On 25 September, the UK government announced closed-door Whitehall briefings for representatives of defence companies and Critical National Infrastructure providers. The Cabinet Office and Ministry of Defence said the sessions would address Russian threats including cyber attacks, sabotage and disinformation.

“Russia is actively seeking to disrupt the organisations that form the bedrock of our national security,” Minister for the Armed Forces Louise Sandher-Jones said.

For British business, the question is no longer only how such threats can be prevented, but how essential operations continue when disruption occurs.

Why resilience has become a British business issue

The National Cyber Security Centre managed more than 200 incidents affecting the UK’s Critical National Infrastructure and its supporting ecosystem in the year to May 2026. Around 75 per cent were believed to be linked to state actors, while the NCSC identified Russia, China and Iran among hostile states increasingly targeting systems underpinning essential services.

The exposure extends across energy, transport, telecommunications, finance and data infrastructure. The National Protective Security Authority stresses that these sectors are interconnected: disruption in one can affect several others.

For boards, geopolitical risk is increasingly becoming operational risk.

Ukraine as an extreme test of business continuity

For Ukrainian companies, resilience has become a daily operating requirement. Russian attacks on energy infrastructure, industrial sites, warehouses, logistics hubs and data centres repeatedly disrupt production and commercial activity.

Ukraine’s Minister for Economy and Environment Oleksandr Kravchenko told The Guardian that every hour in which air-raid alerts bring businesses to a halt costs the economy an estimated $45 million.

“If people are in a bunker, business stops,” he said.

The EBRD says Ukrainian businesses are adapting their models and building buffers as attacks continue to damage energy, transport and logistics infrastructure. Such measures cannot remove the cost of disruption, but they can reduce the risk that one failure stops an organisation altogether.

What Ukraine’s experience reveals about resilience

Ukraine’s experience points to a broader principle: critical systems need redundancy before disruption occurs. Dependence on a single supplier, energy connection, data centre or communications network can turn a local failure into a wider interruption.

Continuity planning matters too. Companies need to know which functions must remain operational, who can make decisions during an incident and which alternatives can be activated when primary systems fail. Recovery is equally important: resilience assumes that not every attack can be prevented.

NCSC chief executive Richard Horne warned in June that “the many vulnerabilities that organisations tolerate today will be exploited in conflict tomorrow.” He urged organisations to build the ability to sustain critical operations and recover quickly after an attack.

Britain is not Ukraine — but the principle travels

The comparison has clear limits. British companies are not operating under wartime conditions, and the scale and nature of the threats are fundamentally different.

Yet Ukraine shows how quickly assumptions about reliable electricity, communications, logistics and digital access can break down. A joint assessment by the World Bank, Ukrainian government, European Commission and United Nations put direct damage at more than $195 billion by the end of 2025, with transport and energy among the hardest-hit sectors.

The lesson for British companies is not to prepare for war, but to build systems capable of absorbing disruption without allowing it to become organisational paralysis.

Resilience as investment

The Whitehall briefings show how national-security risk is moving further into the boardroom. The UK Government’s 2026 Resilience Action Plan implementation report calls for stronger economic, public-service and infrastructure resilience as risks become more interconnected.

Ukraine is not a blueprint for Britain. It is a case study in what operational resilience looks like when ordinary systems become unreliable. For British companies, resilience may increasingly need to be treated like cybersecurity, insurance or capital investment: a cost incurred before disruption rather than after it.