The Art of Conflict: Revisited, After the First Shock of the Iranian Conflict

Executive summary

Iran is not only a cyber escalation story; it is a resilience test for organizations dependent on cloud, identity, OT, telecom, third parties and AI-era compute. 

The most exposed organizations are not always the most geopolitically visible; they are the ones with fragile dependencies, internet-facing operational systems, weak identity controls and untested recovery assumptions. 

The mandate for leadership: map what matters, reduce obvious exposure, test degraded operations and govern resilience as an enterprise and national security priority. 

On March 3, we detailed that Iran's retaliation model would likely be sustained, opportunistic and infrastructure-adjacent rather than a single cyber shock event. Four months later, that assessment has held, but the operating environment has become clearer and more consequential. 

This is not only a military or intelligence issue. It is an enterprise resilience issue. Cloud, telecom, payment systems, ports, energy, transportation, managed service providers, identity systems and operational technology are now part of the conflict surface. The strategic question is no longer whether cyber will accompany conflict. It will. Often the targets will be opportunistic, not strategic.  For example, Iranian aligned hackers impacted a medical device manufacturer early in the conflict.  They didn't attack Stryker because it had military relevance, but because they could gain access.  It is important to review your security posture to make sure you won't be next target hit in the west simply "because they can." 

At a glance 

Why "opportunistic" does not mean low consequence 

One of the more important policy lessons from this moment is that opportunistic cyber activity can still produce significant consequences. U.S. cyber sanctions authorities have long recognized that malicious cyber-enabled activity may rise to a national-security concern when it significantly compromises critical infrastructure services, disrupts the availability of computer systems, misappropriates funds, trade secrets, personal identifiers or financial information or threatens the national security, foreign policy, economic health or financial stability of the United States. In a contested infrastructure environment, the consequence of a cyber event may exceed the sophistication or original intent of the actor. 

 The strategic shift: from cyber incident response to contested infrastructure 

Cyber has accompanied conflict for years. What is different now is the density of dependency. More critical services rely on the same concentrated layers: cloud regions, identity providers, telecom pathways, SaaS platforms, payment rails, third parties and operational technology connected into enterprise environments. That concentration creates efficiency in stable conditions and fragility in contested ones. 

That is the more useful frame for this moment: infrastructure concentration risk. It describes an environment where the vital systems that enterprises depend on may remain technically available, but become partially degraded, physically exposed, politically constrained or operationally unreliable during a crisis. The strategic issue is no longer simply whether an adversary can compromise one system. It is whether pressure on one dependency can cascade across business operations, public trust, regulatory obligations and national security concerns at the same time. 

 Figure 1. Contested infrastructure: concentrated dependencies create efficiency in stable conditions and fragility in contested ones. 

The cloud and AI compute lesson 

The cloud disruption in the Middle East changed the conversation because it made the physical exposure of digital infrastructure visible. For years, organizations treated cloud as the answer to physical instability. The more accurate view is that cloud has become part of the critical infrastructure that must be defended, governed and tested under conflict conditions. 

The dependences matters even more in the AI era. Compute concentration is becoming a strategic dependency. As enterprises move more security operations, analytics, automation and decision support onto AI-enabled platforms, compute availability becomes more than an IT issue; it becomes a condition for operational decision-making. Cloud and compute architecture are no longer only technology decisions; they are resilience, risk and national security decisions. 

The OT lesson: internet-facing operational technology is geopolitical exposure 

Internet-facing OT is not just a technical misconfiguration. It is a geopolitical exposure point. When PLCs, SCADA displays, remote access gateways, engineering workstations and vendor pathways are discoverable and reachable, they become part of the conflict surface. This matters most in water, energy, transportation, manufacturing, healthcare and logistics, where operational continuity has public safety and economic implications. 

The threshold should not be "could this create catastrophic physical destruction?" The more useful question is whether an adversary can create uncertainty, force shutdowns, degrade confidence, interrupt operations or consume response capacity at the moment leaders need clarity. In conflict, disruption does not have to be catastrophic to be strategically useful. 

Identity, third parties and the information environment are now resilience issues 

The next phase of conflict will continue to test identity. Credentials, MFA fatigue, stale VPNs, unmanaged service accounts, insecure vendor access and abuse of legitimate administrative tools remain some of the most practical paths into enterprise and critical infrastructure environments. Identity is no longer just an IAM program; it is a resilience control that connects cloud, enterprise IT, security tooling, third parties and OT. 

The information environment matters as well. Public claims of compromise, phishing, impersonation and psychological operations can amplify the impact of even a limited incident. A cyber event can quickly become a communications problem, a trust problem and a regulatory problem. That is why resilience cannot sit only inside the SOC; it has to connect to legal, communications, operations, continuity, customer leadership and executive decision-making. 

What not to overstate: Not every outage, intrusion or disruption should be attributed to Iran or treated as a nation-state event. Attribution remains difficult; reporting evolves, and criminal actors often exploit geopolitical moments for their own purposes. The point is not to over-attribute; it is to recognize that geopolitical pressure changes the consequence of ordinary exposure. 

A practical framework for executives 

Executives need a way to govern this environment without turning every board conversation into a technical review. The right starting point is not systems. It is critical services and the dependencies that support them. 

• Start with critical services: what must continue operating under degraded conditions?
• Map the real dependency chain: cloud, identity, telecom, OT, vendors, facilities, power, people and manual procedures.
• Understand geography: where do critical dependencies physically and geopolitically sit?
• Design for degraded operations: can the right services be restored in the right order under real pressure?
• Clarify decision rights: who can authorize failover, disconnect remote access, notify regulators or move to manual operations?

Figure 2. Executive framework for governing resilience in contested conditions. 

What this means depending on your seat 

The same risk looks different depending on where a leader sits. That is why contested infrastructure has to be translated across governance, operations, technology and policy, not left as a technical concern. 

Signals to monitor 

Forward-leaning resilience requires watching the environment, not just the internal control stack. These signals should trigger renewed validation of exposure, recovery and decision readiness. 

The board questions that matter now 

• The most useful board questions are concrete and decision-oriented:
• What are our top critical business services and what cloud, identity, telecom, OT and third-party dependencies support them?
• What percentage of known exploited vulnerabilities are remediated across systems that support critical services?
• When did we last test a regional cloud failure where resources were inaccessible, not merely degraded?
• Can we easily or automatically transition operations into other regions if our cloud instances are impacted?
• How long can we operate manually if telemetry, remote access or vendor support is unavailable?
• Who owns the decision to fail over, disconnect, operate manually, notify regulators or publicly disclose?

What good looks like

A mature posture is not defined by the existence of plans alone. It is defined by tested assumptions, rehearsed decisions and the ability to sustain critical functions under pressure. 

 What leadership should do next 

Immediate action should be practical and cross-functional: 

• Boards should treat this as enterprise resilience, not cybersecurity alone.
• CEOs and executive teams should prepare and align points of coordination with legal, cyber, communications, operations, continuity and customer leadership before impact.
• CISOs should focus on the controls most likely to determine blast radius: internet exposure, remote access, privileged identities, segmentation, logging, backups and recovery sequencing.
• Critical infrastructure leaders should design for degraded operations, including manual procedures, local control, field coordination and clear decision rights.
• Technology providers should design for recoverability, intermittent connectivity, constrained remote operations and secure identity models.

The policy gap 

The private sector owns and operates much of the infrastructure that becomes strategically relevant during conflict, yet public-private coordination often moves at advisory speed while adversaries operate at operational speed. Resilience standards need to move beyond compliance evidence toward tested recovery, degraded-mode performance and executive accountability. 

Resilience as strategic deterrence 

One of the most important lessons from the last four months is that resilience itself is becoming a form of deterrence. Organizations that can contain disruption, recover quickly, operate manually, communicate clearly and prevent cascading failure are less useful targets. The future of cyber resilience is not only about stopping the first intrusion. It is about denying strategic impact. 

How WWT can help 

• WWT can help leaders move from awareness to action in four practical ways:
• Map critical services to the cloud, identity, telecom, OT, third-party, facilities and regional infrastructure layers that support them.
• Reduce exposure across identity, cloud, OT and third parties, including privileged access, remote access, segmentation, backup architecture and known exploited vulnerabilities.
• Test degraded operations and recovery through realistic scenario planning, tabletop exercises and resilience testing.
• Prepare leaders for contested-infrastructure decisions by clarifying decision rights, escalation thresholds, communications posture and recovery sequencing.

Strategic takeaway 

This is not only an Iran story. Iran is the case study of the moment, but the broader pattern is larger: civilian infrastructure and corporate systems are increasingly viewed as instruments of coercion, signaling and conflict preparation. The organizations that perform best will not be the ones that simply buy more tools. They will be the ones that understand their dependencies, reduce obvious exposure, eliminate legacy tech debt, test recovery under realistic conditions and govern resilience as a core function of enterprise and national security.