Critical infrastructure is no longer just something states protect in wartime. It is increasingly the terrain on which coercion happens. Power grids, water utilities, data centres and undersea cables now sit at the intersection of cyber conflict, military planning and economic pressure. The new test of deterrence is not only whether a state can retaliate, but whether it can keep essential services running under sustained pressure.

What makes a battlespace strategic is not simply that it can be attacked, but that attacking it alters an opponent’s choices. By that measure, critical infrastructure has become one of the most important security theatres of the current decade. The old distinction between military targets and civilian systems is eroding because civilian infrastructure now underpins mobilisation, social stability, economic output and public confidence. Electricity powers not only homes but command networks and defence industry production. Water systems are no longer isolated utilities; they are digitally managed public-health assets. Data systems, from cloud providers to pathology labs and undersea fibre links, are the connective tissue of finance, logistics, intelligence and daily governance. The EU’s NIS2 Directive captures this reality by grouping energy, drinking water, waste water and digital infrastructure among the sectors whose disruption now poses systemic risk across borders.

This is why the most worrying incidents are not always the most dramatic. The FBI’s warning in 2024 about Volt Typhoon was strategically important because it described pre-positioning inside US critical infrastructure, including telecommunications, energy and water, apparently for use in a future crisis. The key lesson was intent: the objective of such access is not only theft of information but the creation of options for timed disruption. Salt Typhoon’s later compromise of telecom networks reinforced the same point from a different angle. Communications systems are not merely commercial assets; they are surveillance, crisis-management and command assets. A conflict today may begin with malware in routers, lawful-intercept systems or industrial controllers long before it begins with missiles. In other words, infrastructure access has become a form of strategic positioning.

The same logic applies to water. In October 2024, American Water said it had detected unauthorised activity on its network and disconnected systems, pausing billing and customer service operations while trying to prevent further harm. Public reporting indicated that water and wastewater operations continued, but that detail should not reassure policymakers too much. It illustrates the real problem: even when operational technology remains intact, disruptions to surrounding IT, customer systems and administrative functions can still degrade confidence, slow Critical Infrastructure as the New Battlespace: response and expose a sector that many governments already consider under-protected. US officials warned in 2024 that around 70% of inspected water utilities were falling short of standards designed to prevent cyber intrusions. Water is not only a humanitarian issue; it is an ideal coercive target because it combines high public visibility, chronic underinvestment and low tolerance for operational failure.

Data systems have proved just as politically consequential. The Synnovis ransomware attack in London in June 2024 disrupted pathology services across major hospitals, and in June 2025 British officials said the incident contributed to a patient death. That is a stark reminder that “data infrastructure” is not abstract. Lab systems, identity systems, hospital records and cloud-hosted business platforms are operational infrastructure in their own right. The same insight was visible in the July 2024 CrowdStrike-related outage: not a hostile attack, but a systemic failure that affected nearly 8.5 million Windows devices and disrupted flights, healthcare and banking because critical services were concentrated on a narrow technological stack. Strategic vulnerability, then, comes from both adversaries and architecture. Monoculture, over-centralisation and supplier concentration can produce national-security effects even without a hostile actor pulling the trigger.

Subsea cables show how the physical and digital layers have fused. Baltic incidents in late 2024 and early 2025 affected power interconnectors and fibre links at the same time, prompting NATO’s Baltic Sentry mission and EU calls for closer monitoring of risky vessels. Attribution remains contested in several cases, and that matters: ambiguity is part of the toolset. If hostile actors can create disruption while keeping legal and political certainty just out of reach, they gain leverage without triggering an automatic military response. What matters strategically is not only whether a ship dragged an anchor deliberately, but that Europe now has to plan as if its connectivity, not just its territory, is contestable. Once power cables, telecom cables and maritime energy infrastructure are understood as common targets, infrastructure protection becomes less a technical field than a theatre of deterrence.

The policy consequence is that resilience has to be built around continuity, not around the illusion of perfect prevention. ENISA’s threat analysis placing availability attacks, ransomware and threats against data at the top of the landscape is a warning that the central problem is interruption. Governments therefore need reserve capacity, manual fallback procedures, cleaner separation between IT and OT, better incident reporting and faster public-private information sharing. Operators need redundancy not just inside networks but across suppliers, routes and governance arrangements. And both sides need to treat recovery time as a strategic metric. An infrastructure system that can restore service in hours under pressure sends a deterrent message; one that needs weeks or months invites repeat targeting. The new battlespace is not defined by geography alone. It is defined by whether an adversary can make modern life stop.