Organizations may not recognize their exposure to conventional, cyber, and hybrid risks until a disruption occurs. Here is how they can anticipate and reduce risks associated with these threats. In January 2026, a suspected arson attack triggered a power outage in Germany, leaving over 45,000 homes without electricity.1 About seven months later, cyberattacks on water systems across at least seven US states caused operational disruptions, in some cases contributing to loss of water pressure and flooding.2 Critical infrastructure has always been exposed to disruption from natural hazards, physical attacks, espionage, and cybercrime, plus a range of other potential intrusions. What is evolving is the speed, complexity, and confluence of these threats. Physical attacks and natural hazards now coexist alongside threats exploiting digital vulnerabilities, or even those combining physical, cyber, and informational tactics. Advances in AI are further complicating the threat landscape by accelerating both attack and defense. Adversaries can use increasingly capable frontier models, for instance, to identify vulnerabilities and quickly orchestrate attacks, while organizations can use the same technology to test their defenses and identify weaknesses before they are exploited.