Energy crises no longer arrive one at a time

More than half a million Ukrainian households lost power last week after one of Russia’s largest missile and drone attacks in months damaged energy infrastructure across the country. Ukraine says its energy sector has been hit more than 2,000 times since mid-July.

In the Middle East, renewed attacks on Saudi infrastructure have pushed oil prices sharply higher and increased fears of further disruption to global energy supplies.

And in Europe, millions of bank customers temporarily lost access to services after a power event at a third-party facility disrupted part of a major cloud provider's European network.

The incidents are very different. But together they illustrate a challenge that energy companies and other critical infrastructure operators increasingly face: disruption does not respect sectors, organisational charts, or traditional risk categories.

“Many organisations still analyse cyber risks, physical security risks, supply-chain risks, and business continuity risks separately. The problem is that real crises rarely follow organisational boundaries,” says Mikael Toll, Senior Advisor Resilience in Sweden at Ramboll.

For Mikael Toll, the individual threats are largely familiar. What has changed is the environment in which they occur.

Digitalisation has created new dependencies. Global supply chains and efficiency have reduced inventories and spare capacity. Energy, telecommunications, transport, software, and logistics increasingly rely on one another. At the same time, geopolitical instability has returned as a major consideration for critical infrastructure.

That means several disruptions can reinforce each other.

Information may become fragmented. Suppliers may be unavailable. Communications can fail while damaged infrastructure still needs repairing. And organisations may discover that alternatives they expected to have are not actually available.

“The challenge is that resilience has not increased at the same pace as awareness,” Mikael Toll says.

His concern is therefore less about predicting the next crisis than ensuring organisations retain enough capacity and flexibility to respond when events develop differently from their plans.

He adds: “No single organisation owns the entire problem. As a result, no single organisation can create resilience on its own.”

For energy leaders, that may be the uncomfortable lesson from today’s threat landscape: preparing for individual risks is no longer enough.

Explore our services in energy sector.