Cyber and security risk in infrastructure investment

Geopolitical and security risks have shifted from secondary considerations to core valuation drivers in the infrastructure sector, as physical and cyber threats converge on an unprecedented scale. Last week’s revelation of vulnerability flaws in PHP language used in millions of websites around the world has added to the urgency.

Data in the latest EY-Parthenon CEO Outlook Survey suggests infrastructure CEOs are preparing for this different operating environment over the next 12-24 months, with 81% agreeing that they need to shift their business approach from efficiency to resilience. 

Sonia Baldeira, EY global infrastructure insights leader, asserts: “In our view, pricing geopolitical and security risks is rising up the agenda across multiple sectors, including infrastructure assets such as airports and ports.”

Certainly, due to the essential services they provide, core infrastructure assets are inherently exposed to today’s heightened risk environment. “Fundamentally, those without a robust, through-life approach to security programmes across all disciplines and suppliers, regularly tested and validated, are the most vulnerable,” says Nathan Jones, executive director and head of digital M&A advisory at Aon. “Of course, state-backed threat actors ultimately have the resources to carry out more sophisticated attacks,” he adds, noting: “These are likely to be focused on critical national infrastructure assets.”

In the view of Ludovico Capelli, portfolio manager for the Global Listed Infrastructure Fund at Van Lanschot Kempen, infrastructure is “particularly vulnerable where a single point of failure can disrupt an entire network, and alternatives are limited”.

The Cyber Threat

Although infrastructure is a real asset, disruption can be just a few clicks away. As AI gives hackers faster and more effective tools to target the systems that keep grids, ports and communications networks running, cybersecurity becomes part of protecting the essential services – and cash flows – that make infrastructure worth owning,” says Capelli. Jones agrees: “Threat actors leverage open-source information… AI could be used to assist in matching known common vulnerabilities and exposures to externally facing, unpatched vulnerabilities.” 

Energy is particularly in focus. Jessica Bailey, global head of infrastructure at Nuveen, argues that, as power systems become more digital and interconnected, cybersecurity has moved from being a “technical, back-office function to a board-level investment consideration”. She says: “Insurance markets have adapted accordingly, with expanded coverage now available for business interruption and property damage arising from cyber events.”

A shift in perceptions across the industry has been helped by regulatory frameworks such as NIS2 and the EU Cybersecurity Act. For investors, this “puts management’s willingness, ability and commitment to the test”, says Capelli. He cites increased pressure, including on remuneration incentives.

Bailey notes that this “sharper due diligence” means that “cybersecurity has simply become one more dimension of the operational discipline that long-term infrastructure investing has always required, and one that disciplined managers are well equipped to manage”.

She adds: “Cybersecurity should be embedded at board level with structured, verifiable oversight – moving from documentation and policy statements to operational evidence, including expanded insurance coverage for business interruption and property damage risk from cyber attacks.” This should also include climate and physical risk with a “rigorous, asset-level screening approach”, she says.

Pricing security risk

Increasingly, investors must therefore price security risk into their calculations. From a valuation perspective, adjustments to formulas are being made. Geopolitical and security risks are “primarily priced through adjustments to discount rates and the identification of potential downside scenarios in discounted cash flow valuations,” says Baldeira. “It is becoming clear that infrastructure assets’ risk premiums are under scrutiny.”

Greater appreciation of this starts from the get-go. As Bailey puts it: “Geopolitical risk is increasingly a first-order input into portfolio construction, not an afterthought. We stress-test specific scenarios for assets exposed to cross-border supply chains or politically sensitive sectors, and we’re mindful that discount rate, duration and credit assumptions inherited from the post-global financial crisis era can no longer be relied upon.”

She adds another point: “Given the multi-year, sometimes multi-decade, timeframes involved in infrastructure, policy clarity and continuity across election cycles is an increasingly important factor in where we commit capital.” 

This must be seen in context, however. Infrastructure is a primary target of both hybrid and kinetic attacks for good reason. As the backbone of a country’s economy, society and security, if disrupted, then all three are disrupted. Capelli therefore stresses that being an obvious target does not make geopolitical risk specific just to infrastructure. “Exposure is economy-wide and, on its own, does not warrant a universally higher risk premium for the infrastructure sector. In fact, infrastructure is critical to mitigating geopolitical risk, because securing energy supplies, communications and trade routes requires infrastructure investment.”

Too broad-brush an approach is therefore not helpful. Tom Levering, global industry analyst and portfolio manager at Wellington Management, says: “We price security risk through cash flows and recovery mechanisms, not through a broad geopolitical label. We do not treat geopolitical and security risk as a generic premium applied equally to every infrastructure asset.” Rather, Wellington breaks it down into asset-level exposures. Levering lists these as “physical location, supply-chain dependence, regulatory regime, customer concentration, contractual protections and the ability to recover resilience investment through tariffs or contracts”.

Importantly, these factors consider both sides of the equation. Levering explains: “A security threat can increase operating costs and tail risk, but it can also create a longer investment runway if policymakers support spending on redundancy, hardening and domestic capacity.” In other words, “essentiality” can create both risk and protection, he says. “An asset may be an attractive target because it is critical, but that same criticality can bring regulatory support, government coordination, cost recovery and strong incentives to preserve service.” 

The appropriate risk premium therefore depends on who bears the residual risk. Levering continues: “If resilience spending, insurance costs and remediation expenses can be recovered through a supportive regulatory or contractual framework, the impact on equity value may be limited. If the owner faces uncapped liability, weak insurance coverage, political interference, or no recovery mechanism, the premium should be materially higher.”

He concludes, therefore, that essential infrastructure does not necessarily deserve a higher risk premium, whereas poorly protected and poorly compensated infrastructure does. “The key question is whether the owner is compensated for taking that risk. In regulated infrastructure, for example, resilience capex can contribute to asset-based growth if the regulatory framework allows recovery and an appropriate return.”

This nuance seems to be recognised by the market. On pricing energy infrastructure credit, Bailey notes that Nuveen “continues to fund at spreads in excess of 500-600 basis points with first-lien security and strong structural protections – reflecting the meaningful illiquidity and complexity premium that disciplined underwriters command in this space, even as comparable liquid energy credit indices have compressed”. At the same time, she admits: “Cyber resilience is becoming a factor in insurance coverage, financing conditions and operational risk assessments.”