Image generated by AI
Organisations can no longer afford to overlook the infrastructure, technology, suppliers, and institutions that keep them running.
When I was younger, I drove a 1976 Toyota Corolla. It was a brilliant car. I could open the bonnet, see what connected to what, and, if something broke, fix it with gaffer tape, Blu Tack, and a wire coat hanger. I could repair dents with a rubber mallet I kept in the boot. Life was simple back then. These days, car engines have so many wires, pipes, hoses, and other whatsits that I have no idea what does what. Do I even know how to open the bonnet, in fact?
Running an organisation is heading the same way. In the not-too-distant past, the systems beneath most organisations were fewer, simpler, and more predictable. Leaders did not need to understand every component because they could generally assume that the foundations were stable and broadly neutral. Today, organisations rely on a far more complex combination of infrastructure, technology, suppliers, platforms, and institutions, much of which sits outside their control. Geopolitical competition can change who supplies those systems, who controls access, and who designs and enforces the standards. A problem somewhere under the bonnet can bring several parts of the organisation to a juddering halt at once.
The Australian Government’s 2026 Critical Infrastructure Annual Risk Review, new research from McKinsey, and my earlier work in The Geopolitics of Infrastructure and The Geopolitics of Australia’s Great Big Data Centre Bet all lead to the same conclusion: Every organisation’s ability to succeed depends on infrastructure, technology, suppliers, and institutions it does not fully control. Those dependencies are becoming more interconnected, concentrated, and politically contested. Organisations therefore need to understand what they depend on, how those dependencies interact, and whether today’s responses to disruption are changing their future operating environment.
What keeps your organisation running?
The Australian Government’s review starts from the recognition that disruption no longer remains neatly contained within one asset, organisation, or sector. It can spread through interconnected systems, affecting several services at once. The report therefore calls on critical-infrastructure operators to prepare for the failure of shared dependencies and to demonstrate that they can maintain essential services when disruption occurs.
That message applies well beyond formally designated critical infrastructure. A business may depend on energy, payments, cloud services, logistics, suppliers, customers, and market access. A government department may rely on technology platforms, contractors, secure communications, specialist personnel, and other levels of government. Councils, NGOs, universities, and healthcare providers each have their own combination of critical dependencies.
The difficulty is that these dependencies may be less diverse than they appear. Several software suppliers may use the same cloud platform. Different contractors may rely on the same telecommunications network. Multiple supply chains may pass through the same port or ultimately depend on the same manufacturer.
McKinsey’s research shows how concentrated these relationships already are. Half of the organisations surveyed reported highly concentrated cloud or software-provider relationships, while almost three-quarters relied on moderately to highly concentrated providers for AI applications. Only 24 per cent had a clearly defined strategy for managing what McKinsey calls digital-sovereignty risk: the risks to access and control that come from relying on digital providers in particular jurisdictions.
Responsibility for these risks is often divided among technology, physical security, risk, compliance, procurement, operations, and human resources. Each function may manage its own responsibilities competently, but a failure affecting one supplier or system can disrupt several functions at once. Managing each risk separately may therefore leave the connections between them poorly understood.
AI makes the underlying dependencies more complex
AI adds another layer to these interconnected dependencies because it relies on extensive physical and digital infrastructure while also changing the capabilities available to attackers and defenders. AI systems depend on data centres, electricity, water, advanced chips, critical minerals, cloud platforms, communications networks, models, data, and specialised personnel.
As I argued in The Geopolitics of Australia’s Great Big Data Centre Bet, building data centres in Australia can increase domestic computing capacity. However, it does not, by itself, secure access to the imported chips, foreign-controlled models, energy systems, and international technology supply chains that make that capacity useful. An Australian data centre remains part of a much larger international system of dependencies.
At the same time, AI can improve operations, security, and decision-making. AI can also make sophisticated attacks cheaper, faster, and more accessible, while effective defence continues to require specialist skills, reliable data, computing capacity, continuous monitoring, and substantial investment. The Australian Government’s review expects the cost of mounting attacks to keep falling while the cost of defending against them rises.
The rising cost of defence matters beyond the largest infrastructure operators. A well-resourced organisation may strengthen its own systems and remain exposed through contractors, software vendors, councils, suppliers, or service providers that cannot invest at the same level. As attacks become more accessible, capability gaps between organisations may become weaknesses across the wider system.
For boards and organisational leaders, the question extends beyond the adequacy of their own cyber controls: Are defensive capabilities improving as quickly as the capabilities available to potential attackers across the whole system on which the organisation depends?
The road ahead is changing too
Understanding these dependencies helps organisations prepare for immediate disruption. They can diversify suppliers, strengthen controls, hold more inventory, invest in backup systems, retain critical skills, and practise operating under different conditions. However, adaptation is only part of the story. When governments and organisations across the economy respond in similar ways, their decisions can begin to change the system itself. Governments are restricting suppliers, promoting domestic capability, tightening data rules, subsidising strategic industries, and introducing new security standards. Organisations are duplicating infrastructure, changing technology platforms, moving production, and reorganising supply chains around trusted jurisdictions.Each decision may be a reasonable response to a particular vulnerability. Collectively, however, these decisions can change who participates in markets, where infrastructure is built, which standards apply, who controls access, and how much choice organisations retain.
To understand the longer-term implications, it helps to separate three things: the immediate effect of a disruption, the adaptations made in response, and any structural change those adaptations produce. A disrupted supply may be an immediate effect. Finding another supplier is an adaptation. A wider shift towards politically aligned supply chains, competing technology systems, or national restrictions on access changes the conditions under which future decisions will be made. For this third category, continuity planning alone is insufficient. The assumptions underpinning the organisation’s strategy, investments, partnerships, and operating model may also need to change.
Leaders need to look under the bonnet
Boards, executive teams, agency heads, council leaders, and other accountable authorities do not need to understand every technical component. They do need a clear view of what must continue to work, what those activities depend on, where several activities rely on the same underlying systems, and which dependencies would be difficult to replace. They also need to know whether their alternatives would work during a widespread disruption, when many other organisations may be seeking the same replacement capacity. And they need to distinguish between risks that can be managed through operational adaptation and changes that may permanently alter the organisation’s operating environment. As geopolitical competition increasingly shapes access to technology, infrastructure, markets, and supply chains, organisations also need to understand who controls their critical dependencies, under which jurisdiction, and how those arrangements could change.
The immediate purpose is resilience. The strategic purpose is to preserve the organisation’s ability to choose how, where, and with whom it operates as the surrounding system changes. That means preparing for a world in which commercial considerations increasingly sit alongside security, sovereign capability, political alignment, and control over critical systems.
Leaders can no longer afford to drive without understanding what keeps the organisation running, what could bring several essential activities to a halt at once, and how changes beneath the surface may narrow the routes available in future.