Securing Critical Infrastructure in a Connected World

The United States is entering a new era of critical infrastructure risk defined by persistent, coordinated, and increasingly sophisticated threats across both digital and physical domains. Water systems, transportation networks, energy systems, communications infrastructure, and industrial environments are increasingly interconnected, creating both operational benefits and expanded attack surfaces. These interconnected environments also create significant dependencies and interdependencies across critical infrastructure sectors, meaning organizations are increasingly reliant on external systems, services, and infrastructure outside of their direct control. As a result, disruptions or compromises affecting one organization or sector can quickly cascade across the broader critical infrastructure ecosystem.

Roundtable participants emphasized that cybersecurity can no longer be treated as a standalone technical issue. The convergence of cyber and physical infrastructure risk means that digital vulnerabilities now have direct operational consequences, including but not limited to: disruptions to service delivery, safety concerns, economic impacts, and cascading infrastructure failures. Nation-state actors, criminal organizations, and opportunistic threat actors are increasingly operating in parallel, and more frequently in coordination, leveraging common vulnerabilities, internet-exposed systems, supply chain dependencies, and operational complexity.

At the same time, many infrastructure sectors continue to rely on aging operational technology platforms and legacy infrastructure that were not designed for today’s connectivity requirements or threat environment. Additionally, participants discussed how workforce shortages, funding limitations, fragmented governance, and uneven visibility across infrastructure ecosystems can further complicate resilience efforts.

Read the full white paper here.