Sophisticated hybrid adversaries rarely ask, "What can we disrupt?" The ask, "What consequences can we trigger?"
Their objective is to create strategic, economic, political, operational, or societal effects that exceed the immediate consequences of a particular incident. For this reason, they often focus on critical dependencies that connect multiple systems, sectors, and functions.
Gas electricity interdependencies are one of the most significant examples of such dependencies in critical infrastructure. In many jurisdictions, electricity generation depends substantially on natural gas supplies, while gas production, transmission, storage, and distribution depend on continuous access to electricity. This creates a mutually reinforcing relationship in which disruption affecting one sector may rapidly affect the other, generating consequences that extend far beyond the original point of failure.
Traditional security approaches frequently focus on protecting individual facilities, systems, and networks. Hybrid adversaries, by contrast, exploit the relationships between systems. They look for points where operational, technological, economic, regulatory, and societal dependencies intersect. Gas electricity interdependencies provide precisely such an opportunity.
The attractiveness of these interdependencies is further increased by their potential to generate second order and third order effects.
A first order effect is the immediate consequence of an incident. For example, a disruption affecting a major gas transmission pipeline may reduce the availability of natural gas for electricity generation.
A second order effect emerges when reduced electricity generation begins to affect other sectors that depend upon reliable power supplies. Manufacturing facilities may be forced to reduce production. Data centres, hospitals, financial institutions, and logistics providers may activate contingency measures to maintain critical services. The severity of these consequences will depend on the duration, scale, and geographic scope of the disruption, but also on the resilience measures implemented and the hybrid risk preparation of affected organizations.
Third order effects arise when these operational disruptions generate broader economic, societal, regulatory, or political consequences. Reduced industrial output affects supply chains. Energy shortages contribute to increased prices and market volatility. Prolonged disruptions trigger emergency government measures, regulatory interventions, contractual disputes, and increased public scrutiny of critical infrastructure operators. A main target is often to affect public confidence and to influence policy decisions.
Understanding better the gas electricity interdependencies
For most people, natural gas is important for heating homes and industrial facilities. But in many countries, a significant proportion of electricity is generated by power plants that burn natural gas. These gas fired power plants convert the energy contained in natural gas into electricity that is supplied to homes, businesses, transportation systems, hospitals, data centres, telecommunications networks, and other users.
The relationship is particularly important because electricity cannot generally be stored at national scale in sufficient quantities to support prolonged demand. Electricity must be generated continuously to match consumption. Gas fired power plants play a critical role in this process, because they can increase or decrease electricity generation relatively quickly. As a result, they are frequently used to balance electricity grids and compensate for fluctuations in demand and renewable energy production.
For example, if wind generation unexpectedly decreases, grid operators may increase output from gas fired power plants. Similarly, during periods of unusually high electricity demand, gas fired power plants provide additional generation capacity to maintain grid stability.
This creates an important dependency. Electricity generation depends not only on the existence of power plants, but also on the continuous availability of natural gas.
Before reaching a power plant, gas must pass through production facilities, processing plants, transmission pipelines, compressor stations, storage facilities, liquefied natural gas (LNG) terminals, distribution systems, and various monitoring and control systems. Each component contributes to the ability of the power plant to obtain the fuel required for electricity generation. Disruptions affecting any part of this chain may affect electricity generation.
A simplified example: Natural gas is produced in one location, then transported through transmission pipelines. Compressor stations maintain the pressure required to move the gas over long distances. Storage facilities help manage fluctuations in demand. Eventually, the gas reaches a power plant where it is used to generate electricity.
If a major transmission pipeline becomes unavailable, less gas may reach the power plant. If a compressor station stops operating, gas flows may be reduced. If storage facilities cannot release sufficient quantities of gas during periods of high demand, power plants may receive less fuel than expected.
The immediate consequence is not necessarily a power outage. However, electricity operators will have fewer generation options available to maintain grid stability. They may be forced to follow a path that adversaries have designed.
Gas supports electricity generation. Electricity supports gas transportation and distribution. Together they form a mutually dependent system, not two independent sectors. From a resilience perspective, disruptions propagate through both systems. A problem that begins in the gas sector affects electricity generation. Problems affecting electricity generation affect gas infrastructure.
Hybrid adversaries view gas electricity interdependencies as pathways through which multiple dimensions of national resilience can be affected simultaneously. Such dependencies offer opportunities to amplify disruption, increase uncertainty, complicate response efforts, and exploit the interconnected nature of modern societies.
It is January. Temperatures are unusually low, and extreme weather conditions are expected. Electricity demand is already high. Several gas fired power plants are operating.
Several energy sector journalists report receiving documents from an individual claiming to be an employee of a major gas operator. The documents allege deficiencies in maintenance practices, unresolved audit findings, and management awareness of operational vulnerabilities. Additional documents subsequently appear on industry forums and social media platforms. Initial review suggests that some materials may be authentic, while others may have been altered, selectively disclosed, or fabricated.
The identity and motives of the source remain unknown. The sourse writes: "I am not asking anyone to believe me. I am only asking to investigate."
Some documents appear genuine internal emails and audit observations. There are allegations that certain managers bypassed controls and ignored security concerns.
Management becomes aware of the allegations and initiates an internal review to determine whether the documents are authentic and whether any of the issues raised require immediate investigation. Legal, compliance, communications, and risk management functions are notified. At this stage, no operational abnormalities have been identified and there is no evidence linking the allegations to any current operational challenge. However, management recognizes that the disclosures may create regulatory, reputational, governance, and market related risks regardless of their accuracy.
Journalists are informed that the organization is assessing the authenticity of the materials and that no operational abnormalities have been identified. At this stage, the organization declines to comment on specific allegations pending verification of the documents and completion of preliminary fact finding activities.
Additional documents appear online. It becomes increasingly difficult to distinguish authentic disclosures from fabricated material. Questions emerge regarding infrastructure resilience, cybersecurity governance, management competence, and regulatory / political oversight.
Three days later, at 06:15, operators detect abnormal behaviour at a major compressor station responsible for maintaining gas pressure within a transmission pipeline network.
Compressor stations function like pumps in a water system. Without sufficient compression, gas does not have the required pressure.
Gas operators reduce compressor output, introduce operational restrictions, increase safety margins, and try to understand what has happened. Less gas enters the downstream pipeline system. They cannot determine whether the anomaly reflects equipment malfunction, sensor failure, software defect, maintenance error, or a cyberattack.
Engineers compare pressure readings, vibration data, compressor control logs, and valve position data. The readings are inconsistent. They cannot safely confirm that the compressor station can operate at normal load. The control room imposes a more conservative operating envelope.
At 08:00, gas flows decline further. A major gas fired electricity generating facility contacts the gas operator seeking clarification regarding delivery forecasts. Additional personnel become aware of the situation.
At 08:50, a gas balancing team begins assessing the potential impact of reduced transmission capacity on downstream consumers, including gas fired electricity generation facilities.
At 08:55, engineers remain unable to determine the cause of the anomaly. Regional operations managers are informed.
At 09:00, an employee notices that social media accounts are already discussing the challenges. The discussion focuses on the leaked documents from previous days, but also recent developments and the situation that develops. Several posts claim that s something is happening inside the company. No evidence is provided.
At 09:20, the situation is escalated internally. The Chief Operations Officer and the General Counsel are informed. A crisis management team is working hard.
Before 09:30, several journalists contact the firm. Questions focus on the leaked documents, alleged governance failures, whether operational problems are occurring, and whether cybersecurity is involved. At this point, the Board has not yet been informed.
At 10:30, the incident reaches predefined escalation thresholds. The CEO is informed. The Board receives an initial briefing. The organization still does not know whether a cyber incident exists, whether the anomaly is technical, and whether the leak and the anomaly are connected.
At 11:00, the first media article appears. The article states: "Questions are being raised regarding operational resilience at the company following recent document leaks." The article does not claim an incident has occurred, but public speculation increases.
The Board's first challenge is to understand what is confirmed, and what is speculation. The next challenge is what must be disclosed. What must be explained to investors, customers, government authorities, employees, and the media.
The journalists appear to know more about the leaked documents and the existing challenges in the compressor station that the Board. This creates enormous pressure on decision makers. They must make governance, legal, operational, and communication decisions without knowing whether the public narrative is ahead of them, behind them, or completely wrong. That is exactly the type of ambiguity that sophisticated hybrid adversaries seek to create.
At 11:45, a second incident is reported. A pipeline interconnection operator reports anomalies affecting monitoring and operational verification systems. Under established safety procedures, transfer capacity is temporarily reduced, and additional verification procedures are introduced.
At 11:50, a third incident is reported, about regulation equipment failures.
Natural gas moves through transmission pipelines at very high pressures. Before gas can be delivered to power plants, distributed to industrial customers, and transferred to regional networks, the pressure must be controlled. Pressure regulation equipment performs exactly this function. It involves regulators, control valves, pressure sensors, actuators, and monitoring systems. This is a traffic control system for gas flow, that moves the correct amount of gas at the correct pressure.
Unfortunately, all 3 challenges can plausibly arise from three entirely different causes:
1. Maintenance failure. Deferred maintenance, inadequate inspection, aging components, calibration deficiencies, budget pressures, or contractor performance issues.
2. Hybrid attack. Monitoring data could be manipulated, maintenance records could be altered, sensor readings became unreliable, or a supplier compromise introduced incorrect settings.
3. A combination of 1. and 2. above. Adversaries have discovered an existing weakness (they did not create the weakness, they exploited it). Genuine maintenance deficiencies, genuine inspection concerns, genuine equipment degradation exist. The adversary attacks and affects exactly the points that had weaknesses.
Now the Board faces a nightmare, because the public narrative cannot be proved entirely false. There are internal documents about abnormal regulator behaviour, degraded actuator performance, and valve movement problems. Now the social media narrative is very hard to manage.
Around 13:30, large industrial customers contact account managers. They are concerned about supply reliability, possible interruptions, media reports, and contractual obligations.
At 14:00, the national supervisor requests information update. Soon after that, government officials request a situation report. The company must now explain what happened, what is known, what remains unknown.
At 15:20, a leaked email appears online. The email appears authentic. It contains discussion of budget constraints and deferred infrastructure upgrades. Social media immediately interprets the email as proof that management knowingly accepted excessive risk. Whether this interpretation is correct remains unclear.
Now the Board must handle operational disruption, cybersecurity concerns, regulatory engagement, media scrutiny, and governance allegations.
At 16:30, the Board receives an update. The cause, duration, validity of allegations, and future consequences are still unknown.
Each individual anomaly could be manageable. What transforms the situation into a strategic crisis is the simultaneous interaction of operational uncertainty, cyber uncertainty, governance allegations, media pressure, regulatory scrutiny, electricity sector consequences, investor response, and public speculation. That realization is often the most valuable lesson of a stress test.
At 16:45, the electricity grid operator informs the gas operator that reserve margins are becoming increasingly constrained.
At 17:00, a severe weather event that was expected for days affects the grid.
At 17:20, grid operators initiate emergency measures. Electricity is prioritized for hospitals, emergency services, telecommunications facilities, water systems, and selected assets considered essential for maintaining grid stability. Several gas transmission facilities experience reduced or interrupted electricity supply and transition to backup power.
At 17:21, gas operators report that several compressor stations are now operating on backup power. Others experience voltage instability. Some remote monitoring systems become unavailable. Communications with certain field locations become problematic.
At this point, crisis management teems realize they were worried about gas affecting electricity. They are now seeing electricity affecting gas.
After 17:30, there are cascading effects. Reduced electricity availability affects compressor stations, monitoring systems, control centres, telecommunications equipment, LNG support infrastructure, maintenance activities. Gas transmission capacity declines further.
As the incident develops and uncertainty regarding its causes and potential consequences persists, financial markets react. Public allegations concerning operational deficiencies, maintenance failures, cybersecurity weaknesses, governance shortcomings, or possible regulatory non compliance attract significant investor attention.
As uncertainty regarding the incident increases, market participants begin reassessing the organization's operational, regulatory, and financial exposure. Increased volatility is observed in the company's securities, and market commentators speculate regarding potential remediation costs, regulatory investigations, litigation exposure, business interruption impacts, and governance concerns. Short sellers believe that the full consequences of the incident may not yet be reflected in the market valuation of the affected entity.
Increased short selling activity contributes to market volatility, declining share prices, adverse media coverage, and intensified scrutiny from investors, analysts, lenders, and counterparties. There are concerns regarding potential litigation, regulatory investigations, remediation costs, business interruption losses, reputational damage, and future regulatory obligations. Importantly, these developments occur before experts complete their investigations and before the underlying causes of the incident have been conclusively established.
Boards and executive management know that financial market pressures emerge in parallel with operational, regulatory, political, and reputational challenges. The organization is required to address investor concerns, disclosure obligations, market speculation, and allegations regarding management oversight, while simultaneously managing the ongoing incident and cooperating with governmental authorities and regulators. In complex hybrid incidents, financial market reactions can become a significant source of pressure, influencing stakeholder confidence and organizational decision making before definitive facts are available.
As the operational situation deteriorates, political involvement intensifies significantly.
Government officials and elected representatives issue public statements emphasizing that the situation is being closely monitored. Parliamentary inquiries, requests for ministerial briefings, and formal information requests from relevant governmental authorities are initiated. Political representatives publicly question whether the incident was foreseeable, whether appropriate maintenance and risk management measures were implemented, whether existing regulatory obligations were adequately fulfilled, and whether competent authorities received sufficient warning regarding potential vulnerabilities. At the same time, competing political narratives emerge, attributing the situation to political and regulatory negligence.
Importantly, political pressure increases before the factual circumstances are fully understood. Boards and executive management find themselves operating in an environment where public expectations, political demands, regulatory scrutiny, and media attention intensify while investigations remain ongoing and definitive conclusions regarding causation, attribution, or responsibility cannot yet be reached. This divergence between the demand for certainty and the availability of reliable information is one of the most significant governance challenges arising during complex hybrid incidents.
The stress test scenario could be expanded significantly. Additional developments could include conflicting public statements, mistakes made by the Board or executive management when communicating with regulators, investors, customers, employees, or the public, disputes regarding insurance coverage, disagreements concerning the interpretation of policy terms and conditions, questions relating to the classification of the incident, notification obligations under insurance policies, reservation of rights communications, and disagreements regarding whether certain costs, business interruption losses, cyber related impacts, physical damage, or hybrid threat activities fall within the scope of available coverage. Each of these developments could increase the complexity of the exercise and create additional legal, regulatory, financial, and reputational consequences.
Is hybrid risk insurable? This is a very important question, and we strongly believe you must read the answer: https://www.hybrid-risk-management.com/Insurability.html
The objective of this stress test is not to exhaust every possible escalation path. It is designed to demonstrate how individually manageable events can interact across operational, cyber, physical, informational, regulatory, and governance domains to create systemic pressure on decision makers. The scenario illustrates how uncertainty regarding causation, attribution, responsibility, and future developments can complicate decision making long before the underlying facts have been established.
The exercise further demonstrates that critical infrastructure incidents rarely remain confined to a single organization or sector. Disruptions affecting gas transmission infrastructure may create consequences for electricity generation and distribution, while operational challenges may simultaneously trigger regulatory scrutiny, political involvement, media attention, financial market reactions, and public concern. In such circumstances, Boards are required to make consequential decisions despite incomplete information, competing assessments, and rapidly changing conditions.
No, a hybrid stress test can not predict the future, but it gives the opportunity to decision makers to experience difficult decisions before they encounter them during a real crisis. Organizations rarely have the opportunity to explore complex cascading scenarios under controlled conditions. During an actual incident, decisions must often be made under severe time pressure, incomplete information, public scrutiny, regulatory expectations, and operational stress. A hybrid stress test creates an environment in which Boards, executives, legal teams, operational personnel, cybersecurity specialists, communications teams, and other stakeholders can examine how they would respond to such challenges before the consequences become real.
DISCLAIMER: The analysis presented here is provided solely for informational, educational, and professional development purposes. It does not express support for, or opposition to, any government, regulatory authority, political party, public institution, private organization, policy initiative, or geopolitical position. Its purpose is to assist risk, compliance, legal, governance, resilience, and security professionals in understanding regulatory, legal, operational, and geopolitical developments that may affect their professional responsibilities.
The content is intended to facilitate informed decision making by examining structural trends, regulatory interactions, interdependencies, and potential areas of operational impact. It does not constitute legal advice, regulatory guidance, policy advocacy, investment advice, or an endorsement of any particular legal, regulatory, commercial, or political position.
Any scenarios, examples, stress testing exercises, simulations, or case studies discussed are hypothetical and are designed exclusively to illustrate risk management, resilience, governance, compliance, and strategic planning concepts. Unless expressly stated otherwise, they do not describe, refer to, or represent any actual organization, country, government, institution, individual, incident, crisis, dispute, investigation, operation, or real world event.
References to sectors, critical infrastructures, technologies, jurisdictions, threat actors, or operational environments are illustrative in nature and should not be interpreted as allegations, factual assertions, predictions, or assessments regarding any specific entity or ongoing situation.
Learn more about hybrid risk, in the following Cyber Risk GmbH websites:
1. https://www.hybrid-risk.com
2. https://www.hybrid-risk-management.com
3. https://www.hybrid-stress-testing.com
4. https://www.defensive-hybrid-intelligence.com