Sep 25, 2026 · 33 min
Critical infrastructure must rehearse disruption before crisis strikes
Shut it down before they do.
Resilience depends on knowing what must keep operating, who owns recovery, and whether teams have practiced restoring it under pressure.
- 1Organizations should map mission-critical systems, identities, third parties, and data before an incident exposes hidden dependencies.
- 2Realistic tabletop exercises build recovery muscle memory and reveal restoration priorities that compliance-focused meetings often miss.
- 3AI accelerates defense and attack alike, expanding agentic decision-making, phishing, reconnaissance, and the security attack surface.
Don't miss
Todd Thorsen’s case for mapping mission-critical dependencies and rehearsing restoration order turns resilience from an audit exercise into an operational discipline.
The brief
Critical infrastructure faces disruption from aging technology, underinvestment, known vulnerabilities, and geopolitical pressure—not just conventional network intrusion.
CrashPlan CISO Todd Thorsen says incident response should start by mapping the systems, identities, third parties, and data that must keep operating.
The practical test is a realistic tabletop exercise: teams rehearse outages, clarify restoration order, and build recovery muscle memory before an emergency.
Thorsen argues resilience work fails when exercises become audit-box meetings; executive sponsorship and cross-functional participation make preparation consequential.
AI raises the stakes on both sides, letting agentic systems trigger downstream actions while attackers improve phishing and reconnaissance at greater speed and scale.