Securing Critical Infrastructure in a Connected World

The United States is entering a new era of critical infrastructure risk defined by persistent, coordinated, and increasingly sophisticated threats across both digital and physical domains. Participants described a rapidly evolving threat environment in which operational technology environments, industrial control systems, and connected infrastructure are simultaneously becoming more efficient and more exposed. Water systems, transportation networks, energy systems, communications infrastructure, and industrial environments are increasingly interconnected, creating both operational benefits and expanded attack surfaces.

Roundtable participants emphasized that cybersecurity can no longer be treated as a

standalone technical issue. The convergence of cyber and physical infrastructure risk means that digital vulnerabilities now have direct operational consequences, including disruptions to service delivery, safety concerns, economic impacts, and cascading infrastructure failures. Nation-state actors, criminal organizations, and opportunistic threat actors are increasingly operating in parallel, leveraging common vulnerabilities, internet-exposed systems, supply chain dependencies, and operational complexity.

At the same time, many infrastructure sectors continue to rely on aging operational technology platforms and legacy infrastructure that were never designed for today’s connectivity requirements or threat environment.

Read the full white paper here (link to PDF).