Key Takeaways
- Cyber threats are increasingly targeting operational technology (OT) controlling physical infrastructure (utilities, healthcare, transportation), moving beyond data breaches to risks affecting essential services and public safety.
- The insurance industry faces unprecedented systemic risk challenges, as single OT vulnerabilities can trigger simultaneous losses across multiple policy lines (cyber, property, business interruption, etc.) and vast geographic regions due to widespread technology dependencies.
- Long lifecycles of critical infrastructure assets (often decades) complicate risk assessment and liability, as connectivity and remote access decisions made today will influence vulnerability for the useful life of the infrastructure.
- Effective cyber-physical risk management requires breaking down organizational silos; responsibility spans IT, facilities, engineering, operations, and safety teams, necessitating board-level governance focused on understanding critical systems and potential disruption impacts.
- Adversaries are pre-positioning within infrastructure systems, and AI advancements are lowering attack barriers, increasing threats from both nation-states and criminal groups whose financially motivated actions can cause unintended physical disruptions.
- Insurance models designed for localized natural catastrophes are inadequate for cyber-physical risk; new risk transfer products and evolved professional standards are needed to address systemic, cross-industry exposure.
Cyber-Physical Risk Shifts Focus from Data to Physical Safety
For decades, cybersecurity centered on protecting data, preventing ransomware, and avoiding business system disruptions. However, discussions at the Cyber Safety Summit in Washington, D.C., hosted by the National Academy of Sciences and supported by groups like Building Cyber Security and the Society of American Military Engineers, revealed a critical evolution: threats now increasingly target systems governing the physical world. Experts emphasized that as buildings, utilities, transportation, healthcare, and industrial operations become interconnected, cyber risk has transcended the IT department. It is now a pervasive operational and governance challenge where incidents can disrupt essential services like power, water, or medical care, posing direct risks to public safety—not merely inconveniences like blocked social media access.
DHS Warns of Adversary Pre-Positioning and AI-Lowered Barriers
Nick Andersen, acting director of CISA within the Department of Homeland Security, articulated a stark threat landscape. He contrasted today’s environment with pre-regulation medicine, where unproven "magic elixirs" were sold to consumers, highlighting the current lack of standardized, robust cyber-physical defenses. Andersen stressed that adversaries are not just launching random attacks but are actively pre-positioning within critical infrastructure systems, lying in wait for opportune moments to strike. Furthermore, he warned that advances in artificial intelligence are dramatically reducing the technical expertise required for sophisticated cyber attacks, enabling a far broader range of actors—including less-skilled criminals—to deploy capabilities once reserved for nation-states. This democratization of cyber threat tools significantly amplifies the risk profile for essential services.
Insurance Confronts Unprecedented Systemic Risk Aggregation
Insurance leaders at the summit, particularly Gerry Kennedy of Observatory Strategic Management, framed cyber-physical risk as a fundamental challenge to traditional risk models. Kennedy noted that while insurers have refined models for localized catastrophes like hurricanes or wildfires over decades, operational technology introduces a terrifying new dimension: the potential for a single vulnerability to exist identically across thousands of facilities spanning multiple regions simultaneously. This "aggregation of risk" means a cyber event exploiting a widely used OT platform could trigger correlated losses across numerous insurance lines—cyber, property, business interruption, professional liability, workers’ compensation, environmental, and even directors and officers coverage—at once. As Sezaneh Seymour of Coalition observed, insurers often unknowingly concentrate risk by covering many clients dependent on the same technology, akin to insuring every house on a single beach. Steven Schwartz of FireTower Risk Solutions added that standard property policies frequently exclude cyber-attacks, leaving a critical gap in coverage today, necessitating innovative risk transfer solutions.
Long-Lived Infrastructure Assets Complicate Risk and Liability
Nicholas Leiserson from the Institute for Security and Technology highlighted a uniquely challenging aspect of cyber-physical risk: the extreme longevity of critical infrastructure assets. Decisions made today regarding connectivity, remote access, and the integration of operational technology into systems like power grids, water treatment plants, or manufacturing lines will persist for decades—the typical useful life of such infrastructure. This creates significant difficulty in assigning liability for future cyber incidents stemming from present-day design or procurement choices. Leiserson emphasized that disruptions don’t stay isolated; they ripple through interconnected systems. An attack on a transportation hub, for example, can swiftly disrupt logistics, supply chains, regional economies, and even healthcare access, demonstrating how cyber-physical risk inherently demands broader business continuity and resilience planning beyond the initial point of compromise.
Governance Failure: Silos Obstruct Effective Risk Management
A resounding theme from the summit was that cyber-physical risk cannot be managed effectively by IT or security teams alone, exposing a critical governance gap. Alison King of Forescout argued that while traditional cybersecurity programs reside within IT departments, operational technology systems controlling physical processes often fall under facilities, engineering, manufacturing, operations, or safety divisions. As these domains converge through digital connectivity, responsibility becomes fragmented and poorly coordinated. King stressed that relying solely on technical controls is insufficient; organizations must prioritize risk mitigation (reducing exposure proactively) over mere risk transfer (like purchasing insurance). For boards and executives, this necessitates moving cyber-physical risk discussions from technology or audit committees into core enterprise risk strategy. Directors must urgently understand which OT systems are networked, identify the services vital to ongoing operations, and rigorously evaluate how disruptions to physical processes would cascade to impact customers, employees, and the surrounding community—questions fundamental to organizational resilience.
Evolving Standards Needed for a Connected Physical-Digital Future
The Cyber Safety Summit concluded that cyber-physical risk has irrevocably transcended its origins as a purely cybersecurity concern. As digital connections proliferate across buildings, factories, hospitals, and transit networks, cyber incidents will increasingly manifest as tangible threats to physical operations, public safety, and economic stability. This reality demands a fundamental shift: cyber-physical risk must be addressed as an core operational resilience issue, a strategic governance priority requiring board oversight and cross-functional collaboration, and an insurance challenge necessitating entirely new risk modeling and transfer mechanisms. Professional fields like architecture, engineering, and construction—which already carry liability for physical safety through errors and omissions or builders’ risk insurance—must now explicitly encompass cyber risk inherent in their designs and specifications. Ultimately, safeguarding critical infrastructure in this era demands evolving not just technical defenses, but also insurance frameworks, professional standards, and organizational governance to meet the profound implications of a world where the digital and physical are inseparable. (Word Count: 998)