What happened
Recent hybrid incidents9 and major blackouts10 have renewed urgency to strengthen Europe’s critical infrastructure resilience amid aging assets, maintenance backlogs, climate-related stress and rising AI-driven power demand. Physical attacks on infrastructure have quadrupled since 202311 and cyberattacks continued to increase between 2024 and 202512.
In October 2025, the EU extended sanctions against Russian individuals and entities involved in hybrid activities abroad.13
Across Europe, governments are designating14 national “critical entities” in digital, energy, financial and transport infrastructure to eventually meet stricter physical and cyber resilience requirements.
What’s next
Intensifying competition over advanced technology will drive cyber espionage and IP theft15, while European organizations’ growing unease over dependence on US digital infrastructure is driving the EU’s call for a “sovereign digital transition.”
EU and NATO will advance resilience through initiatives like the Baltic Sentry initiative16 and the new EU Cyber Solidarity Policy regulatory frameworks to strengthen cyber17 and physical preparedness of critical infrastructure and other strategic sectors. And the European Commission will propose a Data Centre Energy Efficiency Package18 in 2026 to improve energy efficiency in digital infrastructure, including data centers.
Hybrid confrontation is likely to persist - and intensify around energy infrastructure this winter. Within the EU, increasing levels of interconnectedness due to growing AI adoption and the green transition are broadening Europe’s exposure to such hybrid threats.
Business impact
Hybrid attacks have already caused hundreds of millions of euros in losses across Europe’s energy, transport and digital sectors. Rising AI-driven power demand and climate-related stress are increasing operational risks and infrastructure strain, adding urgency for infrastructure companies to prove prevention of and preparedness for disruptions through stress-testing, supply-chain mapping and robust data-governance and talent-security measures. Executives should also expect insurance costs to rise.
New resilience and stockpiling rules will increase transparency demands and compliance costs, especially for energy and telecoms equipment and for infrastructure, making it essential to align with evolving procurement requirements and engage government stakeholders to demonstrate understanding of vulnerabilities and disruption readiness through scenario planning and crisis simulation exercises.
For more information, contact Famke Krumbmüller.