In 2025, a series of technology related disruptions showed how dependent modern businesses had become on infrastructure they did not necessarily own or control. In March, a fire at an electricity substation near Heathrow contributed to the closure of one of the world's busiest airports. A month later, cyber-attacks caused significant disruption at Marks & Spencer and the Co-op. Then in September, a cyber-attack halted production at Jaguar Land Rover, with the effects reaching into its extensive supplier network.
The causes were very different, but each event exposed dependencies that extended well beyond the organisation directly affected. Electricity networks, telecommunications, software, cloud services and other shared infrastructure had become integral to how businesses operated. Their resilience increasingly depended on systems sitting outside their immediate control.
For the Willis Research Network, this connected several strands of research that had been developing as the digital economy expanded.
The infrastructure behind the digital economy
The rapid growth of artificial intelligence had already focused attention on the physical infrastructure needed to support it.
WRN research with the Wharton School in 2024 examined the growing environmental footprint of AI and the implications of rapidly expanding data-centre capacity. Greater computing demand meant greater demand for electricity and water, alongside increasing pressure on grids and other infrastructure. It also found that selecting locations with access to carbon-free energy could reduce operating emissions by at least 60%, demonstrating how the resilience and environmental impact of digital infrastructure are closely tied to energy systems and location.
Subsequent research with Rutgers looked more closely at hyperscale data centres in the United States across their lifecycle and regional footprint. These facilities sit within a much wider system involving electricity, cooling, water, telecommunications, advanced semiconductors and complex supply chains. As demand for AI and cloud computing grows, so too does the infrastructure supporting it.
This creates an important resilience question. Data centres are typically designed with considerable redundancy in power, connectivity and computing capacity. Multiple sites and backup systems are intended to maintain services when individual components fail. But the resilience of those arrangements also depends on how independent they really are.
Two facilities may be geographically separate but draw power from connected infrastructure. Several sites may share telecommunications or water supplies, or face the same flood or other natural hazard. Different businesses may use separate technology systems that ultimately rely on the same cloud provider, software platform or specialist supplier.
WTW's work on data-centre resilience has increasingly examined these shared dependencies alongside the resilience of individual facilities. Based on the findings from Rutgers, these pressures are often concentrated rather than evenly distributed. Around half of U.S. data centres are in just ten metropolitan areas, including Northern Virginia, Phoenix and Dallas. This clustering can create shared exposure to the same electricity grids, water systems, telecommunications networks and regional hazards. Northern Virginia, for example, has more than 4,000 megawatts of data-centre power demand and around 300 facilities, making grid capacity and backup-power emissions regional resilience concerns rather than risks belonging to any single operator.
Water creates a comparable shared exposure. The Rutgers research found that approximately 40% of U.S. data centers, and 43% of large facilities, are located in areas experiencing high or extreme water stress. A large data center can withdraw between three and five million gallons of water per day for cooling. In markets such as Phoenix, this means that facilities promoted as geographically separate alternatives may nevertheless depend on the same constrained regional water system. The concept of shared fate captures the possibility that sites or systems assumed to provide redundancy remain exposed to a common point of failure.
Looking at utilities, natural hazards, building characteristics, business continuity arrangements and the clustering of facilities can therefore reveal vulnerabilities that may be missed when locations are assessed individually. It also provides a different way of thinking about redundancy: understanding what the alternatives themselves depend upon.
Shared fate in the digital world
The same issue extends beyond the physical infrastructure.
The CrowdStrike outage in July 2024 provided a particularly clear example. A faulty software update caused around 8.5 million Windows devices to crash, disrupting organisations across multiple sectors. The scale of the event came partly from the number of businesses sharing the same technology dependency.
Research undertaken by Rutgers with WTW subsequently examined CrowdStrike alongside other major technology incidents to understand how disruption can spread between businesses, sectors and supply chains. It identified concentration in cloud infrastructure, operating systems, cybersecurity and network services as an important source of exposure.
NotPetya showed how indirect technology dependencies can be. Malware introduced through accounting software used in Ukraine spread globally and caused an estimated $10 billion in damage. The initiating vulnerability was several connections removed from many of the operations ultimately disrupted, demonstrating how an apparently local dependency can propagate through global infrastructure and supply chains. Organisations can have extensive internal resilience measures while remaining dependent on technology providers used by thousands of other businesses.
The events of 2025 brought this issue back into focus. The attacks on Marks & Spencer and the Co-op disrupted business operations well beyond their IT departments. At Jaguar Land Rover, a cyber incident stopped manufacturing and affected companies across its supplier network. Digital disruption had immediate consequences for physical operations.
This matters for insurance as well. The Rutgers research found that widespread operational losses can arise from accidental technology failures as well as malicious cyber events. It highlighted the importance of understanding dependency-driven losses, contingent business interruption and the concentrations created by common technology providers.
Finding the dependencies that matter
There is a natural connection here with the supply-chain research WRN was undertaking in 2024. Mapping beyond immediate suppliers can reveal concentrations and dependencies that would otherwise remain hidden. Digital infrastructure presents a similar challenge.
A business might spread operations between several data centres, suppliers or technology platforms and reasonably regard that as diversification. Assessing how resilient that arrangement really is requires going another level down: looking at the infrastructure, providers and locations on which those alternatives depend.
For data centres, the common exposure might be electricity, water, telecommunications or natural hazards. For digital systems, it could be cloud infrastructure, operating systems, cybersecurity software or another widely used provider. The common dependency may sit several connections away from the business itself.
This also changes how accumulation can appear to insurers. Physical proximity has traditionally provided an obvious way of identifying concentrations of exposure. Shared digital infrastructure can connect businesses across sectors and geographies. For insurers, this creates a different type of accumulation. Individual risks may be geographically dispersed and appear diversified while still depending on the same underlying infrastructure or technology provider.
The ability to identify those connections is improving. Better data, dependency mapping and modelling can help businesses and insurers understand where infrastructure is shared, how disruption might spread and where genuine alternatives exist. There are still significant gaps, particularly where dependencies extend through third-party providers, but the direction of travel is clear.
Understanding shared fate
The growth of AI will increase demand for data centres, electricity networks and the technology supply chains supporting them. The concentration of facilities in a small number of regional markets means that this growth may also concentrate demand and exposure within the same electricity grids, water systems, telecommunications networks and local communities. At the same time, more businesses are placing critical functions on cloud platforms and shared digital services. Those developments bring substantial benefits, but they also make the resilience of the infrastructure underneath them increasingly important.
The events of 2025 illustrated the breadth of that dependence. A failure in electricity infrastructure could close an airport. A cyber incident could stop a production line. Disruption affecting one organisation or technology provider could reach businesses elsewhere in the economy.
For WRN, this brings physical infrastructure, natural catastrophe, cyber and supply-chain research increasingly close together. Each examines the same underlying question from a different perspective: where dependencies sit, how widely they are shared and what happens when one of them is disrupted.
As businesses become more reliant on shared digital infrastructure, understanding those connections will become an increasingly important part of assessing resilience. The challenge is to identify where apparently separate systems ultimately depend on the same infrastructure, technology or provider, and what that means for the risks businesses and insurers are carrying.
Authors
