Deep dive: Critical infrastructure resilience — what's working, what's not, and what's next

In 2024, the United States experienced 27 billion-dollar weather and climate disasters, causing $182.7 billion in damages and 568 fatalities—making it the fourth costliest year on record. The interval between billion-dollar disasters has collapsed from 82 days in the 1980s to just 12 days in 2024. Meanwhile, cyberattacks on U.S. utilities surged 70% compared to 2023, with 42% of critical infrastructure companies reporting successful cyber intrusions. These converging pressures—climate shocks, aging assets, and digital vulnerabilities—have transformed critical infrastructure resilience from a niche engineering concern into an existential priority for governments, corporations, and communities worldwide.

The Critical Infrastructure Protection market reached $148.64 billion in 2024 and is projected to grow to $213.94 billion by 2032 at a 4.73% CAGR, according to SNS Insider analysis. Yet spending alone doesn't guarantee outcomes. The organizations achieving genuine resilience share common patterns: they measure what matters, invest in prevention over reaction, and treat infrastructure interdependencies as first-order concerns rather than afterthoughts.

Why It Matters

Critical infrastructure—energy grids, water systems, transportation networks, telecommunications, healthcare facilities—underpins every aspect of modern society. When these systems fail, the consequences cascade through economies and communities in ways that compound rapidly. The 2024 Hurricane Helene, a Category 4 storm with 140 mph winds, demonstrated how a single event can disable power, contaminate water supplies, and isolate entire regions simultaneously.

The economic case for resilience investment is now unambiguous. According to 2024 analysis from the National Institute of Building Sciences, every $1 invested in resilience generates $13 in avoided recovery costs. Climate-resilient infrastructure carries only a 3% upfront cost premium but delivers a 4:1 benefit-cost ratio over its lifecycle. Despite this, the American Society of Civil Engineers (ASCE) estimates a $3.6-3.7 trillion funding gap for U.S. infrastructure over the next decade, with total investment needs of $9.1 trillion between 2024-2033.

The risks are not limited to natural disasters. The Department of Homeland Security's 2024-2025 Strategic Guidance identifies five priority threat areas: cyber threats from state actors (particularly the People's Republic of China), AI and emerging technology risks, supply chain vulnerabilities, climate impacts, and growing dependency on space systems. These threats interact—a cyberattack during an extreme weather event, for example, could disable backup systems precisely when they're needed most.

For the private sector, infrastructure resilience has become a material financial risk. Insurers paid out approximately 43% of $328 billion in global economic losses from climate disasters in 2024, up from $303 billion in 2023. Companies without credible resilience plans face higher insurance premiums, restricted access to capital, and regulatory scrutiny under emerging climate disclosure requirements.

Key Concepts

Understanding critical infrastructure resilience requires clarity on several foundational concepts that often get conflated in policy discussions.

Resilience vs. Robustness: Robustness means building systems strong enough to withstand anticipated stresses without damage. Resilience means building systems that can absorb unexpected shocks, adapt during disruption, and recover quickly. Modern infrastructure strategies require both—robustness for predictable loads, resilience for tail risks.

Interdependency mapping: Infrastructure systems don't fail in isolation. Power outages disable water pumping stations. Telecommunications failures prevent emergency coordination. Transportation disruptions strand repair crews. Effective resilience planning requires modeling these interdependencies explicitly, identifying single points of failure that could cascade across sectors.

Redundancy vs. diversity: Redundancy means having backup systems (two power lines instead of one). Diversity means having different types of backup systems (grid power plus distributed solar plus battery storage). Redundancy protects against component failure; diversity protects against systemic failure modes that could disable all systems of one type simultaneously.

Mean Time to Recovery (MTTR): The critical metric for resilience isn't whether disruptions occur but how quickly systems return to acceptable function. Top-performing infrastructure operators target MTTR in hours for essential services, not days or weeks.

Adaptive capacity: The ability to modify infrastructure operations and configurations in response to changing conditions—rerouting power flows, activating backup water supplies, shifting traffic patterns. Systems with high adaptive capacity can maintain service even when components fail.

Critical Infrastructure Resilience KPIs by Sector

Sector	Key Resilience Metric	Baseline (2020)	Current (2024)	Target (2030)
Electric Grid	System Average Interruption Duration Index (SAIDI)	475 min	420 min	<300 min
Water Systems	Unaccounted-for water (%)	16%	14%	<10%
Transportation	Critical route redundancy (%)	62%	68%	>85%
Telecommunications	Network uptime (%)	99.5%	99.7%	>99.95%
Healthcare	Backup power duration (hours)	48h	72h	>96h
Ports/Logistics	Days operational post-major event	14d	7d	<3d

What's Working

Distributed Energy Resources and Microgrids

The shift from centralized generation to distributed energy resources (DERs) represents one of the most successful resilience strategies of the past decade. When Hurricane Maria devastated Puerto Rico's centralized grid in 2017, recovery took 11 months. In contrast, facilities with microgrids maintained power throughout. This lesson has driven aggressive DER deployment: U.S. utility capital expenditure reached $179 billion in 2024 and is projected to hit $1.4 trillion by 2030, with significant portions allocated to distributed assets.

The Grid Resilience and Innovation Partnerships (GRIP) Program, funded through the Infrastructure Investment and Jobs Act, has allocated $10.5 billion across 105+ projects specifically targeting grid modernization and resilience. Early results show microgrids reducing outage duration by 60-80% for connected facilities during major storm events.

AI-Powered Predictive Maintenance

Machine learning systems analyzing sensor data can now predict equipment failures 2-4 weeks before they occur, enabling preventive intervention rather than emergency repair. Utilities deploying these systems report 30-40% reductions in unplanned outages and 15-25% decreases in maintenance costs. The technology is most mature in electric transmission, where high-value assets justify sensor deployment costs, but is rapidly expanding to water treatment, transportation, and telecommunications.

Cross-Sector Coordination Protocols

The Cybersecurity and Infrastructure Security Agency (CISA) has substantially improved information sharing between sectors through its National Risk Management Plan, updated in 2025. During the January 2025 LA wildfires—which caused $61.2 billion in damages, making them the costliest wildfire event in U.S. history—coordinated response protocols enabled utilities, telecommunications providers, and transportation agencies to prioritize restoration in sequence, reducing overall recovery time by an estimated 20% compared to historical baselines.

Private Capital Mobilization

Institutional investors have dramatically increased infrastructure allocations, from 3.6% of portfolios in 2019 to 5.7% in 2023, with 94% of limited partners planning to maintain or increase allocations in 2025. Brookfield's Infrastructure Fund V closed at $28 billion—the largest infrastructure fund ever raised—with significant allocations to resilience-focused assets. This capital influx enables projects that government budgets alone couldn't support.

What's Not Working

Underinvestment in Prevention

Despite the 13:1 return on resilience investment, most spending still flows to disaster response rather than prevention. FEMA's disaster budget was half depleted within the first eight days of fiscal year 2025, forcing the agency into "Immediate Needs Funding" status—a condition that has occurred only 10 times since 2001. Annual climate disaster relief now costs approximately $150 billion, resources that could fund prevention infrastructure if allocated differently.

Aging Asset Base

The average U.S. bridge is 47 years old against an expected 50-year lifespan, with 6.8% rated in poor condition. Energy, aviation, and transit infrastructure received D-range grades in the ASCE's 2025 Infrastructure Report Card. While no category received D- or lower for the first time (the overall grade improved to C from C- in 2021), the improvement rate lags the deterioration rate for many asset classes.

Cybersecurity Gaps

Despite increased attention, critical infrastructure cybersecurity remains inadequate. Ransomware attacks on industrial operators increased 46% in January 2025 alone. Utilities face an average of 1,728 cyberattacks per week per organization—a 47% year-over-year increase. The April 2025 Spain power outage, which caused widespread blackouts, remains under investigation for potential cyberattack origins targeting renewable generators. Many smaller utilities and water systems lack resources for basic cyber hygiene, let alone sophisticated threat detection.

Siloed Planning

Infrastructure sectors still largely plan in isolation. Transportation agencies optimize road networks without modeling power grid constraints. Water utilities design systems without accounting for telecommunications dependencies. This siloed approach creates hidden vulnerabilities that only become apparent during multi-system failures. The 2024 DHS Strategic Guidance explicitly calls for improved cross-sector planning, but implementation remains inconsistent.

Insurance Market Stress

Climate risk is straining traditional insurance models. Insurers are retreating from high-risk regions, leaving infrastructure operators self-insured or unable to transfer risk at any price. This creates a dangerous dynamic: operators who most need capital for resilience investments are least able to access it.

Key Players

Established Leaders

Honeywell — Commands 8-9% of the critical infrastructure protection market with integrated building automation, physical security, and cybersecurity solutions. Their Forge platform provides unified asset management across facility types.

Thales — The French multinational holds 6-7% market share, specializing in cybersecurity, encryption, and secure communications for utilities and government infrastructure. Their 2024 report documented that 42% of critical infrastructure companies experienced cyber intrusions.

Northrop Grumman — Provides defense-grade cyber solutions and threat detection systems, with particular strength in protecting energy and communications infrastructure from sophisticated state-actor threats.

BAE Systems — Offers comprehensive physical and cyber security integration, including access control, surveillance, and threat intelligence tailored to critical infrastructure environments.

Lockheed Martin — Delivers radar, sensors, and cyber training capabilities, with specialized testing and evaluation programs for infrastructure operators.

Emerging Startups

Darktrace — AI-driven autonomous threat detection and response, using machine learning to identify anomalous behavior across operational technology networks without requiring predefined attack signatures.

Deepwatch — Provides managed security operations and extended detection and response (XDR) specifically tailored for infrastructure operators who lack internal security operations capacity.

Dragos — Industrial cybersecurity platform focused on operational technology (OT) environments in energy, manufacturing, and water sectors, with threat intelligence specific to infrastructure attack patterns.

One Concern — Climate resilience analytics platform providing scenario modeling and risk quantification for infrastructure portfolios, enabling risk-informed capital allocation.

Key Investors

Brookfield Asset Management — Raised $104 billion for infrastructure strategies between 2020-2024, with the $28 billion Infrastructure Fund V specifically targeting resilient and transition-ready assets.

Blackstone Infrastructure Partners — Manages $32.5 billion focused on digital infrastructure and resilience, pioneering open-end fund structures that provide long-term patient capital.

Copenhagen Infrastructure Partners — Raised $25.5 billion with emphasis on energy transition and greenfield resilience projects, particularly in Northern Europe.

Antin Infrastructure Partners — Manages $28.8 billion across energy, transport, and social infrastructure in Europe and North America, with growing allocation to climate adaptation.

Examples

Duke Energy's Grid Investment Program: The utility invested $75 billion over 2020-2024 in grid modernization, including underground power lines, automated switches, and vegetation management. During 2024's Hurricane Helene, Duke restored power to 2 million customers in 72 hours—50% faster than comparable historical events. Their approach demonstrates how sustained capital investment, combined with modern switching technology that can automatically isolate faults and reroute power, delivers measurable resilience outcomes.

Singapore's Deep Tunnel Sewerage System: Facing sea-level rise and increasing storm intensity, Singapore invested $3.7 billion in a 48-kilometer underground superhighway for wastewater, replacing surface infrastructure vulnerable to flooding. The system, completed in phases through 2025, provides 100-year flood protection and frees surface land for development. It exemplifies how infrastructure renewal can simultaneously address climate resilience and land scarcity.

Los Angeles Department of Water and Power (LADWP) Cybersecurity Transformation: Following a 2023 audit revealing significant vulnerabilities, LADWP invested $200 million in cybersecurity upgrades, including network segmentation, operational technology monitoring, and 24/7 security operations. The investment proved critical during the January 2025 wildfire response, when the utility's systems remained operational despite attempted intrusions during the crisis—demonstrating how cyber resilience enables physical emergency response.

Action Checklist

• Conduct interdependency mapping across all critical infrastructure assets to identify cascade failure pathways
• Implement predictive maintenance using sensor data and ML models for high-value assets with MTTR targets
• Establish mutual aid agreements with peer organizations for equipment, personnel, and expertise sharing during events
• Deploy distributed energy resources or microgrids for critical facilities requiring uninterrupted operation
• Upgrade cybersecurity posture with OT-specific monitoring, network segmentation, and incident response plans
• Secure adequate insurance or alternative risk transfer mechanisms; if traditional insurance is unavailable, evaluate parametric instruments
• Build organizational capacity through regular tabletop exercises simulating multi-system failures
• Engage with sector-specific Information Sharing and Analysis Centers (ISACs) for threat intelligence

FAQ

Q: How do we prioritize resilience investments when budgets are constrained? A: Focus first on assets where failure would cascade to multiple systems—typically substations, water treatment facilities, and major telecommunications nodes. Use scenario modeling to quantify the cost of various failure modes, then prioritize investments with the highest ratio of avoided loss to capital cost. The 4:1 benefit-cost ratio for resilience investments suggests even modest prevention spending outperforms reactive approaches.

Q: What's the right balance between hardening existing infrastructure versus building redundancy? A: Neither alone is sufficient. Hardening protects against anticipated stresses but fails against novel threats. Redundancy provides backup but adds cost and complexity. The emerging best practice is "graceful degradation"—designing systems that can lose components while maintaining essential functions at reduced capacity, then recover incrementally. This requires both robust individual assets and flexible system architectures.

Q: How should organizations approach cyber-physical convergence in infrastructure? A: Start by inventorying all operational technology (OT) assets connected to networks—many organizations undercount by 40-60%. Implement network segmentation to prevent IT compromises from reaching OT systems. Deploy OT-specific monitoring that understands industrial protocols. Most importantly, include cybersecurity in all physical infrastructure planning, not as an afterthought. The cost of retrofitting security is typically 3-5x higher than designing it in.

Q: What role should climate scenarios play in infrastructure planning? A: Organizations should plan for conditions 20-30 years ahead, not historical averages. This means using climate scenario data (RCP 4.5 or RCP 8.5 pathways) to inform design parameters for temperature extremes, precipitation intensity, sea level, and storm frequency. Assets built today will operate through 2050-2070; designing for 1990 conditions guarantees inadequacy.

Q: How do we measure resilience progress beyond dollars spent? A: Track outcome metrics rather than input metrics. Key performance indicators include: Mean Time to Recovery (MTTR) after disruptions, percentage of assets with real-time monitoring, cross-sector exercise participation rates, and post-event performance versus pre-event predictions. Organizations should also track near-misses and partial failures, not just complete outages—these early indicators often predict future full failures.

Sources

• NOAA National Centers for Environmental Information, "Billion-Dollar Weather and Climate Disasters," January 2025
• Department of Homeland Security, "Strategic Guidance and National Priorities for U.S. Critical Infrastructure Security and Resilience 2024-2025," June 2024
• American Society of Civil Engineers, "2025 Infrastructure Report Card," March 2025
• SNS Insider, "Critical Infrastructure Protection Market Size & Forecast 2032," November 2024
• National Institute of Building Sciences, "Natural Hazard Mitigation Saves: 2024 Report," September 2024
• Thales Group, "2024 Critical Infrastructure Protection Report," October 2024
• Infrastructure Investor, "Infrastructure Fundraising Report 2024," December 2024
• CISA, "National Infrastructure Risk Management Plan," January 2025