Security is a top priority for any organization responsible for safeguarding critical infrastructure. However, recent events have highlighted the fragility of the global energy supply chain and the need for change.
When tankers cannot safely navigate the Strait of Hormuz, fuel prices rise and public anxiety grows. This often results in long lines at the fuel pump and fears of shortages quickly becoming a self-fulfilling prophecy.
The reality is that critical infrastructure will always be a target because those seeking to disrupt, cause harm or force change — militarily, economically, politically or socially — understand both its physical and psychological impact.
Regulating for resilience
While headlines focus on political debates over who should keep shipping lanes open, critical infrastructure organizations and governments are moving forward with new physical and cyber safeguards to protect sites closer to home.
Before recent Middle East events, CISA’s 2025 review outlined efforts to strengthen U.S. securityWeeks before recent events in the Middle East, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released its 2025 review outlining major actions taken to strengthen national cyber and physical defences. Meanwhile, in Europe, the Critical Entities Resilience (CER) Directive will take effect across the EU in July, with member states such as Germany advancing early through its KRITIS framework to establish a model for CER compliance.
These initiatives extend to energy supplies, from power stations (gas, electricity and nuclear), refineries and pipelines, substations, water treatment facilities, data centers and food production. And while increased investment in renewable energy may reduce reliance on overseas supply, wind and solar farms remain potential targets as well. Fortunately, the likelihood of missile strikes on critical infrastructure is low in many regions. But the risks of trespassing, espionage, sabotage, terrorism and protest activity are far higher.
Protection and detection
Security levels vary widely across critical infrastructure. A large power station may employ live-monitored CCTV, video analytics, alarms, sensors, access control, fencing and other heightened defences. In contrast, a rural electrical substation may rely on a single unmonitored camera, a perimeter fence and a basic alarm.
Despite significant annual investment, organizations often lack the ability to connect these systems. Without integrated systems, real-time situational awareness — understanding what happened, how it began, what is occurring now and how to respond — is nearly impossible. Operators typically manage large portfolios of sites spread over vast and often challenging geographies. Only by integrating siloed systems and linking multiple sites into a centralized operation can true enterprise-wide visibility be achieved.
Video management system
A centralized insight layer (PSIM) ensures incidents are detected using all available resources
For example, a perimeter breach at a substation might initially appear to be an isolated incident. But combined with a similar incident at another site, it could indicate the start of a coordinated attack.
A centralized insight layer (often referred to as a PSIM — Physical Security Information Management system) ensures incidents are detected using all available resources. A perimeter alarm — triggered by a steel fence sensor or a 3D LiDAR system — initiates an alert and the video management system automatically displays the relevant live camera feed and recent footage. Operators can follow predefined workflows to lock down areas, dispatch first responders or initiate evacuations. Automated actions, such as playing recorded announcements over public address systems, can also occur. Rapid, effective response is essential for safety, security and ensuring uninterrupted service to customers.
Resilient supply chains require security measures that function from the source to the point of service. Recent geopolitical and environmental events, such as severe flooding, have shown how quickly disruption to one link can trigger widespread consequences. However, critical infrastructure operators can strengthen resilience by leveraging the robust systems they already have, improving their ability to detect and respond to threats.
