Munich Cyber Security Conference Highlights Shift Toward Deterrence, Supply-Chain Risk, and Critical Infrastructure Resilience

Senior officials from the EU, NATO, the United States, Sweden, Estonia, and Taiwan used the Munich Cyber Security Conference to warn that cyber and “hybrid” operations are now a persistent feature of geopolitical competition and are increasingly aimed at critical infrastructure (energy, health, government services, satellites, and military command networks). EU Executive Vice President Henna Virkkunen argued Europe cannot be “naive” about adversaries’ ability to disrupt essential services and pointed to proposed revisions to the EU Cybersecurity Act intended to strengthen the EU cybersecurity agency and reduce critical ICT supply-chain risk, including phasing out designated high-risk suppliers. NATO Deputy Secretary General Radmila Shekerinska said Russia and China are challenging the alliance in both physical and digital domains and cited attempted disruptions to Poland’s energy infrastructure as an example of the threat environment.

U.S. officials signaled a shift from primarily defensive “resilience” toward deterrence by “imposing real costs” on malicious actors, while also emphasizing deeper cyber partnerships with allies and industry to send a coordinated message to adversaries; National Cyber Director Sean Cairncross said a forthcoming U.S. cyber strategy will align with broader national security strategy and rely on whole-of-government tools. Estonia’s intelligence chief Kaupo Rosin urged Europe to invest in homegrown offensive cyber capabilities to reduce reliance on non-European tools, while Swedish defense official Lisa Gustafsson said societies must be designed to function under sustained disruption under Sweden’s “total defense” model. Taiwan’s National Security Council adviser Yuh-Jye Lee warned China may be rehearsing a “digital siege,” referencing activity like Volt Typhoon and reporting on alleged Chinese training infrastructure (“Expedition Cloud”) designed to simulate foreign power grids and communications networks; separate reporting also underscored that much of the technology stack underpinning cyber defense is controlled by U.S. firms, complicating sovereignty and supply-chain decisions.