When Critical Infrastructure Is Tested, Resilience Matters
James Griffiths, founder of UtopianKnight Consultancy, has been quoted in InfoSecurity Magazine's report on the reported Iranian-linked attack that shut down a UK power plant.
The report, published on 24 August 2026, highlights concerns about the resilience of the UK's critical national infrastructure (CNI). The incident reportedly affected a relatively small facility for several days, but the scale of the site is not the only point worth considering. A successful disruption demonstrates that operational technology environments can be reached and affected, even when the immediate impact appears limited.
Legacy systems remain part of the risk picture
Many essential services rely on technology that was designed for reliability and availability, not for today's connected threat environment. Some of these systems are difficult to patch, hard to replace, and deeply embedded in physical processes. That creates a long-term security challenge: organisations need to improve protection without compromising the stability of the services those systems support.
As I told InfoSecurity Magazine:
The under-investment in protecting our CNI in the UK has always been an issue, with legacy and aged systems running the core of what we take for granted: power.
Resilience has to go beyond prevention
Prevention remains important, but it cannot be the only measure of readiness. Operators need to understand how they will detect abnormal activity, contain an intrusion, maintain essential operations, and recover safely. Those decisions need to be made before an incident, while there is still time to test assumptions and resolve gaps.
This is particularly important across interconnected suppliers and smaller operators. A weakness in one part of the wider ecosystem can create consequences elsewhere, so resilience planning should include third parties, remote access, industrial control systems, and the dependencies that keep services running.
What organisations should do now
- Identify the systems and suppliers that are essential to continued operations.
- Map legacy technology, external connections, and points where an incident could move from IT into operational technology.
- Test containment and recovery plans with the people who would make decisions during a real event.
- Set clear escalation routes and ensure smaller or less visible parts of the supply chain are included.
The question is not whether every incident can be prevented. It is whether the organisation can keep control when prevention fails. For CNI operators, that means investing in visibility, practical recovery capability, and rehearsed decision-making before the next serious disruption.