Bearings

Public and private entities are not impacted or targeted randomly. The current geostrategic environment shows that adversaries select the target and the hour with care. A hostile actor reads an organisation from material it publishes willingly: procurement notices, maintenance windows, financial calendars, leadership announcements. What that reading reveals is not a vulnerability in any technical sense but a window, a period in which the institution will be slower to convene, slower to authorise and slower to speak. The instruments then arrive in combination rather than in sequence, mixing physical interference, network intrusion, regulatory and legal pressure, economic leverage and information manipulation, which is why a single operation is experienced by an energy company, a municipality, a hospital and a newsroom as four unrelated local problems. This cluster covers how that selection works, why the pattern is so difficult to see from inside any one organisation, and what can be decided responsibly in the months before attribution arrives.

Organisations facing crises rarely fail for lack of information. They routinely fail because the people who held the information were not authorised to act on it. The authority exists somewhere in the plan, but in the first hour it turns out to be held by a person who cannot be reached, or split between two functions that each expect the other to move, or conditional on a committee whose quorum assumes ordinary working days. This cluster examines that gap, in the executive committee and in the organisational arrangement alike. For private operators it ends where it matters commercially, on what a company inherits when a state decides to act, and on how little of that inheritance is ever negotiated beforehand.

Risk registers assume probability and adversaries assume intent, and the two do not combine, which is why an organisation can hold a mature risk register and remain unprepared for the one situation in which the environment is choosing rather than rolling dice. Regulation has begun to close that gap by naming individuals rather than functions, and the management body is now personally answerable for a readiness it has usually certified without ever having seen it demonstrated. This cluster works through the substance of the CER Directive, NIS2 and DORA rather than their summaries, including the parts most often misstated. It sets out the distinction the regulations imply but seldom define, between a capability that is unaddressed, one that is documented, one that was tested some years ago under assumptions that have since changed, and one that is genuinely embedded in how the organisation behaves. It closes on preparedness as a financial object: an unpriced line in valuation, an emerging item in due diligence, and a growing source of exposure for boards.

Nothing an institution depends on is entirely its own, since power arrives across an interconnector owned by another organisation, payments clear through an intermediary chosen for cost, and a critical process runs on a platform maintained by a supplier with a small number of employees. Continuity plans are written on the assumption that failures are accidental and arrive in isolation to each other, which is a reasonable assumption about accidents but a poor one about a failure that has been selected. This cluster works through the mechanics of cascade, showing how one interruption propagates across operators who each hold accurate information about their own position and almost none about the position of the others, and why second and third order effects arrive faster than the coordination meant to manage them. It treats interconnection as an arrangement that distributes resilience in normal conditions and distributes shock in abnormal ones. It then widens to comprehensive security itself, which is a division of labour in which the state relies on operators it does not own and operators rely on authorities they do not command, and is candid about the conditions that arrangement assumes and relies on.

An institution can lose while every system it operates remains perfectly intact, because the disruption is real, the cause is misstated, and the misstatement is faster, simpler and more satisfying than the truth. That interval belongs to whoever moves first, and it is widened by a speed gap the organisation cannot easily close: an operator needs hours to confirm a technical fact, a regulator needs days to authorise a position, and a newsroom is working to a deadline measured in minutes. This cluster addresses the particular difficulty of correcting a false causal claim without amplifying it, why the first statement is the one quoted for the following fortnight regardless of what follows it, and why organisations with several sites and several spokespeople reliably contradict themselves on a tight clock. It treats institutional credibility as an asset that appears on no balance sheet and has no owner in the organisational chart, which is why it is defended late and by whoever happens to be available. For media and public bodies it extends to editorial and source pressure applied deliberately, where the target is not the system but the standing of the institution that operates it.