Why the EU’s Crisis Preparedness Needs a Digital Backbone
The European Union recently urged its citizens to stock up on essentials—water, food, torches, medicine—for at least 72 hours in case of a major disruption. The recommendation, outlined in a report by the Financial Times, is part of a broader push to improve resilience in the face of climate events, potential conflict, or breakdowns in critical infrastructure.
It’s a prudent message—but only partially complete.
In our increasingly digital-first world, real resilience cannot stop at flashlights and food rations. The invisible layer supporting every modern emergency response is digital. From electricity to emergency services, healthcare to food logistics, everything runs on code. So, the question becomes: if the digital infrastructure breaks down, what good is a stockpile?
Avoiding Panic, Encouraging Preparedness
First, let’s be clear: cyber security professionals—and public leaders—must walk a fine line. Our goal is not to cause alarm or stoke fear.
One of the key strategies of threat actors is to spread chaos. If we in cyber security create unnecessary social alarm, we may be contributing to the very disruption we aim to prevent.
That’s why it’s essential to approach this conversation with calm, perspective, and facts. Risk is real—but preparation is powerful. And digital resilience should be seen as an extension of personal and public safety planning—not a reason to panic, but a reason to plan smartly.
When the Threat is Digital—and the Consequence is Physical
If the power goes out during a storm, most people reach for their emergency flashlight. But what happens if the power outage wasn’t caused by wind or heat—but by a cyber attack?
This isn’t hypothetical. In 2015, over 230,000 residents in Ukraine were left in the dark during a coordinated cyber attack on the power grid. Backup systems were disabled. Operations had to be restored manually. A second attack the following year confirmed this wasn’t a fluke—it was the new face of modern conflict.
In 2021, the Colonial Pipeline incident showed how a single compromised password could disrupt half the fuel supply to the eastern United States. Panic buying ensued. Flights were grounded. Gas stations emptied out. No natural disaster caused it—just ransomware.
During the COVID-19 pandemic, cyber attacks on European hospitals had life-or-death consequences. One patient in Germany died after an emergency room was shut down by ransomware, forcing a long and ultimately fatal rerouting.
And increasingly, attackers don’t even need to shut systems down to do damage. In the Russia-Ukraine war, deepfakes, fake evacuation orders, and disinformation campaigns flooded social media—undermining trust in institutions and creating widespread confusion.
Resilience today isn’t just about sheltering from the storm. It’s about ensuring the digital systems we depend on are functional and protected when the storm hits.
Infrastructure Is Only as Resilient as Its Budget
Resilience doesn’t begin at the firewall—it begins with strategy. And unfortunately, in many critical sectors, that strategy is missing or underfunded.
Cyber security isn’t just a corporate issue. It’s a public one. Small and medium-sized businesses, municipal governments, and even agriculture sectors are all increasingly digital—and vulnerable.
- Farmers rely on OT (operational technology) to manage crops, irrigation, storage, and distribution. These systems are often connected—but not secured. A targeted cyber attack could paralyze food supply across entire regions.
- SMBs make up the backbone of European economies. If their operations are disrupted—whether in logistics, manufacturing, or retail—supply chains collapse, livelihoods are lost, and local communities suffer.
- Public services are equally fragile. From traffic systems to hospital scheduling, municipal operations increasingly run on digital rails. A single successful cyber attack could disable city services and send ripples across regions.
The reality? Many of these entities don’t have the budgets, staff, or expertise to defend themselves.
What Government Should Be Doing
This is where public leadership must step in. The burden of resilience cannot fall solely on citizens or under-resourced organizations. Telling people to buy batteries and bottled water is a start—but the real focus should be on securing the systems those supplies depend on.
The EU’s NIS 2 Directive is a strong move in the right direction. It expands cyber security requirements to more sectors, enforces stricter incident reporting, and empowers regulators with enforcement capabilities. Importantly, it takes an “all-hazards” approach—acknowledging that physical, cyber, and hybrid threats are increasingly indistinguishable.
But policy must be paired with funding and execution.
Cyber security isn’t a poker game. Hacktivists and threat actors are bluffing less and striking more. Governments need to ensure that funding reaches local governments, critical sectors, and SMBs—not just big institutions. They need to support upskilling, shared intelligence, and practical resilience initiatives across the board.
From Technology to Strategy: AI, Chaos Engineering, and the Role of CISOs
In times of complexity, AI can be a game-changer. It can help detect and mitigate threats in real time, often before human teams are even aware of them. AI-enhanced firewalls, behavioral analytics, and anomaly detection can significantly boost protection, especially when paired with traditional hygiene practices like patching and segmentation.
But even advanced tools are only as good as the strategy that guides them.
Real resilience requires architecture that anticipates failure. “Chaos engineering”—the concept of designing systems under the assumption that they will break—should be standard in infrastructure planning. Exercises, simulations, and business continuity plans must be lived experiences, not theoretical checklists.
The Heathrow outage, for example, was not a cyber attack, but a perfect case study in failed continuity planning. Swapping power incomers, testing backups, and practicing black start scenarios could have prevented the chaos.
A Calm, Clear Path Forward
Let’s be realistic: not every crisis will be a cyber attack. Some will be floods. Some will be heatwaves. Some will be economic.
But every crisis now has a digital layer—and that layer must be protected.
The message to the public should be simple and balanced:
“Have a plan. Be prepared. Know what to do. But don’t lose sleep over what hasn’t happened. Just make sure you—and the systems around you—can handle it if it does.”
Cyber security professionals must be truth-tellers, not fearmongers. We must balance vigilance with calm, caution with capability. And we must constantly advocate for systemic protection—because our food, water, energy, communications, and healthcare increasingly depend on it.
Final Thought: Preparedness Begins at the Core
It’s easy to ask citizens to stockpile food and batteries. But real preparedness begins far earlier—with well-funded infrastructure, clear strategy, and digital systems that work under stress.
We can’t stockpile trust. We can’t stockpile electricity.
But we can build resilient systems, invest in readiness, and design a world that stays calm—even in crisis.
And that’s where the conversation must go next.