AI is turning cloud, edge, connectivity and data into one interdependent system. In this article I explore why that makes resilience the defining infrastructure challenge, and why it now has to be designed across the whole system.
AI is turning cloud, edge, connectivity and data into one interdependent system. In this article I explore why that makes resilience the defining infrastructure challenge, and why it now has to be designed across the whole system.
The attack surface is expanding, threats are intensifying, and the protection horizon is lengthening. This is the clear pattern
Most conversations about AI infrastructure begin with capacity. Do we have enough chips? Enough data centers? Enough power? Enough network capacity to move growing volumes of data?
These are important questions. The recently published techUK report “Digital Infrastructure 2035” shows why they are becoming urgent. Government modeling cited in the report projects that UK demand for AI-related compute could be four to seven times higher by 2035. That estimate does not include general-purpose computing or non-AI workloads. Total demand will be higher still. But capacity is only part of the challenge.
The growth of AI is also changing the shape of digital infrastructure. Computing is becoming more distributed. Environments are becoming more heterogeneous. Connectivity, compute and data infrastructure are becoming more dependent on one another. The report examines this at a national level. The same architectural shift is taking place globally and inside organisations.
The relationship is direct. Organisations inherit dependencies on power, fibre, data centres, subsea cables and global supply chains. They then add cloud platforms, identity services, applications, APIs and suppliers of their own. National and enterprise resilience are therefore two layers of the same problem.
These forces are concurrent and compounding, not a causal chain. A more distributed environment creates more dependencies and more paths through which disruption can travel. Intensifying threats increase the pressure on that environment. Longer-lived data and technology dependencies extend the period over which protection must be planned.
Together, these forces are making resilience the unifying digital infrastructure challenge of the next decade.
Resilience, the unifying challenge
Much of the training of large AI models will remain concentrated in hyperscale data centres. It requires enormous amounts of specialised compute, power and cooling.
Inference and real-world use are different. As AI becomes embedded in healthcare, manufacturing, transport, public services and industrial systems, more processing will need to happen closer to the applications, users and data it serves.
Public cloud will not replace private infrastructure. Edge computing will not replace data centres. Mobile networks will not replace fibre. They will all co-exist.
A Gartner’s report from 2024 projects that 90% of organisations will operate hybrid-cloud models by 2027. It also describes a future in which large centralised facilities coexist with distributed edge nodes, enterprise systems and increasingly intelligent networks.
Connectivity is following the same pattern. Fixed, mobile, satellite and enterprise wireless networks have traditionally been treated as separate architectures. They are now moving towards a “network of networks” model. Workloads will shift across these networks according to latency, availability, policy, location and service need.
These technologies may remain technically distinct. They may still come from different suppliers. But from the perspective of the organisation using them they have to increasingly operate as one environment.
That does not mean they become one technology or one supplier environment. It means they form an interdependent system of systems whose boundaries still matter for segmentation and containment, even if those boundaries are no longer sufficient to explain end-to-end risk.
It is not simply a question of having more devices or more endpoints. There are more identities, APIs, suppliers, workloads and machine-to-machine interactions. AI agents add another class of non-human identity, often with authority to access information and take action.
There are also more dependencies between components that were once operated separately. An application may depend on a cloud platform, an identity provider, a security service, several networks, an external data source and a chain of software suppliers. Each component can appear secure and available in isolation while the service remains vulnerable at the joins between them.
There is another implication, the boundaries between networks, clouds, compute, applications are becoming less useful for understanding how risk actually travels. Interdependence can also improve resilience when it creates diversity, rerouting and alternative capacity. The danger lies in hidden coupling, correlated dependencies and shared failure domains that make apparently separate components fail together.
This growing complexity is emerging at the same time as the threat environment becomes more serious.
The NSCS Annual review 2025 records 204 nationally significant cyber incidents between September 2024 and August 2025. That was up from 89 the previous year.
Eighteen incidents were classified as highly significant. This represented an increase of almost 50% and the third consecutive annual rise. The figures do not mean that every category of attack is increasing at the same rate. Nor is the growth in infrastructure complexity solely responsible for the rise in threats.
The NCSC has warned that defensive capability across critical infrastructure is not keeping pace with the threat.
Geopolitical competition is intensifying. State-sponsored actors present a capable and persistent threat. Criminal groups continue to industrialise ransomware, extortion and credential theft. AI is capable of lowering the cost of some forms of attack and increasing the speed at which weaknesses can be found and exploited.
The practical effect is clear. The environment is becoming harder to defend at the same time as the pressure against it increases. The target is also no longer only software.
Digital services depend on physical infrastructure. Data centres depend on energy, cooling, specialist hardware and high-capacity fibre. International services depend on subsea cables. Distributed computing depends on reliable connectivity at the edge.
A cyberattack can interrupt physical operations. Damage to physical infrastructure can remove digital services. A disrupted supplier can create both a capacity problem and a security problem.
As infrastructure becomes more interconnected, the system can fail in more ways. Disruption can also travel further from its original source. This is the point at which the resilience problem becomes broader than cybersecurity. The cyber attack surface sits within a wider dependency and failure surface that includes power, cooling, cables and suppliers.
Organisations must also protect against risks that do not fully materialise today. Quantum computing provides the clearest example.
A sufficiently capable quantum computer could eventually undermine some of the public-key cryptography used to protect transactions, identities, communications and data. Nobody can predict the exact point at which that capability will become practical. But uncertainty about the date does not remove the need to prepare.
The NCSC has already established a post quantum migration timeline. By 2028, organizations should have defined their migration goals, completed a full discovery exercise and produced an initial migration plan.
By 2031, they should have completed their highest-priority migrations and refined their roadmaps. By 2035, the migration of systems, services and products should be complete. Those dates may sound distant. For large organisations, they are not.
Cryptography is embedded across applications, networks, devices, certificates, identity systems and supplier products. Many organisations do not have a complete inventory of where it is used. Some systems will take years to replace. Others will depend on vendors that follow different migration schedules.
Post-quantum readiness is therefore not a product upgrade. It is a long-term transformation programme. There is also a more immediate concern.
Sensitive information collected today may retain its value for many years. An adversary does not necessarily need to decrypt it now. Encrypted data can be captured and stored in the hope that future computing capabilities will make it accessible later.
This does not mean that every theft of encrypted data is motivated by a future quantum capability. It means that organisations must consider the lifetime of the information they hold, not only the strength of the protection available today.
The protection problem has gained a temporal dimension. Security decisions made now may need to protect information against capabilities that will not mature for years. Quantum is the clearest example of a broader timing problem. Risk emerges when the lifetime of data and systems, and the time required to migrate them, extend beyond the effective life of the controls protecting them. The issue is operational as well as cryptographic because identity, certificates, software signing, secure communications and supplier products must migrate together.
Teams across the organisation are focusing on their respective areas to solve those challenges but the organisation experiences the result as one system.
That is why resilience is becoming the unifying challenge. Here, resilience means preserving critical outcomes and trust through disruption or compromise. It includes availability and recovery, but also confidentiality, integrity and the continued reliability of the identities and controls on which the system depends.
The techUK report identifies four dimensions of national digital infrastructure resilience: hardware supply chains, cyber threats, physical infrastructure and post-quantum security.
That framing is important because it changes the unit of analysis. The relevant unit is no longer the individual component but the complete critical service and its dependency system. A secure firewall cannot compensate for a critical service that depends on a single network route. A replicated application cannot remain available if every instance relies on the same identity provider. A multi-supplier strategy offers limited protection if those suppliers depend on the same upstream component. Strong encryption provides little long-term assurance if the organisation does not know where vulnerable cryptography is embedded.
Resilience cannot be reduced to redundancy within one layer nor delegated entirely to the cybersecurity function.
It is an emergent property of the whole operating environment. A resilient organisation can continue delivering its most important outcomes when a component, supplier or assumption fails. It understands what depends on what. It can detect disruption across boundaries. It can contain failure before it propagates. It has alternative paths and knows how to recover.
That requires several changes in how infrastructure is managed. Those changes can be grouped into three capabilities: understanding dependencies, observing, testing and containing propagation, and governing across organisational and time boundaries. First, organisations need to map critical services and the dependencies that support them. An asset inventory is necessary, but it is not enough. The important question is how failure in one component affects the service as a whole.
Second, operational visibility must follow the service across network, cloud, security, application and supplier boundaries. This does not require every technology to come from one provider. It does require teams to build a shared picture of what is happening.
Third, resilience must be designed around containment, graceful degradation and recovery. The goal cannot always be to prevent every failure. It must also be to preserve the most important functions when failure occurs. Resilience should be demonstrated through scenario exercises, failover tests and supplier-recovery tests rather than inferred from design alone.
Fourth, planning must operate across different time horizons. Organisations need to address current vulnerabilities while preparing for structural risks such as supply-chain concentration, cryptographic migration and changing infrastructure dependencies.
Finally, accountability must cross organisational boundaries. If connectivity, security, cloud and applications operate as one environment, governance cannot stop at the edge of each team or supplier contract.
Digital infrastructure is becoming the foundation of almost every form of economic activity. That foundation will be larger, more distributed and more heterogeneous than the one organisations operate today. It will also face more persistent threats and risks that extend further into the future.
The response is not merely more cybersecurity. It is a broader approach to resilience that connects architecture, operations, security, supply chains and long-term technology planning.
The organisations best prepared for this future will be those that stop treating these as separate problems and begin designing resilience across the system as a whole.
