Threat environment
Critical national infrastructure operates under a threat model in which local weaknesses can create national consequences. Energy, transport, communications, water, industrial and other essential systems depend on combinations of operational technology, enterprise IT, physical assets, specialist people, contractors, utilities and logistics. The resulting attack surface is rarely contained by the facility boundary. An adversary may never need to defeat the strongest control directly if a supplier account, remote-maintenance route, trusted contractor, exposed site or fragile dependency offers a more achievable path to the same operational effect.
Typical adversaries
Typical adversaries include state and state-aligned actors seeking intelligence, strategic leverage or disruption; organised criminal groups pursuing extortion, theft and fraud; malicious or recruited insiders with legitimate access; and other hostile actors seeking reputational or operational impact. These groups differ markedly in intent, capability, patience and tolerance for detection. Treating them as a single generic threat obscures the decisions that matter. ARM therefore starts with the actor: what outcome they want, what they can realistically do, and where opportunity exists within the organisation and its wider dependency network.
Critical vulnerabilities
Critical vulnerabilities often sit at the junction between domains. Legacy operational systems may prioritise availability over rapid change. Remote sites can depend on limited communications or specialist maintenance. Third parties may retain privileged digital or physical access. Key spares, fuel, logistics, utilities or communications may have concentrated dependencies. People with deep operational knowledge may become single points of failure or attractive targets for social engineering and coercion. The important question is not simply whether each individual control is compliant, but whether an intelligent opponent can combine several modest weaknesses into a credible attack pathway.
RiskAdviza approach
RiskAdviza applies the ICO triad and FARM cycle across the Five Operational Fronts: Cyber, Physical, Personnel, Supply Chain and Information. The Adversarial Threat Assessment frames the relevant actors and critical assets, tests intent, capability and opportunity, and maps plausible routes from reconnaissance to operational consequence. From that evidence base, the FARM cycle supports decisions: Frame the threat precisely, Assess current exposure, Respond with prioritised options and explicit trade-offs, and Monitor the indicators that would show the threat picture or organisational exposure is changing.
Leadership priorities
For leadership, the objective is a defensible view of where security investment changes adversary opportunity rather than merely adding controls. Priorities can include closing cross-domain attack paths, reducing concentrated dependencies, improving contractor and privileged-access governance, testing crisis decisions, and establishing indicators that can be monitored over time. This allows boards and executive teams to connect protective security, resilience and investment decisions to the adversaries most capable of affecting the services and assets that matter most.