From Board to Breach: The Accountability Chain NIS2 Just Made Explicit

For nineteen years, Verizon’s Data Breach Investigations Report told the same story: the human is the door. Click the wrong link, hand over the wrong credential, and the attacker is in. It was the finding that shaped an entire industry — security awareness training, phishing simulations, culture programmes. I built a significant part of my career on that finding.

This year’s DBIR says something different.

For the first time since the report began, vulnerability exploitation has overtaken stolen credentials as the leading initial breach vector. Thirty-one percent of breaches started with an unpatched system. The human element is still present in 62% of breaches — it has not gone away. But it is no longer the primary door. Unpatched machines are failing alongside people, and they are failing in ways that are getting harder, not easier, to manage.

The World That Made This Possible

The threat landscape changed — and the catalyst was geopolitical.

Russia’s invasion of Ukraine permanently altered the risk calculus for organisations that had previously treated nation-state cyber threats as someone else’s problem. What followed was not a contained regional conflict in cyberspace. It was a demonstration of how state resources — intelligence infrastructure, offensive tooling, zero-day exploit pipelines — can be redirected at civilian and commercial targets with operational precision.

Iran has continued to expand its cyber operations against Western targets. NATO’s internal cohesion has been tested in ways that have left individual member states recalibrating their threat models almost monthly. The result is a threat environment where a mid-size logistics company in Oslo and a manufacturer in Stuttgart now sit within operational range of adversaries with nation-state capabilities.

The DBIR confirms this is not abstract. State-affiliated actors are involved in 23% of EMEA breaches — nearly one in four, compared to 14% globally. Espionage motivation is present in 27% of EMEA breaches. The adversaries exploiting unpatched systems are not primarily opportunistic criminals. In Europe, they are disproportionately state-linked, well-resourced, and patient.

The gap between nation-state capability and commercial security teams matters because of what it means for timing. Nation-state actors are among the primary consumers of zero-day vulnerabilities. They are also early adopters of AI-assisted exploitation tooling — a category of tools that has compressed the window between vulnerability disclosure and weaponised exploit from months to hours. When the current median time to full patching is 43 days, that compression is not a tactical inconvenience. It is a structural exposure.

The Gap Is Larger Than the Numbers Show

The patching figures from DBIR 2026 deserve to be read carefully, because they understate the problem.

Forty-three days to patch. Up from 32 days the year before — a 34% deterioration, moving in the wrong direction while the threat is accelerating. Organisations patched only 26% of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalogue, down from 38%. The number of KEV-linked vulnerability instances tracked across the past four years reached 527 million — nearly eight times what it was in 2022.

But there is a layer beneath those statistics that most of the commentary has missed.

CISA’s KEV catalogue — the list against which the 26% coverage figure is measured — is not the full vulnerability universe. It is the curated, pre-filtered, highest-priority subset: known vulnerabilities, actively exploited in the wild, with confirmed real-world impact. It is the floor, not the ceiling.

Below that floor: the classification infrastructure is breaking.

CVE submissions increased 263% between 2020 and 2025. In April 2025, the US government came within hours of allowing the entire CVE programme — managed by MITRE for 25 years — to lapse. An emergency 11-month contract extension from CISA kept it alive. NIST’s National Vulnerability Database, which provides the severity scores and product identifiers that vulnerability scanners rely on to surface findings, developed a backlog it was unable to clear despite enriching 45% more CVEs in 2025 than any prior year.

In April 2026, NIST formally acknowledged what had become obvious: approximately 29,000 backlogged CVE entries, pre-dating March 2026, were reclassified as “Not Scheduled” — they will not receive full enrichment. Going forward, NIST will fully enrich an estimated 15 to 20 percent of incoming CVE volume. The remainder will exist as entries without the structured data that most organisations’ security tooling needs to act on them.

This is not a failure of intent. It is an honest acknowledgement that the volume has outrun the capacity of the system designed to make sense of it.

And the practical consequence is significant: the vulnerability roadmap most organisations operate from is now, by design, incomplete. The gap between “vulnerabilities that exist” and “vulnerabilities that reach a patch workflow” is widening structurally — regardless of how diligent the security team is.

The 43-day patch window and the 26% KEV coverage are already bad numbers. They are also the most optimistic reading available.

The Law That Arrived

Into this environment — deteriorating patch rates, collapsing classification infrastructure, nation-state actors with AI-assisted tooling — the European Union delivered a regulatory framework with one architectural choice that most commentary has not adequately examined.

NIS2 does not merely require organisations to have cybersecurity measures. It requires them to prove the measures work. It applies to organisations operating in 18 critical sectors across the EU — energy, transport, banking, health, digital infrastructure, public administration, and others — above defined size thresholds; if you operate in Europe and are uncertain whether you’re in scope, treat that uncertainty as your answer.

Article 21(2)(f) establishes a standalone mandatory obligation: organisations must maintain policies and operational procedures to assess the effectiveness of their cybersecurity risk-management measures. Not to document that the measures exist. Not to confirm that the budget was allocated or the policy was signed off.

But to demonstrate, with operational evidence, that the controls are actually functioning.

This is a materially different ask from anything that came before.

Article 20 is where the regulatory architecture becomes personal. Member states are required to ensure that management bodies formally approve cybersecurity measures, actively oversee their implementation — and can be held personally liable for infringements. “Actively oversee” is not a formality. Signing off a framework and returning to the next agenda item does not satisfy the standard. Under Article 32(5)(b), national authorities can temporarily ban individuals from exercising managerial functions. Germany has already signalled the enforcement direction: its BSI Act amendment sets individual manager fines up to €500,000 for governance failures.

The accountability chain is explicit. The board approved the framework. The CEO delegated the programme. The CISO ran the scanners. The scanners — calibrated to an NVD database that now covers 15 to 20 percent of incoming vulnerabilities by design — missed entries that never made it to the patch workflow. The breach happened through a known vulnerability that took 43 days to reach someone who could act on it. The adversary needed hours.

Under NIS2, everyone in that chain who cannot produce evidence of active, continuous oversight is exposed.

What Actually Changed

The security industry spent two decades building on a shared premise: effort is the measure of compliance. You trained the employees. You ran the penetration test. You wrote the policy and got it signed. You can demonstrate good faith.

NIS2 Article 21(2)(f) replaces that premise with a different one: effectiveness is the measure of compliance.

Not effort. Not intent. Operational, continuous, audit-ready evidence that controls are working.

This is the accountability cascade. It begins with a geopolitical shift that expanded the adversary pool and compressed the exploitation window. It runs through a data picture where the primary breach vector is now technical failure, and the system designed to help organisations manage that failure is retreating from most of its scope. It terminates in a regulatory framework that places personal liability on the individuals at the top of the governance chain — and requires them to show their work.

I have spent my career arguing that security is a human problem. I still believe that — the 62% human-element figure in DBIR 2026 is not a rounding error. That finding — the human is the door — built an industry I helped shape: security awareness training, phishing simulations, culture programmes. We told organisations to train their people and measured completion rates because completion rates were easy to measure. What we could not easily measure was whether any of it actually reduced risk. The gap between “training happened” and “behaviour changed in ways that lowered exposure” was real, and the industry largely talked around it. I have spent the past two decades trying to close that gap — to make it technically possible to document whether security behaviours are actually improving, not just that a programme exists. The inability to answer that question honestly is not new. What is new is a regulatory framework that now demands the answer.

The machines are failing too, at scale, and the infrastructure that was supposed to help us understand and prioritise those failures is no longer keeping up.

For a CEO or board member reading this: the question is not whether your organisation is doing the right things. It is whether you can demonstrate — with evidence, not assurance — that those things are working.

“We tried” is a statement about effort. It is not evidence of effectiveness.

Here is a practical test for your next governance conversation: if an auditor walked in today and asked for evidence that your cybersecurity controls are working — not that they exist, not that they were funded, but that they are working — what would you show them? Policies and training completion records are evidence of effort; NIS2 auditors will ask for something else. The question most boards have not yet confronted is not whether they are investing enough in cybersecurity, but whether they can prove the investment is working. That is the shift NIS2 forces, and it arrives whether the board has had the conversation or not.

Norway’s first NSM audits under NIS2 begin in October 2026. The calendar does not move based on whether leadership was aware of it.

— -

Kai Roer is the creator of the Security Culture Framework (adopted by ENISA, 2010), co-author of The Security Culture Playbook (Wiley, 2022), and founder of Praxis Security Labs. He was previously Chief Research Officer at KnowBe4 following the acquisition of CLTRe.

Disclosure: Praxis Navigator, the product I build, exists in part as a response to the problem described in this essay — continuous, automated documentation of control effectiveness.

— -

References

[1] Verizon. “2026 Data Breach Investigations Report.” Verizon Business. 19 May 2026. https://www.verizon.com/business/resources/reports/dbir/

[2] Verizon. “Vulnerability Exploitation Top Breach Entry Point, 2026 Industry-Wide DBIR Finds.” GlobeNewswire. 19 May 2026. https://www.globenewswire.com/news-release/2026/05/19/3297614/0/en/Vulnerability-Exploitation-Top-Breach-Entry-Point-2026-Industry-Wide-DBIR-Finds.html

[3] Kovacs, Eduard. “Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector.” SecurityWeek. 20 May 2026. https://www.securityweek.com/verizon-dbir-2026-vulnerability-exploitation-overtakes-credential-theft-as-top-breach-vector/

[4] Seals, Tara. “Verizon DBIR: Vulnerability Exploitation Is the Dominant Initial Access Vector.” Help Net Security. 20 May 2026. https://www.helpnetsecurity.com/2026/05/20/verizon-2026-dbir-findings/

[5] Qualys Threat Research Unit. “Inside the 2026 Verizon DBIR: What One Billion Records Revealed About Vulnerability Remediation.” Qualys Blog. 19 May 2026. https://blog.qualys.com/vulnerabilities-threat-research/2026/05/19/inside-the-2026-verizon-dbir-what-one-billion-records-revealed-about-vulnerability-remediation

[6] NIST. “NIST Updates NVD Operations to Address Record CVE Growth.” National Institute of Standards and Technology. April 2026. https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth

[7] Cimpanu, Catalin. “NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions.” The Hacker News. April 2026. https://thehackernews.com/2026/04/nist-limits-cve-enrichment-after-263.html

[8] Toulas, Bill. “NIST Admits Defeat on NVD Backlog, Will Enrich Only Highest-Risk CVEs Going Forward.” Help Net Security. 16 April 2026. https://www.helpnetsecurity.com/2026/04/16/nist-national-vulnerability-database-nvd-enrichment/

[9] Kovacs, Eduard. “NIST Prioritizes NVD Enrichment for CVEs in CISA KEV, Critical Software.” SecurityWeek. April 2026. https://www.securityweek.com/nist-prioritizes-nvd-enrichment-for-cves-in-cisa-kev-critical-software/

[10] Cimpanu, Catalin. “CVE Program Averts Swift End After CISA Executes 11-Month Contract Extension.” CSO Online. April 2025. https://www.csoonline.com/article/3963190/cve-program-faces-swift-end-after-dhs-fails-to-renew-contract-leaving-security-flaw-tracking-in-limbo.html

[11] Toulas, Bill. “CISA Extends Funding to Ensure ‘No Lapse in Critical CVE Services.’” Bleeping Computer. April 2025. https://www.bleepingcomputer.com/news/security/cisa-extends-funding-to-ensure-no-lapse-in-critical-cve-services/

[12] Cimpanu, Catalin. “CISA Extends CVE Program Contract With MITRE for 11 Months.” The Record (Recorded Future News). April 2025. https://therecord.media/cisa-extends-cve-program-contract-with-mitre

[13] European Parliament and Council of the European Union. “Directive (EU) 2022/2555 (NIS2 Directive).” Official Journal of the European Union. 27 December 2022. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555

[14] NIS-2-Directive.com. “NIS 2 Directive, Article 21: Cybersecurity Risk-Management Measures.” https://www.nis-2-directive.com/NIS_2_Directive_Article_21.html

[15] NIS-2-Directive.com. “NIS 2 Directive, Article 32: Supervisory and Enforcement Measures in Relation to Essential Entities.” https://www.nis-2-directive.com/NIS_2_Directive_Article_32.html

[16] DLA Piper. “NIS2 Directive Explained: Part 2 — Management Bodies Rules.” November 2025. https://www.dlapiper.com/en-us/insights/publications/2025/11/nis2-directive-explained-part-2-management-bodies-rules

[17] Greenberg Traurig LLP. “NIS2 in Germany: The New BSI Act Makes Cybersecurity a Board-Level Issue.” December 2025. https://www.gtlaw.com/en/insights/2025/12/nis2-in-germany-the-new-bsi-act-makes-cybersecurity-a-board-level-issue

[18] Morrison Foerster. “Flipping the NIS2 Switch: What Germany’s Implementation Means for 2026 Compliance.” December 2025. https://www.mofo.com/resources/insights/251208-flipping-the-nis2-switch-what-germanys-implementation

[19] DLA Piper Norway. “Digital Security Act and Related Regulation Enters into Force.” 2025. https://norway.dlapiper.com/en/news/digital-security-act-and-related-regulation-enters-force

[20] Cyberday. “What Is Digitalsikkerhetsloven? NIS2 in Norway.” 2025. https://www.cyberday.ai/blog/what-is-digitalsikkerhetsloven-nis2-norway

[21] Office of the Director of National Intelligence. “Annual Threat Assessment of the U.S. Intelligence Community.” March 2025. https://www.dni.gov/files/ODNI/documents/assessments/ATA-2025-Unclassified-Report.pdf

[22] Trellix. “The Iranian Cyber Capability 2026.” Trellix Advanced Research Center. 2026. https://www.trellix.com/blogs/research/the-iranian-cyber-capability-2026/

[23] Reuters. “Russia Supplies Iran With Cyber Support, Spy Imagery to Hone Attacks, Ukraine Says.” U.S. News. 7 April 2026. https://www.usnews.com/news/world/articles/2026-04-07/exclusive-russia-supplies-iran-with-cyber-support-spy-imagery-to-hone-attacks-ukraine-says

Essay — Effort Is No Longer a Defense was originally published in Security, traveling, entrepreneurship. on Medium, where people are continuing the conversation by highlighting and responding to this story.

Factory Series Part 6

In 2007, I walked into a Scandinavian food-production facility and reached the production floor in under an hour. No badge. No appointment. A smile and a borrowed hair net. Over the last five posts, I’ve traced what changed around that factory: the geopolitical buffers dissolved, the fuel margins vanished, the digital perimeter evaporated, and the compound effect made each of those worse than the sum.

If you’ve read the series, you might be somewhere between alarm and paralysis. The alarm means you’re paying attention. The paralysis is the thing we need to fix.

Because here is the truth that security professionals — myself included — have spent decades learning the hard way:

the answer is not technology. It never was.

The Technology Trap

After every breach, every incident, every headline, the instinct is the same: buy something. A firewall. A SIEM. An AI-powered threat detection platform. An access control system.

These things help. But technology is a tool. It does what it is configured to do, maintained to do, and — critically — what the people operating it allow it to do. A badge reader on the factory door is useless if the culture says “just hold the door open for the person behind you.” A SCADA monitoring system is useless if the alert goes to an inbox nobody checks. An AI threat detection platform is useless if the organization has no process for acting on what it finds.

In 2007, the factory had a perimeter guard. It had a sign telling visitors to report in. It had a policy requiring hair nets in the production area. The technology and the rules existed. What was missing was the culture to make them work.

Nineteen years later, the technology is vastly more sophisticated. The culture gap has barely moved. The Verizon DBIR has attributed the human element to more than 60% of breaches every year for over a decade. Global cybersecurity spending has passed $200 billion annually. The percentage of incidents rooted in how people actually behave has stayed flat.

The Lesson That Took Me Twenty Years

Early in my career, I came from marketing. I understood how to study audiences, measure their attitudes, and design interventions that changed behavior at scale. When I moved into security, I was stunned by the gap. The industry was obsessed with technical controls and almost completely blind to the humans operating them.

So I built the Security Culture Framework — a structured process for building and measuring security culture. ENISA adopted it. Later, I built the first scalable security culture measurement instrument — measuring culture inside an organization across seven dimensions: Attitudes, Behaviors, Cognition, Communication, Compliance, Norms, and Responsibilities. Not as soft concepts. As data. Benchmarkable. Comparable across industries and regions.

That work taught me something I still carry: culture shapes behavior. And behavior — not technology, not policy, not compliance — is what actually protects you.

A policy says “lock the door.” Behavior is whether someone locks it. A training module says “challenge unknown visitors.” Behavior is whether the line worker actually speaks up when a stranger walks past. A monitoring dashboard shows an anomaly. Behavior is whether someone acts on it before lunch.

The gap between policy and behavior is where every attack in this series succeeded — mine included.

From Measurement to Continuous Visibility

The Security Culture Framework proved that you could measure culture and move it. But measurement alone — especially annual measurement — is not enough.

The threats described in this series operate continuously. A ransomware operator doesn’t wait for your assessment cycle. A supply chain disruption doesn’t time itself to your quarterly board report. The behavioral patterns that make an organization resilient or fragile are happening every day, in every interaction between people and systems.

The field needs to evolve from periodic surveys to continuous behavioral visibility. Not what people say they do in a questionnaire, but what they actually do, every day, at the point of interaction. That data needs to reach decision-makers — executives, boards, policymakers — in time to act on it.

The principle hasn’t changed in twenty years: understand your people, measure what matters, adapt to what you find. The tempo has to change. Annual snapshots are to behavioral security what a single blood test is to health monitoring. The threats are continuous. The visibility needs to match.

The Factory Tour, One More Time

Let me walk you through the factory one last time. Not the 2007 version. Not the 2026 threat version. The version where the culture changed.

You arrive at the gate. The perimeter guard looks up. Not because a new system forced him to — because the organization decided that every person entering the facility matters, and trained him accordingly. He asks who you are. He checks. If you don’t have a reason to be here, you don’t come in.

You try the distribution center door. It’s locked — not because a €50,000 access control system was installed, but because the drivers inside understand that an unlocked door is everyone’s problem. They lock it because that’s what you do here.

You reach the production floor. Someone stops you. Not a guard. A line worker. She asks: “Who are you with?” Not because she was told to challenge strangers as part of a compliance checklist — because in this facility, looking out for each other is normal. It is the culture.

Nothing exotic happened. No AI. No biometric scanners. No military-grade perimeter. Just people who understand why security matters and behave accordingly.

That is what behavior looks like when culture works. And it is the one thing that scales across every threat described in this series — physical, digital, and compound.

Why Behavior Is the True Defense

Technology defends against specific attacks. Fuel reserves buffer against specific shortages. Military alliances deter specific adversaries.

Behavior is what makes all of them work — or what makes all of them fail.

An organization where people behave securely will notice when something is wrong — a door that shouldn’t be open, a system behaving oddly, a person who doesn’t belong. They will report it, because reporting is easy, expected, and safe. They will respond, because processes exist and people know them. And they will adapt, because the organization learns from what it sees.

An organization where people don’t will have all the same technology, all the same policies, and none of the behavior. The alert fires and nobody responds. The door is propped open because it’s convenient. The stranger walks through because challenging people feels awkward.

This is true whether the threat is a person with a smile and a hair net, a ransomware operator in another hemisphere, or a compound crisis that hits from six directions at once.

What This Means in Practice

The most common response I hear from executives: *”This sounds right, but where do we start?”*

Measure behavior, not just compliance. Most organizations know whether they passed an audit. Almost none know how their people actually behave with the systems and access they have — every day, not just during assessment week. You cannot change what you do not see.

Make it a leadership issue. If the factory manager walks past an open door without comment, the message is clear. If the board treats security as a cost center to be minimized, the organization will minimize it. Behavior flows from the top. Executives and boards need behavioral data they can act on — not risk registers they file and forget.

Monitor continuously. The threats in this series operate every day. Annual assessments are snapshots of a patient between visits. Your visibility into how people interact with your systems needs to match the tempo of the threats against them.

The counterargument writes itself: culture change takes years, and the threat horizon is now. It’s a fair objection. But it’s also a false choice. You don’t wait for culture to mature before acting — you start measuring today so you can see where you’re exposed today. Behavioral visibility is immediate. The culture shift it enables compounds over time. The organizations that started measuring five years ago aren’t wondering whether it was worth it.

The Question Answered

In 2007, I asked: can you take out our factory?

The answer was yes. Easily.

In 2026, the threats are larger, faster, more numerous, and more interconnected than anything I imagined when I walked through that gate. The geopolitical environment has removed the buffers. The digital environment has removed the perimeter. The energy environment has removed the margin.

But the factory still has people. People who open doors and close them. People who challenge strangers or let them pass. People who notice something wrong or look the other way.

Technology will not save the factory. Governments may not be able to protect it. Supply chains may fail it. Allies may not show up.

What’s left is behavior. The thing people actually do — at the gate, at the keyboard, in the moment when something feels wrong. Culture shapes that behavior. And behavior is the true defense.

You don’t need to solve the Strait of Hormuz. You don’t need to patch every SCADA system overnight. You don’t need to predict the next compound crisis.

You need to see how your people behave. You need to understand why. And you need to start changing it.

One step at a time.

You can measure behaviors too: https://praxisnavigator.io is the worlds first human behavior analytics platform, with built in automatic stakeholder reporting, intervention tracking and detailed behavior information.

The Factory Series — Part 5

So far in this series, I’ve treated the threats one at a time. The physical walk-through. The geopolitical shift. The fuel reserves. The digital attack surface. Each one dangerous on its own.

But threats don’t queue politely.

One Bad Day

It is a Tuesday in 2026. Not a single real Tuesday — a composite, drawn from concurrent, documented realities that are all live right now. Every capability described here has been publicly demonstrated. The only fiction is the compression into one morning.

A ransomware attack hits a major logistics provider — one that serves hundreds of food producers, retailers, and distribution networks. The kind of provider most people have never heard of, because supply chain infrastructure is invisible until it stops. Manufacturing absorbs 56% of all global ransomware attacks. This is not an outlier. This is the Tuesday average.

The same week, fuel prices spike again. The Strait of Hormuz is still effectively closed. The largest coordinated release of strategic reserves in history — 412 million barrels from 32 countries — is underway, but it is a buffer, not a solution. Trucking companies are rationing routes. Diesel allocation is being discussed in cabinet meetings in countries that haven’t thought about fuel security since the 1970s.

A GPS jamming event disrupts navigation across the Baltic — again. Commercial shipping slows. Flight paths are rerouted. Emergency services in three countries switch to backup navigation protocols that most operators haven’t trained on since certification.

And somewhere, quietly, a state actor that has been prepositioned inside critical infrastructure for years decides this is the moment. Not to destroy. Just to degrade. A water treatment plant operates at reduced pressure for 72 hours. Power delivery to an industrial zone becomes intermittent. Nothing catastrophic. Everything slightly wrong.

This is not a war scenario. This is a Tuesday.

The Compound Effect

Each of the threats I’ve described in this series — physical vulnerability, geopolitical instability, energy dependency, digital exposure — is serious on its own. But they were never going to arrive alone. They share infrastructure, they share timing, and they amplify each other.

A fuel shortage makes a cyberattack worse. If your backup generators need diesel, and diesel is rationed, your redundancy plan is a line item on paper. The factory’s refrigeration fails not because someone hacked the SCADA system, but because the generator ran dry — because the tanker didn’t arrive — because the strait is closed.

A cyberattack makes a physical vulnerability worse. If your access control system is digitally managed — badge readers, CCTV, automated locks — and a ransomware attack takes it offline, the factory door isn’t just unlocked. It’s open. The perimeter guard can’t check the entry log because the entry log is encrypted.

Geopolitical instability makes everything worse. When governments are managing fuel crises, alliance fractures, and military posture simultaneously, the bandwidth for inspecting food factories, auditing water plants, or patching SCADA systems drops to zero. In April 2025, the Iberian blackout didn’t kill anyone. But for 18 hours it tested every backup assumption hospitals, transit systems, and water utilities had made — during peacetime. What happens during compound stress?

And then there’s the accelerant. An autonomous attack agent doesn’t know about the fuel crisis or the staffing shortage. It just probes the factory network the same way it probes ten thousand others — around the clock, adapting in real time. But a factory already running on reduced staff, with backup power uncertain, with security teams pulled elsewhere — that factory is softer. The AI doesn’t need to know why. It just finds the gap faster.

Resilience is not the sum of individual defences. It is the weakest combination of failures.

The Scenario No Tabletop Has Modeled

The North American Electric Reliability Corporation runs GridEx — the largest grid security exercise in North America — simulating coordinated cyber and physical attacks on the power grid. The scenario: simultaneous digital intrusion and physical sabotage causing a cascading, multi-week blackout affecting tens of millions of people.

A Lloyd’s of London scenario modeled a coordinated attack on 50 generators supplying the northeastern U.S. grid: 93 million people without power, insured losses estimated between $20 billion and $70 billion. One attack. One region. One grid.

The U.S. National Guard has run combined cyber-weather exercises — practicing response when a cyberattack strikes during an extreme weather event. The logic: attackers choose the moment when the system is already stressed.

These exercises exist because serious people understand compounding. What they don’t capture is the full scope of 2026 — because no exercise combines a fuel crisis, a hot war in Europe, a closed strait, a fracturing alliance, an AI-accelerated threat landscape, and degraded infrastructure simultaneously. Reality is running a scenario that no tabletop has modeled.

The Factory in the Compound

Back to the factory. The one I walked through nineteen years ago wearing a hair net as my only credential. The one that stands for every food plant, water facility, logistics hub, and manufacturing operation that keeps a society functioning.

In 2007, the threat was singular: could a person walk in and do harm? Yes. And the factory wasn’t ready.

In 2026, the threats are compound. The factory faces physical intrusion and digital intrusion and fuel dependency and supply chain disruption and workforce shortages and geopolitical instability — not sequentially, but simultaneously. And each one makes the others harder to defend against.

The factory that wasn’t ready for one person walking through the door is now facing a convergence that the most sophisticated military organizations in the world are struggling to model.

And the hair net is still the only credential.

The Question Has Changed

In 2007, I asked: can you take out our factory?

The answer was: one person, one morning, no questions asked.

In 2026, the question is: can you keep the factory running?

The threats are not hypothetical. The fuel crisis is real. The war is real. The cyber prepositioning is real. The AI acceleration is real. The infrastructure decay is real.

The factory isn’t facing an attacker at the gate. It is facing an environment where everything it depends on is simultaneously under pressure.

In Part 6, I’ll explain why technology alone won’t fix this — and what will.

The Compound Effect was originally published in Security, traveling, entrepreneurship. on Medium, where people are continuing the conversation by highlighting and responding to this story.

The Factory Series post 4

In 2007, I walked into a food-processing factory in Northern Europe without showing identification to a single person. The only credential anyone checked was a hair net — required at the canteen door. I walked past production floors, through control rooms, past areas where a single contamination event could have shut down a supply chain feeding three countries. Nobody stopped me. Nobody asked why I was there.

That factory is still operating. It got connected.

The PLCs that ran the production line in 2007 — isolated, air-gapped, communicating over proprietary serial protocols — now sit on a network segment that touches the corporate IT environment. SCADA systems that once required physical presence to monitor are accessible through web interfaces. The maintenance vendor has a VPN. The HVAC contractor has another. The line between IT and OT, which was never formally drawn, has been formally erased.

The hair net is still the only credential at the physical entrance.

The digital entrance has no credential at all.

The Numbers Are Not Predictions

Dragos’s 2024 OT Cybersecurity Year in Review confirmed what practitioners already suspected: manufacturing was the most-targeted sector for ransomware in operational technology environments — for the third consecutive year. Separately, Waterfall Security’s annual threat report documented a 146% year-over-year increase in cyberattacks that caused physical consequences to OT systems.

These are not projections. They are the audited results of a year that already happened.

The manufacturing sector did not become a target in 2024. It became a documented target. The distinction matters. Targeting requires access. Access requires time. The attacks that showed up in last year’s statistics started with intrusions that happened the year before, or the year before that.

The Walk-Through, Reimagined

If I were to take out that same factory today, I would not need legs.

I would not need to be in the country. I would not need a hair net. I would need a laptop, patience, and the working assumption that at least one entry point uses default credentials — because in OT environments, that assumption is correct more often than it is wrong.

The reconnaissance happens from a coffee shop on another continent. Shodan indexes the factory’s internet-facing devices. The SCADA HMI is reachable because someone in IT enabled remote access for a contractor in 2019 and never revoked it. The PLC firmware has not been updated since installation because updating it requires a production stoppage that nobody has budget authority to approve.

Some OT operators have done this properly. Genuine Purdue Model segmentation, validated by red teams, monitored continuously. They exist. In my experience, the ones who have done it can tell you the date they completed the work. Most boards I sit across from cannot.

Lateral movement from the IT network to the OT network takes patience, not sophistication. The segmentation that was supposed to separate them was implemented as a firewall rule set that has been amended forty-seven times since deployment. Nobody remembers what the original rules were meant to protect.

I have presented exactly this scenario to boards — walked them through the Shodan query, the default credentials, the unrevoked vendor VPN — and watched a room of competent executives realize that their risk register describes a facility that no longer exists. The risk register describes the air-gapped factory. The factory on the network is a different asset with a different threat model, and nobody updated the paper.

The ghost in the wires does not need to be brilliant. The ghost needs to be patient. And the patient ones are not testing the door. They are already inside, mapping the floor plan.

The Patient Ones

In February 2024, CISA published Advisory AA24–038A, confirming what had been suspected for months: a Chinese state-sponsored group designated Volt Typhoon had maintained persistent access inside U.S. critical infrastructure networks — energy, water, transportation — for at least five years.

Five years.

Not five days. Not five weeks. Five years of sitting inside networks that run physical systems, watching traffic, mapping dependencies, maintaining access without triggering a single alarm.

Volt Typhoon’s tradecraft is notable for what it does not do. It does not deploy custom malware. It does not exfiltrate large datasets. It lives off the land — using built-in system tools, legitimate credentials, and native protocols to blend into normal network traffic. The technique is not invisible. It is indistinguishable. There is a difference, and the difference is what makes it effective.

Salt Typhoon, a separate Chinese state-sponsored operation, achieved the same thing inside telecommunications infrastructure. The access was confirmed across major U.S. carriers. The dwell time was measured in months.

These operations are not espionage in the traditional sense. Espionage extracts information. Pre-positioning maintains access for future use. The access exists so that when the decision is made to act, the capability is already in place. No intrusion required on the day it matters. No timeline pressure. The breach already happened. The action is a matter of timing.

AI Changes the Math

The question is not whether AI has been used in a cyberattack. AI-assisted tooling — for phishing generation, vulnerability scanning, code analysis — is already operational on both sides. The question that matters for OT threat modeling is what happens when the tedious parts of patient intrusion become scalable.

A human operator conducting the kind of low-and-slow reconnaissance that Volt Typhoon used requires trained personnel, coordination, and years. An AI agent conducting the same reconnaissance requires compute. Compute scales. Personnel do not.

A 2024 study from the University of Illinois (Fang et al.) demonstrated that large language model agents could autonomously identify and exploit known vulnerabilities — with a success rate that surprised the researchers. The significance was not that the AI was creative. It was that the vulnerability landscape is repetitive enough that pattern recognition outperforms human analysts on coverage. The AI does not get tired. It does not lose focus. It does not decide that the forty-seventh firewall rule amendment is not worth investigating.

This does not mean AI replaces the nation-state operator. It means the nation-state operator now has a force multiplier for the parts of the operation that are tedious. Scanning, mapping, credential testing, lateral movement enumeration — these are exactly the tasks that AI handles well and humans handle poorly at scale.

The factory I walked into in 2007 had one threat model: a person with legs and bad intentions. The factory in 2026 has a threat model that includes autonomous systems with infinite patience and no need for a hair net.

The Grid That Failed by Accident

On April 28, 2025, the Iberian Peninsula experienced its most severe power grid failure in decades. Spain and Portugal lost power across wide regions. Transportation stopped. Communications degraded. Hospitals ran on generators.

The cause, according to initial investigations, was a cascading failure — a technical fault that propagated through an interconnected grid. Not a cyberattack. An accident.

That is the point. A cascading failure is a threat model documented in real time by the infrastructure itself. The interconnections that allowed a localized fault to cascade across two countries are the same interconnections that a patient adversary maps during five years of persistent access. The failure mode does not need to be engineered from scratch. It has already been demonstrated.

The question for a board is not whether this could happen to your infrastructure. The Iberian blackout proved it can happen. The question is whether the next cascading failure will be accidental — or whether someone will decide it is time to use the access that CISA confirmed has been maintained since at least 2019.

The Door That Is Already Open

I think about that factory in 2007 more often than I should. The ease of it. The absurdity that a hair net was the security perimeter for a facility whose failure would have disrupted food supply across a region.

But in 2007, the attack required me. My legs, my presence, my willingness to walk through a door that should have been locked. That constraint — physical presence — was the factory’s actual security model, whether anyone acknowledged it or not.

That constraint no longer exists.

The PLCs are networked. The SCADA systems are remotely accessible. The adversaries documented inside critical infrastructure did not break in. They walked through doors that were never closed. And the IT/OT boundary that was supposed to keep them out is a fiction maintained by an org chart, not by architecture.

Next in the series: Part 5 — What happens when threats don’t arrive one at a time.

You Don’t Need Legs Anymore was originally published in Security, traveling, entrepreneurship. on Medium, where people are continuing the conversation by highlighting and responding to this story.

Factory Series Part 3: Twenty Days

I grew up in Norway, near Slagentangen. Esso’s refinery on the Vestfold coast — one of two refineries that processed Norway’s crude oil into the fuel the country actually runs on. I still recall the smell of petroleum in the air. Tankers in the fjord. Jobs in the community. The quiet certainty that the fuel was there because the refinery was there.

In 2021, Esso shut it down. After 60 years of operation, the refinery was converted into an import terminal. The storage tanks are still there. The infrastructure is intact. But nothing is refined. Products are imported and distributed.

The official answer was economics: “not economically viable over the long term” due to competition, regulation, and falling demand. The market logic was clean. The national security logic was absent.

Because here is what it means: Norway — one of the world’s largest oil producers — now has one functioning refinery. Mongstad, on the west coast. That’s it. We pump crude from the North Sea, export it across the globe, and fund one of the wealthiest sovereign funds in history. Oil is our identity. It built modern Norway.

And Norway has 20 days of fuel reserve.

That’s it. Twenty days. If the imports stop — if the tankers don’t arrive, if the supply chain breaks, if something happens to the narrow waterways that global shipping depends on — Norway runs out of diesel in under three weeks.

Sweden holds 90 days of reserves. Finland holds 90. They meet the international standard set by the IEA. Norway — the oil nation — does not come close.

This is not a secret. It is in a report from NHO, published in April 2026. The head of Norway’s largest business confederation called it “very serious for a society needing fuel in crisis.” The Norwegian Defence Research Establishment put it bluntly: “War and crisis in Norway and our neighbouring areas can lead to serious disruptions in the supply of food and fuel.”

Meanwhile, the empty tanks at Slagentangen sit idle.

The Outsourcing of Survival

The pattern is the same everywhere: countries outsourced refining because the market said it was cheaper.

Norway closed Slagentangen and kept Mongstad. One refinery for an oil nation. We import over half our diesel and nearly all our aviation fuel.

The United Kingdom just closed another one. Grangemouth — Scotland’s only refinery — processed its last crude in April 2025. It supplied 65% of Scotland’s oil products. Now it’s a fuel import terminal. The UK is down to five refineries, with gasoil imports hitting six-year highs.

Australia sells its crude to Asian buyers, then buys back refined products from refineries it does not own, in countries whose interests may not always align. The entire continent runs on two operational refineries. On April 16, 2026, one of them caught fire. The Geelong refinery in southeastern Australia, capable of processing 120,000 barrels per day, was hit by a major blaze with multiple explosions. No sabotage. No terrorism. Just an industrial fire at the worst possible moment.

Australia’s energy minister commented: “Not good timing.”

Japan imports over 90% of its crude from the Middle East — primarily the UAE and Saudi Arabia, through the Strait of Hormuz. Japan holds deep reserves, but even 254 days run out when the strait stays closed. In March 2026, the government began releasing oil from national reserves — lowering the amount refiners must hold — for the first time since the 2011 earthquake.

Africa and the Caribbean are not peripheral to this story. They are the end state — what zero-buffer dependency looks like when it matures. Nations like Angola export crude and then re-import refined products at higher prices. Across the continent, many nations import 80–90% of their petroleum products. The Caribbean runs over 90% of its electricity generation on imported fossil fuels. Countries like Jamaica and the Dominican Republic buy on the spot market. When prices double, the lights go out. If you run a supply chain that touches any of these regions — and most multinationals do — this is not someone else’s problem. It is a line item on your risk register.

The logic was always the same: it’s cheaper to let someone else refine it. The market will provide.

The Strait of Hormuz

This is the chokepoint that energy analysts warned about for decades. A narrow waterway between Iran and the Arabian Peninsula. Roughly 20% of the world’s oil transits through it daily. In early 2026, the Iran conflict effectively closed it.

The downstream effects are immediate and global. In March, the IEA announced the largest coordinated release of strategic oil reserves in history: thirty-two countries selling a combined 412 million barrels into the global market over four months.

That sounds like a lot. It is a lot. And it is still not enough if the strait stays closed.

A prolonged closure could reduce Japan’s GDP by 3%. Bangladesh has closed universities. Myanmar has mandated remote work. Cambodia conducts government meetings online only — not by choice, but because fuel rationing makes travel impractical.

The Factory Connection

In 2007, I walked through a food factory unchallenged. That factory needed trucks to distribute its products. Those trucks needed diesel. That diesel came from refineries. Those refineries were assumed to exist and function.

Take away the fuel, and the trucks stop. The refrigeration fails. The distribution chain collapses. The food stays in the factory. The factory doesn’t need a terrorist with anthrax. It just needs an empty fuel tank. And that tank is connected to a supply chain that stretches through import terminals, across contested waterways, to refineries in countries whose interests may not always align. Norway’s 20-day reserve is the distance between that factory’s loading dock and silence.

Physical security protects the door. But the door doesn’t matter if the system behind it can’t function.

The Pattern

The pattern is not national. It is structural. Every country that outsourced refining — because it was cheaper, because the market optimized, because nothing had gone wrong yet — is exposed to the same failure mode.

The market provides when conditions are stable. When the Strait of Hormuz is open. When there’s no war in Europe. When a refinery in Geelong doesn’t catch fire on the worst possible day.

When any one of those assumptions fails, the market provides nothing. This is an argument against building your national survival on the assumption that nothing will ever go wrong.

Do you know what your organisation’s equivalent of 20 days is? What is the single dependency you have outsourced because the market made it easy — and what happens to your operations when that dependency stops delivering? If you cannot answer that question in one sentence, you do not have a resilience strategy. You have a hope.

In Part 4, I’ll show why the next walk-through won’t require legs at all — and what digitalization, AI, and connected systems mean for the factory I visited in 2007.

Kai Roer is the creator of the Security Culture Framework and founder of Praxis Security Labs. He has been walking into places he shouldn’t be able to access for over four decades.

Your board is going to ask you to defend your AI spending. The question is which conversation you are walking into.

The first conversation.

The quarterly review. Someone pulls up the dashboard.

“Our AI token consumption is up 3400% month-on-month.”

The board nods. A hand goes up.

“What are we getting for it?”

The pause before that answer is the most expensive moment in your AI strategy. Because if the honest answer is “we are consuming more AI than ever” — you do not have an answer. You have a spend report.

This is the conversation playing out in boardrooms right now. And it is playing out because the AI industry handed executives a metric that is easy to track, easy to report, and completely disconnected from value. That metric is token consumption: the volume of data fed through AI systems. It goes up automatically when you buy more. It tells you nothing about whether anything improved.

The second conversation.

Now picture a different room. Same quarterly review. Different preparation.

“Our token spend has been roughly flat for two quarters.”

A board member — one who has been following the headlines — leans forward.

“Why aren’t we spending more? Our competitors are scaling up.”

“Because we stopped measuring inputs and started measuring outputs. We replaced AI with deterministic automation wherever AI was not the right tool for the job. The processes that actually needed judgment — those we kept on AI, and they are producing measurably better results. Token spend is flat. Output quality is up. Decision error rates are down. Here is the data.”

That executive is not on the defensive. They own the room.

The difference between those two conversations is not budget. It is what you decided to measure.

Where the metric came from

Understanding why token consumption became the default benchmark requires knowing who proposed it.

Jensen Huang, CEO of NVIDIA, recently declared that any engineer earning $500,000 a year should be consuming at least $250,000 in AI tokens annually — or, in his words, he will “go ape.” Meta CTO Andrew Bosworth went further, saying his best engineer spends the equivalent of his salary in tokens and is “5x to 10x more productive.” He called it a “no-brainer.” No upper limit.

Meta turned the theory into a leaderboard. “Claudeonomics” tracked token consumption across 85,000 employees. Titles were awarded: “Token Legend,” “Session Immortal.” In a single 30-day window, employees burned 60 trillion tokens at an estimated $9 billion. The top individual user: 281 billion tokens.

The leaderboard was shut down two days after it leaked publicly.

It was shut down because employees had found the obvious move: run AI agents overnight, loop tasks for hours, burn tokens while producing nothing — and climb the rankings. When consumption becomes the metric, people optimize for consumption. This is not a technology problem. It is a basic human response to a badly designed incentive system. Boards and executives have seen this pattern before, in every domain where the wrong thing got measured.

There is also a structural reason to be skeptical of this metric. NVIDIA sells the GPU infrastructure that the AI industry runs on — the hardware purchased by cloud providers and AI companies that in turn sell token access to your organization. More token consumption means more compute demand. More compute demand flows back to NVIDIA. When the CEO of that company tells you that high performers should be consuming AI at 50% of their salary, he is describing a market worth billions to his business.

Your vendors are not wrong that AI can drive productivity. But they have a clear financial interest in the version of that claim that requires you to spend the most.

Goodhart’s Law will find you

When a measure becomes a target, it ceases to be a good measure. Meta’s leaderboard confirmed this in approximately two weeks. Agents left running overnight. Tasks looping for hours. Compute burning while producing nothing — but the leaderboard moved. This is not solvable with better monitoring. It is what happens when you give humans a scoreboard that measures the wrong thing. If your organization is measuring AI productivity by usage volume — queries run, tokens consumed, sessions opened — you are building the same trap. The score will go up. The work may not.

Volume is not value

Even setting aside the incentive question, token consumption fails as a productivity metric for a more fundamental reason.

It measures input, not output. And output volume is not the same as output quality.

A team generating more AI-assisted analysis is not more valuable if the analysis is shallower. An organization producing faster reports is not ahead if the reports say less. Throughput without quality is noise at scale — and scaling noise is expensive, both in direct cost and in the leadership attention required to process it.

The question that belongs in your board reporting is not “how much AI are we consuming?” It is: are we making better decisions? Is the work more reliable? Are we solving problems that were previously out of reach? Those questions are harder to answer. They require evidence rather than dashboards. That is precisely why they get replaced with something easier to count.

Not everything that can be AI should be AI

There is a practical dimension here with direct budget implications.

Running AI across end-to-end workflows — where a model handles the full sequence of tasks — works. It also spends heavily on tasks that have no business being handled by a language model.

When AI-handled portions of a workflow are replaced with scripts — deterministic code for tasks where the output should always be identical — token consumption drops by 90% or more. Cost drops proportionally.

But the more significant gain is not cost. It is trustworthiness.

Scripts are deterministic. The same input produces the same output, every time. Language models are powerful for tasks requiring judgment, synthesis, and reasoning. They are unreliable for anything where the correct answer is already defined — any process that is fixed, repeatable, and rule-based. Running AI on those tasks is not productivity. It is unnecessary cost generating unnecessary risk.

The strategic question is not whether your organization is using AI. It is whether it is using the right tool for each task — and whether the tools driving the most spend are actually the tools delivering the most value.

The conversation is worth preparing for

These are some of the questions I ask the organizations I advise on AI strategy:

• What specific outcomes has AI investment produced — not activity, outcomes?
• Where did we choose not to use AI, and why, and what did we use instead?
• How has the quality of AI-assisted work changed over time?
• What is our cost per meaningful output — not cost per token?

When your board asks about AI spending, the organizations in the strongest position will not be the ones with the highest token counts. They will be the ones who can answer these questions cleanly.

The executives who walk into the second conversation — the one where token spend is flat and output quality is up — did not get there by accident. They decided early that their job was to generate value, not to satisfy a metric invented by the people selling the product.

Your board may not know to ask for that yet. But they will.

The question is whether you are ready to show them the value harvested— or explaining why your metric is token spend only.

Part 2: The Pink Cloud Turned Red

In 2007, I walked through a nationwide food producer’s factory without being stopped. I published the story and asked: what if this had been a terrorist with anthrax?

The answer I got was silence. A few concerned nods. Then everyone went back to work.

That silence was affordable in 2007. Europe was stable. NATO was a given. Global supply chains worked because they always had. The threat of someone weaponizing a food factory, a water treatment plant, or a logistics hub was real in theory but remote in practice.

That was not just a Norwegian problem. It was the default posture of the developed world. From food processing plants in Germany to water treatment facilities in Florida, from port infrastructure in Rotterdam to power grids in Australia — the assumption was the same: this is safe because it has always been safe.

That world is gone.

War on the European Continent

Russia’s full-scale invasion of Ukraine is a land war in Europe. Not a frozen conflict. Active combat with artillery, drones, missiles, and territorial occupation. Over four years now, with no credible resolution in sight.

But the war didn’t stay on the front line. It extended into civilian infrastructure across the continent — and beyond. This is hybrid warfare, and it is no longer a concept paper. It is operational. Ukraine has responded by building one of the most remarkable defence industries in the world — naval drones that neutralized the Black Sea Fleet, indigenous long-range strike capability developed under fire. These are not improvised responses. They are engineered capabilities developed at speed, under combat conditions, against a larger adversary.

Nord Stream. In September 2022, three of the four Nord Stream gas pipelines were destroyed by underwater explosions in the Baltic Sea. Several hundred kilos of explosives. Critical energy infrastructure — assumed to be untouchable — taken out overnight. Europe’s gas supply architecture changed in a single day.

Undersea cables. In late 2024 and into 2025, multiple undersea telecommunications and power cables in the Baltic Sea were damaged in incidents attributed to deliberate action. These cables carry internet traffic, power interconnections, and military communications between allied nations. Similar concerns have been raised about Atlantic cable vulnerability — the backbone of global internet traffic.

GPS jamming. Across Scandinavia, GPS disruption has become routine. Commercial aviation, maritime navigation, and emergency services have all been affected. But this is not a Scandinavian problem. GPS spoofing has been documented across the Middle East, the Black Sea, and the South China Sea. Any nation dependent on satellite navigation — which is every nation — is exposed.

Infrastructure sabotage. Arson attacks on railway signal systems. Surveillance of military logistics facilities. Attempted disruption of transport corridors. In 2024, Germany arrested suspects planning sabotage of military infrastructure on behalf of a foreign state. In the UK, drone incursions over critical sites prompted emergency security reviews.

None of this is classified. It’s in the newspapers. And it’s happening in the countries that assumed they were too stable, too prosperous, too Western to need physical security at their factories and facilities.

If you’re reading this from North America, Asia, or the Southern Hemisphere and thinking that’s a European problem — consider how many of your critical supply chains run through, depend on, or connect to infrastructure in these same vulnerable corridors.

The Ally That Isn’t

For 80 years, the Western security architecture rested on one assumption: the United States would be there. NATO’s Article 5 was the insurance policy. American military presence was the deterrent. American intelligence sharing was the early warning system.

In 2026, that assumption is under direct pressure — not from an adversary, but from Washington itself. Open questioning of alliance commitments. Withdrawal from international institutions. A transactional approach to security partnerships that treats decades-old alliances as negotiable.

If your risk assessment — in Europe, in Asia-Pacific, in the Middle East, anywhere — assumes American response times, intelligence sharing, or coordinated deterrence as a baseline, you need to re-run the numbers. The inputs have changed. Not because of an enemy, but because the guarantor changed the terms.

This affects every country that outsourced part of its security posture to the alliance structure. Which is most of them.

The Middle East and the Strait of Hormuz

The Iran conflict has produced the scenario that energy analysts warned about for decades: the closure of the Strait of Hormuz.

Twenty percent of the world’s oil passes through this narrow waterway between Iran and the Arabian Peninsula — roughly 18–19 million barrels per day. In March 2026, Iran’s Revolutionary Guard Corps confirmed closure, and tanker traffic collapsed.

The downstream effects are not regional. They are global. Fuel shortages. Price spikes. Supply chain disruptions cascading through every economy that moves goods by truck, ship, or aircraft. Which is every economy.

The factory I walked through in 2007 needed fuel for its trucks, refrigeration for its products, stable supply chains for its raw materials. All assumed. None protected. The Strait of Hormuz is 6,000 kilometers from that factory — and its closure threatens it more directly than any intruder at the gate.

Not Just Europe. Not Just Energy.

The pattern is global:

South Africa has spent years managing rolling blackouts from its Eskom power crisis — critical infrastructure failing not from attack but from decades of underinvestment. Factories, hospitals, water treatment — all running on backup generators and hope.

Taiwan Strait tensions put the world’s semiconductor supply chain at risk. Over 60% of advanced chips are manufactured on an island that China has stated it intends to reunify with — by force if necessary. Every factory, every vehicle, every piece of infrastructure that depends on modern electronics depends on that strait staying open.

India and Pakistan share water infrastructure across a contested border, with the Indus Waters Treaty under increasing strain. The infrastructure that manages shared water resources across a contested border is no more secure than the factory I walked into — and disrupting it has immediate consequences for agriculture, power generation, and civilian supply chains downstream.

The pink cloud is not a Western European condition. It is a global one. Anywhere that assumes stability because it has always been stable is running the same risk.

The Pink Cloud in 2026

Nord Stream, Baltic cables, GPS jamming, the Strait of Hormuz, Eskom, Taiwan Strait — they look like separate crises in separate regions. They are the same structural vulnerability: critical systems designed with the assumption that the environment outside them would remain stable.

In 2007, living in a pink cloud was naïve. In 2026, it is reckless.

The threat to critical infrastructure is documented, operational, and multi-vector. State actors have demonstrated willingness to strike civilian infrastructure. Non-state actors have demonstrated capability. The geopolitical environment has removed the buffers that made complacency affordable — not just in one region, but worldwide.

And the factory door is still unlocked.

I’ve sat in boardrooms where the risk register hasn’t been updated since before the invasion of Ukraine. Cyber risk: yes. Regulatory risk: yes. Market risk: yes. Hybrid warfare, geopolitical instability, infrastructure interdependency: not on the page. The good organisations have scenario plans and crisis protocols — but the scenarios were written in a different world, against a different set of assumptions. That’s the gap. Not the absence of planning. The age of the assumptions underneath it.

Physical security culture — access controls, perimeter discipline, vendor credential verification — was the foundation of the 2007 story. In 2026, that foundation is still where it was. What changed is the pressure against it.

The perimeter guard is still in his booth. The distribution center door is still closed but not secured. The hair net is still the only credential required.

The difference between 2007 and 2026 is not the factory. The difference is what’s waiting outside.

And the outside has changed everywhere.

In Part 3, I’ll show you what happens when entire nations outsource their ability to fuel themselves — and then the world stops cooperating.

Kai Roer is the creator of the Security Culture Framework and founder of Praxis Security Labs. He has been walking into places he shouldn’t be able to access for over four decades.

Part 1: The Walk-Through

You are standing outside a factory. One of the largest food producers in the country. A butcher operation — industrial scale. Hundreds of employees. Trucks coming and going. The smell of death and logistics.

One year ago, this company made national headlines. A food poisoning case. Customers died. The fallout was public, brutal, and expensive. If any facility in the country should have locked down, tightened access, and taken physical security seriously — it’s this one.

There is a perimeter guard in a small house at the gate. A sign tells all visitors to report in.

You ignore the sign. You follow a group of employees through the gate. The guard doesn’t look up.

You turn left. The others head for the main entrance. You walk to the distribution center. The door is closed but unlocked. Inside, three drivers in factory uniforms. You ask a question you know they can’t answer. “I’ll go looking for him,” you say. They nod. You walk into the restricted food storage area.

Conveyor belts. Refrigeration units. Product ready for loading. The policy says you need a hair net in this area. You’re not wearing one. Nobody says a word. Nobody gives you a second look.

You leave the distribution center. On the way out, you ask the drivers where the coffee machine is. They look at you for a moment. You smile. “He hasn’t arrived yet — I’ll just have a coffee while I wait.” They point upstairs.

You climb. The office floor. You check every room on your way to the coffee machine. Only one is locked. No people.

At the end of the hallway, a metal door opens into the ventilation and cooling systems. Fresh air supply for the entire production floor. A woman in white walks toward you. You nod. “Good morning.” She smiles. You pass each other.

Down a stairway. Now you’re at the heart of it. Pig carcasses on hooks, moving along the ceiling from the butcher line to the cutters. Slow, steady. The operational core of a nationwide food supply.

“HEY YOU.”

You turn around. A man in butcher’s dress. Your pulse rises. Then: “You need to put on a hat.”

“Oh, yes. I forgot.”

He points to a box on the wall. A thin plastic hair net with a paper strip. You put it on. Now you’re wearing part of the uniform. He moves on.

You move through the rest of the factory without incident.

In the basement, you find the laundry. You pick up a couple of t-shirts and a jacket. They might come in handy later. At the end of your visit, you sit down in the staff cantina. Coffee. A bite to eat. Mission accomplished.

That was 2007.

Nineteen years ago, I walked through that factory. Every detail you just read happened. I published it as a blog post the same year, asking one question: What if this had been a terrorist with anthrax?

The post circulated. Some head-nodding. Then everyone moved on. The factory didn’t change.

Here is what I want you to sit with:

the same walk-through would work today.

Not at every factory. Some industries have moved. Banking invested heavily in physical and digital access controls. Pharmaceutical and biotech tightened under regulatory pressure. Airports, obviously.

But food production? Logistics hubs? Water treatment? Manufacturing? Energy substations?

Try it. Think about the last factory, warehouse, or production facility you visited. How far did you get before someone asked who you were? Did anyone check your ID? Could you have kept walking?

In most cases, the answer is yes. The perimeter guard is still in his booth. The door is still closed but unlocked. The hair net is still the only credential required.

Nineteen years. And the pink cloud persists.

But here’s what has changed: the world outside the factory.

In 2007, the anthrax question was a provocation. A hypothetical designed to make security managers uncomfortable. The geopolitical environment allowed that kind of naivety. Norway was stable. Europe was stable. NATO was unquestioned. Supply chains were assumed to be safe because they always had been.

In 2026, none of that is true.

Europe is at war. Not metaphorically — there are artillery exchanges, drone strikes, and territorial occupation on the continent. Hybrid warfare — the deliberate targeting of civilian infrastructure to destabilize societies — is documented, operational, and ongoing. Nord Stream. Undersea cables. GPS jamming across Scandinavia. Railway sabotage. Arson at logistics facilities.

The Middle East is in active, expanding conflict. The downstream effects — energy disruption, refugee pressure, opportunistic actors — ripple into every supply chain on earth.

And the question I asked in 2007 — what if someone wanted to poison the food supply? — is no longer hypothetical. It is a documented category of hybrid warfare. It is in the playbooks, and it has been publicly framed as an active vector — most explicitly by the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE), a NATO/EU body whose 2022 report treats food supply disruption not as a hypothetical but as an operational instrument of state-sponsored destabilisation.

The factory hasn’t changed. The threat has.

When a critical infrastructure failure can be traced to a governance gap — inadequate oversight, deferred investment, unreviewed access controls — the question stops being operational and starts being one of board accountability, regulatory exposure, and fiduciary liability.

This is Part 1 of a six-part series. In the next piece, I’ll walk through what the 2026 geopolitical environment actually means for physical security at critical infrastructure — and why the pink cloud isn’t just naïve anymore. It’s dangerous.

Kai Roer is the creator of the Security Culture Framework and founder of Praxis Security Labs. He has been walking into places he shouldn’t be able to access for over four decades.

Can You Still Take Out Our Factory? was originally published in Security, traveling, entrepreneurship. on Medium, where people are continuing the conversation by highlighting and responding to this story.