A New Geography of Risk For a long time, the protection of critical infrastructure followed two distinct logics. On one side, cybersecurity — the domain of engineers and IT managers. On the other, the

A New Geography of Risk

For a long time, the protection of critical infrastructure followed two distinct logics. On one side, cybersecurity — the domain of engineers and IT managers. On the other, the physical defense of sensitive sites, entrusted to the military and law enforcement. Recent events show that this separation no longer holds. A single week can bring together a wave of intrusions into the financial system of an advanced economy, missile and drone strikes against energy installations in the Middle East, a fire paralyzing the main pipeline of a producing country, and a diplomatic debate over how to measure time. These events have no direct link to one another. Taken together, they nonetheless sketch a single reality: contemporary societies rest on chains of dependency whose every link can become a point of failure.

The term systemic risk, long reserved for finance, now applies to all vital networks: energy, transport, payments, communications, public health, time synchronization. A local incident does not stay local. It spreads to other systems. This analysis examines the broad outlines of this transformation, from digital threats to kinetic attacks, then the question that follows: how to finance a resilience that has become indispensable in a constrained budgetary context?

Finance, Front Line of the Digital Battlefield

Seoul Sounds the Alarm

In South Korea, a series of cyberattacks resulted in the leak of customers' personal data at several financial institutions. Authorities reacted swiftly. The chairman of the Financial Services Commission (FSC), Lee Eog-weon, urgently summoned the heads of banking institutions and industry associations. He ordered them to conduct in-depth internal inspections without delay and to systematically transmit their findings to the regulator.

This response illustrates a doctrinal shift. IT security is no longer treated as a compliance matter specific to each institution. It has become a stability issue for the entire system. When several actors are hit simultaneously, the question is no longer merely who failed. It is also about identifying shared vulnerabilities: common service providers, standardized software, homogeneous authentication practices. The sector-wide audit imposed by the FSC stems from this recognition. Trust in a financial ecosystem is managed collectively, and a breach at one institution weakens the credibility of all.

Fraud, a Cross-Border Industry

The financial threat does not only take the form of spectacular intrusions. It has industrialized into more diffuse forms: telecommunications scams, SIM-swap fraud, illegal online betting networks. These circuits now link Africa and Asia. On September 10, Beijing convened security ministers and police chiefs from East Africa in Lianyungang to address online fraud, terrorism and kidnappings. China launched the International Alliance Against Telecom Fraud and Cybercrime, with 46 founding countries.

The initiative has a dual purpose. For African states, it offers technical and operational support against sophisticated criminal flows that few national administrations can combat alone. For Beijing, it extends a security footprint across the continent without formal military alliances. The fight against cybercrime thus becomes an instrument of influence. Digital police cooperation creates technical and normative dependencies as structuring as those born of investments in ports or roads.

Viral Assets, the Blind Spot in Investor Protection

France has chosen a different approach to a neighboring phenomenon. The Official Journal published a list of financial terms translating the anglicism "meme coin" as "jeton mème" or "cyberjeton mème." These terms are now binding on administrations, on the recommendation of the Commission for the Enrichment of the French Language. The official definition includes an explicit warning against the heightened fraud risks associated with these assets. The example of the $TRUMP token, linked to nearly two billion dollars in investor losses, shows the scale of the sums at stake. This lexical response may seem modest. It nonetheless reflects a realization: the boundary between speculation, fraud and digital manipulation is becoming porous, and public education is part of the defenses.

Energy, Prime Target of Conflicts

Ukraine, Laboratory of War Against Networks

No theater better illustrates the militarization of critical infrastructure than Ukraine. Russian strikes methodically target productive capacity, ports and the energy system, eroding the country's GDP. Kyiv's daily military spending reaches 190 million dollars. In this context, protecting the energy grid is no longer a technical matter. It conditions the country's economic and social survival as winter approaches.

German Chancellor Friedrich Merz's surprise visit to Kyiv, accompanied by Economy Minister Katherina Reiche and industrial leaders, shows how this issue is now handled. Berlin has formalized a comprehensive aid package of more than 1.3 billion euros, devoted to both the military effort and the restoration of energy infrastructure. An envelope of 350 million euros is specifically earmarked to consolidate Ukraine's energy grid before winter. The industrial component is equally significant: coproduction agreements cover interceptor drones designed by Quantum and long-range missiles, with the participation of industrial players such as Siemens Energy, Hensoldt, Diehl Defence and Helsing.

This arrangement reflects a logic that other European countries should watch closely. The resilience of an electricity grid under attack rests on three inseparable pillars. There must be active defense, with the interception of drones and missiles. There must be rapid repair capacity, which requires available equipment and technical skills. And there must be an industrial base capable of producing at volume. In defending this aid against domestic criticism, notably from the AfD, the chancellor argued that Germany's and Europe's security depends directly on Ukrainian resistance. The critical infrastructure of a partner country thus becomes a component of collective security.

The Reciprocity of Vulnerabilities

War against infrastructure works both ways. In Russia, Ukrainian strikes on refineries add to already severe economic tensions: persistent inflation, labor shortages, military spending that widens the budget deficit and drains the National Wealth Fund. The "military Keynesianism" that sustained activity is now hitting its limits. An economy whose revenues rest largely on hydrocarbons discovers it is vulnerable at the very heart of its model when its refining facilities become accessible to enemy drones.

Gulf and Red Sea: The Threat to Global Flows

In the Middle East, the resumption of the Yemeni conflict has revived a threat that markets had partly forgotten. Houthi rebels claimed a ballistic missile and drone attack on an Aramco facility in Riyadh, followed by visible fires. Saudi authorities did not confirm the strike. The Saudi-led coalition retaliated with nearly a hundred strikes against Houthi reinforcements on several fronts. The Yemeni government army claimed to have killed 700 Houthi fighters in twenty-four hours and bombed Sanaa and Saada.

This escalation follows the collapse in July of a truce in force since 2022. Its implications extend far beyond the region. The Houthis have strengthened their control over the Red Sea coast and the Bab el-Mandeb strait, a strategic passage for global oil trade. A land-based energy installation and a maritime route can thus be threatened simultaneously by the same non-state actor, equipped with means that are both relatively cheap and highly effective. For insurers, shipowners and energy importers, the risk becomes difficult to model, as it depends on volatile political dynamics rather than technical parameters.

When the Incident Is Not Military

Not all disruptions come from conflict. In Ecuador, a fire on October 1 at a pumping station of the Trans-Ecuadorian Pipeline System (SOTE) led state-owned EP Petroecuador to declare force majeure. Technical teams are working around the clock to restore pumping within six days. A unit specializing in hydrocarbon-related offenses has opened an investigation to determine the cause of the blaze. The stakes are considerable for a country whose production exceeds 360,000 barrels per day. The case recalls a simple rule: when an economy depends on a single facility, a single point of failure is enough to suspend a major share of its exports.

Time, Invisible Infrastructure

Among systemic risks, one of the most surprising concerns the measurement of time. Meeting in Versailles for the 28th General Conference on Weights and Measures, diplomats and scientists are examining a reform aimed at eliminating the periodic adjustment by leap second. The reason lies in an unexpected physical phenomenon: the Earth's rotation is accelerating. This acceleration raises for the first time the prospect of a negative leap second — the need to remove a second from global clocks.

For computer, financial and telecommunications systems, this scenario has never been tested at scale. The potential cost of a malfunction is estimated at 300 billion dollars, an order of magnitude that stakeholders compare to the Y2K bug. Trading platforms, software publishers and major technology companies such as Meta are following the matter closely. The International Bureau of Weights and Measures recommends widening to as much as one hour the tolerated gap between atomic time and Earth's rotation starting in 2027, to secure systems over the very long term.

Russia is slowing this rapid transition, due to the immediate incompatibility of its Glonass satellite navigation system, for both civilian and military use, with the new approach. The episode shows that an apparently neutral technical convention can become a sovereignty issue. Time synchronization now falls within the strategic domain, just like undersea cables or satellite constellations.

Hybrid Warfare and Democratic Integrity

Armies Train for Tomorrow's Conflict

General staffs have integrated this convergence of threats. More than 3,500 military personnel from Azerbaijan, Turkey and Uzbekistan took part for the first time in the joint exercise "Power of Unity 2026" in the Karabakh region. Scenarios combined drone attacks, cyberattacks, disinformation and naval operations in the Caspian Sea. Several states, including Iran and Georgia, observed the maneuvers. The mere fact of including cyberattack and information manipulation in a conventional military exercise speaks volumes: these dimensions are no longer ancillary, they are part of the battlefield.

The Electoral Process, Infrastructure of Trust

The electoral process constitutes another critical infrastructure, often overlooked in technical analyses. In Brazil, the vote tallying room of the Superior Electoral Court (TSE) mobilizes around 120 staff to oversee a fully automated and encrypted count, which begins as soon as the first results arrive from Australia. Wrongly labeled a "secret room" by Jair Bolsonaro in 2022, it has been opened to journalists, international observers and political parties. Judge Dias Toffoli stressed the importance of a serene vote.

This transparency effort responds to a new reality. The resilience of an electoral system depends not only on the robustness of encryption. It also depends on institutions' ability to demonstrate that robustness in the face of disinformation. A system that is technically secure but perceived as opaque remains vulnerable, because public trust is itself a resource the adversary seeks to weaken.

Climate and Aging: The Other Face of Vulnerability

Resilience is not limited to intentional threats. Equipment wear and climate disruption also weigh heavily on networks. In France, SNCF chief Jean Castex eventually described the past summer as an "exceptional summer." The scientific community nonetheless reminds us that heatwaves, droughts and megafires are likely to become routine. The gap between these two readings is telling. As long as an operator treats a hazard as exceptional, it manages it as a crisis. If it recognizes it as structural, it must make it a design parameter, with budgetary consequences of a different magnitude.

In Germany, Deutsche Bahn illustrates the weight of accumulated underinvestment. Its chief, Evelyn Palla, tempered expectations on punctuality by recalling the decrepitude of a rail network neglected for many years. The operator is simultaneously making permanent its 99.99-euro family ticket, which attracted 100,000 additional families compared with the previous year. The contrast is striking: demand is growing faster than the capacity of a weakened infrastructure to absorb it. The same country is expanding its electric charging network, which now exceeds 209,000 public points, up 24%. Each new layer of electrification reinforces the dependence of daily uses on grid stability.

Public health follows the same logic. In Pennsylvania, a measles outbreak caused five deaths and affected nearly a thousand people across 39 counties. Only seven of the state's 67 counties have their own health department. This structural gap complicates tracing and vaccination. A health infrastructure that is deficient in normal times becomes an aggravating factor in times of crisis, exactly like an electricity grid without redundancy.

Financing Resilience Under Constraint

The Budgetary Trade-Off

Therein lies the entire difficulty. Strengthening infrastructure is expensive, while budgetary margins are shrinking. In Brussels, the regional government led by Boris Dilliès must close a projected deficit of 957 million euros to return to balance by 2029. It has frozen hiring in the civil service and suspended the Metro 3 project. The unexpected loss of 129 million euros in European subsidies worsens the equation. This example shows how major infrastructure projects become adjustment variables when pressure from rating agencies intensifies. It is a paradox: immediate financial sustainability can come at the cost of lower long-term resilience.

Mobilizing Savings Toward the Long Term

Emerging economies face the same challenge on a different scale. Vietnam estimates its investment needs at 1,480 billion dollars by 2030, of which 80% should come from private funds. The World Bank, through Mariam J. Sherman, recommends diversifying funding sources by developing the bond market and improving the sovereign rating, without saturating bank credit.

Africa suffers from an even starker paradox. The continent holds around 4,000 billion dollars in domestic capital, but less than 500 billion benefits from a formal rating. Fewer than 4,000 ratings were issued there in 2025, compared with more than two million in the United States. This information deficit locks savings into short-term liquid instruments and diverts them from the long-term investments on which energy and infrastructure depend. The launch of the Africa Credit Rating Agency (AfCRA) aims precisely to fill this gap, through a more contextual reading of risk. Infrastructure resilience begins here, upstream, in the quality of the financial information that makes it possible to finance them.

Concentration, Factor of Power and Fragility

The Kenyan port of Lamu offers a final example of the ambivalence of large infrastructure. Its 17.5-meter-deep berths allowed the container ship MV Hamouna to unload around 5,200 containers in a single call, a record. The port must also support the future 16-billion-dollar refinery of the Dangote group, designed for 700,000 barrels per day. This concentration of energy and logistics assets strengthens the region's strategic weight. It also creates a choke point whose protection, both physical and digital, must be designed from the outset rather than added after the fact.

Outlook: From Protection to Resilience Architecture

Several lessons emerge. First, the boundary between cyber, kinetic and climate threats is erasing. A single network can be struck by a drone, compromised by an intrusion, damaged by a fire or weakened by a heatwave, and the responses must be integrated. Second, resilience is becoming a geopolitical issue: alliances against cybercrime, aid for energy reconstruction, time measurement standards — each of these subjects serves as a field of influence. Finally, financing remains the weak link. Without mechanisms capable of directing savings toward the long term and protecting investment budgets from cyclical cuts, talk of resilience risks remaining declaratory.

Public and private decision-makers must change scale. It is no longer enough to protect assets one by one. Interdependencies must be mapped, single points of failure identified, and the fact accepted that redundancy has a cost — one that remains lower than the cost of collapse. Recent crises show that once the chain breaks, the cost of inaction runs into the hundreds of billions.

This article was written with the assistance of artificial intelligence and verified by our editorial team.