The Tangled Web: How Today’s Threats Feed Each Other

October 31, 2026

There is no shortage of writing about how today’s crises connect. Risk reports map it every year, and some historians call it a “polycrisis.” Cyberattacks, a fragile grid, migration, polarization, artificial intelligence, quantum computing, and debt each pull on the others. That much is well documented, and I will walk through it here.

A fragile power grid makes a cyberattack more dangerous. A cyberattack is more frightening in a society that no longer trusts its institutions. Distrust grows faster when immigration strains schools and services, when household debt leaves families one paycheck from trouble, and when the public believes no one is in control. The medicines in our hospitals and the minerals in our weapons come from a rival that has shown it will use them as leverage. Polarization keeps governments from fixing any of it. And new technologies like artificial intelligence and quantum computing are about to make every one of these problems faster, cheaper to exploit, and harder to contain.

What is less understood is how the defense against all this actually works, and why it is thinning in ways an org chart does not show. I spent years in the federal sector. The official picture, with a national coordinator, 16 sectors, industry information-sharing centers, and a response framework for every contingency, describes the plan on paper. In practice, most of the threat information that matters moves between people who know and trust each other. The information-sharing centers have been uneven since the FBI first tried to sell them to a skeptical industry in 1998, and for years the government treated them as a way to collect data rather than share it. Private security firms have since filled much of that gap, for those who can pay.

That is why the decisions of the past 18 months matter more than the numbers suggest. At the very moment these threats are converging, we are thinning out the defenders. The agency that coordinates protection of critical infrastructure lost about a third of its staff, and half its regional offices are run by acting directors. Federal support for the centers that warn local governments about cyberattacks has ended. The law that lets companies share threat data keeps lapsing. A planned backup for GPS was cancelled, and the new GPS ground system was abandoned after more than $6 billion. The law that funds pandemic preparedness is years overdue for renewal. Each decision has its own justification. Together, they remove the people and relationships the system actually runs on, and they leave the county 911 center and the rural water district far more exposed than the big bank or the defense contractor.

This post first walks through the major forces and how they feed one another. Then it looks at how the defense really works, what has changed, and the lessons we have already paid for. It ends with the uncomfortable question: where does this lead if nothing changes?

Fragile foundations: everything depends on everything

Modern life rests on a handful of systems that quietly depend on each other. Electricity powers water treatment, hospitals, telecom, banking, and fuel pumps. The grid, in turn, depends on natural gas pipelines, communications networks, and GPS timing signals. Banks, cell towers, and power plants all synchronize to satellite clocks most people never think about.

We have also concentrated enormous risk in a few places. A small number of cloud providers and software vendors sit beneath huge parts of the economy. Recent years have shown what that means:

• Colonial Pipeline (2021): ransomware hit the company’s business systems, the pipeline was shut down as a precaution, and the East Coast saw panic buying and fuel shortages.
• Change Healthcare (2024): an attack on one claims-processing company froze pharmacy and provider payments across the country for weeks.
• CrowdStrike (2024): a faulty software update, not even an attack, grounded airlines and disrupted hospitals and 911 centers worldwide.

These were accidents and criminal attacks. The deeper worry is deliberate sabotage. The U.S. intelligence community’s 2026 Annual Threat Assessment calls China the most active and persistent cyber threat to U.S. government, private-sector, and critical infrastructure networks. It warns that China and Russia are pre-positioning inside those networks to advance attack capabilities for use against the United States. In a Taiwan conflict, the assessment expects significant disruptions to U.S. transportation from Chinese cyberattacks.

The point is not that the lights will go out tomorrow. It is that our systems have little slack, and a failure in one spreads quickly to the rest.

Who defends it: the plan on paper and the last 18 months

The Cybersecurity and Infrastructure Security Agency (CISA), created in 2018 inside the Department of Homeland Security, is the national coordinator for protecting critical infrastructure. The country’s infrastructure is divided into 16 sectors, each with a lead federal agency, called a Sector Risk Management Agency. CISA leads eight of them directly and coordinates across all 16. Its National Risk Management Center models how a failure in one sector cascades into others, which is exactly the interdependency problem described above.

Most infrastructure is privately owned, so the government cannot defend it alone. On paper, Information Sharing and Analysis Centers (ISACs) fill that gap. These industry-run groups pass threat warnings between companies and government, backed by the Cybersecurity Information Sharing Act of 2015, which protects companies from liability when they share threat data.

In practice, from my years in the federal sector, the effectiveness of the ISACs has shown to be uneven. A few, FS-ISAC above all, are genuinely productive. Many others are not. Most of the information that matters in a crisis moves bilaterally, between people who know and trust each other: a utility’s security chief and an agency analyst, a bank and its regulator, a field agent and a plant manager. That is one reason the federal model leans on the sector agencies and the national response machinery rather than the ISACs. Those agencies already have people, authorities, and working relationships inside their sectors.

How coordination is supposed to work: NSM-22, signed in April 2024, names the Homeland Security Secretary, acting through CISA’s director, as national coordinator for critical infrastructure. It keeps the 16 sectors and their lead agencies and calls for regular national risk plans. When an incident hits, older structures do the work. The National Response Framework and the National Incident Management System give federal, state, local, tribal, and private responders a common command structure. Its Critical Infrastructure and Key Resources Support Annex and Emergency Support Function #14 bring infrastructure owners into the response. For cyber incidents, PPD-41 and the National Cyber Incident Response Plan make CISA the lead for asset response, with the FBI leading the threat response.

The plan runs in six steps. Each now carries a caveat:

Beyond the table, the strain shows at every layer. The 2015 sharing law lapsed for six weeks in late 2025 and has survived since only on short-term extensions, the latest running to December 11, 2026. CISA itself has lost roughly 1,000 of its 3,200 employees, and the fiscal 2026 budget proposal sought a $495 million cut and a 73% reduction for the National Risk Management Center. Federal funding for MS-ISAC ended in September 2025, forcing it to a paid membership model, and the Emergency Services ISAC shut down entirely. In a system that runs on relationships, losing experienced regional and technical staff matters more than any change to the org chart. The structure on paper is intact. The people who make it work are thinner on the ground.

The politics matter here. CISA replaced a DHS office called the National Protection and Programs Directorate, which its last head described as a “conglomeration of disparate security programs” with an unclear identity and muted authority. A bipartisan bill signed by President Trump in 2018 elevated it into a full operational agency, which created friction with the FBI and NSA over who leads on cyber. The FBI later objected when Congress moved to send cyberattack reports to CISA rather than the Justice Department, and NSA stood up its own Cybersecurity Directorate in 2019.

The relationship with the White House soured after Trump fired CISA’s first director, Chris Krebs, over Krebs’s defense of the 2020 election. From 2020 to 2022, CISA also worked with social media companies to flag election and COVID content it considered misinformation, which critics called government-backed censorship. The administration sees the cuts as cleaning house: ending that mission creep, removing what it called “weaponized rot,” and rebuilding CISA around its core job of protecting infrastructure. Critics counter that many of the people who left were career technical staff who had served under different administrations, and that the mission could have been refocused without losing that capacity.

There are signs of a partial reversal. In June 2026, CISA’s acting director announced a push to hire about 330 people, and Homeland Security Secretary Markwayne Mullin said the agency likely needs roughly 600 more. By September, about 250 prospective hires were awaiting security clearance. In October, CISA released a “CISA 2030” strategy that refocuses the agency on infrastructure whose disruption would do the most harm. Supporters see this as the rebuilding half of a deliberate reset. The open question is the gap in between: even if every planned hire arrives, the new staff takes time to build the experience and industry relationships that departed. Adversaries may not wait for the transition to finish.

How the intelligence community sees it

The 2026 Annual Threat Assessment treats cyber threats to infrastructure as a top-tier national security concern. It says these adversaries can pre-position for, or carry out, disruptive and destructive attacks on U.S. critical infrastructure.

Some analysts worry the assessment is also becoming less detailed. One CSO Online commentary noted that the 2026 version dropped the named tracking of Chinese infrastructure campaigns like Volt Typhoon and Salt Typhoon, concluding that the burden of finding threats is shifting to private companies. Put that together with a smaller CISA, acting leaders in half its regions, and less federal help for local governments, and the private owners of the grid, water systems, and hospitals are increasingly on their own.

The cracks within

Not every danger comes from a clever adversary. Much of it comes from weaknesses we built ourselves, and the numbers show attackers are often walking through doors we left open.

The supply chain is the new front door. IBM’s X-Force Threat Intelligence Index 2026 found that major supply chain and third-party breaches have roughly quadrupled over five years. Attackers now go after trusted vendors, open-source code, identity integrations, and cloud connections rather than an organization’s own defenses. As Nick Bradley of IBM X-Force put it: “Attackers have figured out that they don’t need to break through your carefully guarded front door when they can walk right in through your supplier’s back door with valid credentials.”

The basics are still failing. Of nearly 40,000 vulnerabilities X-Force tracked in 2025, 56% could be exploited without any login at all, and exploitation of public-facing applications rose 44%. The report traces many incidents back to lapses in basic hygiene: unpatched systems, weak identity management, and misconfigurations. As Cornell researcher Gregory Falco put it, even advanced AI defenses offer little benefit “if we’re just leaving the front door open.”

North America is now the top target. For the first time in six years, North America was the most attacked region, accounting for 29% of X-Force incident response cases in 2025, up from 24% the year before. IBM’s Ryan Anschutz pointed to the region’s fast digital adoption, massive cloud footprint, and central place in global supply chains: attackers “do not need zero-days, they just need valid credentials and a little bit of patience.”

Identity and AI agents open new gaps. X-Force found more than 300,000 ChatGPT credentials stolen by infostealer malware and offered for sale on the dark web in 2025, though the listed credentials were no longer valid. The larger worry is AI agents that act on their own, delegate tasks to other agents, and move data across systems with little human oversight. IBM experts warn this blurs basic accountability: logs may show an action happened, but not who authorized it. Attackers are also targeting help desks, impersonating employees to get passwords reset, the tactic made famous by the Scattered Spider group.

AI is writing code faster than humans can check it. Most teams now use more AI to write software than their security reviews were designed to handle. When review cannot keep pace with code generation, flaws are found later, when they are harder and more expensive to fix and more likely to be exploited first. Radu Popovici of Pentest-Tools.com called AI “a shiny new hammer, and once you hold a hammer, everything looks like a nail.”

The gap between big and small is widening. The World Economic Forum describes growing cyber inequity: large organizations can afford strong defenses, while small businesses, local governments, and public agencies fall further behind, often without the skilled staff they need. These are the same small utilities, hospitals, and towns that lost federal help when ISAC funding was cut. In the emerging and third world countries, the problems are worse.

Space: the single point of failure overhead

Satellites carry our navigation, timing, communications, weather data, and military intelligence. The 2026 assessment says the space domain has become a key arena for strategic competition and future conflict, and that China has overtaken Russia as the main U.S. competitor there.

The threats range from quiet to catastrophic. Adversaries are already jamming U.S. satellites, and the assessment expects attacks on space services to become normal during crises. At the far end, Russia is developing a satellite meant to carry a nuclear weapon as an anti-satellite capability. A nuclear detonation in orbit would damage every country’s satellites at once, military and commercial alike.

Space is where the cyber problem gets an extra layer. If GPS timing degrades, the grid, the cell network, and financial markets all feel it at the same time. The United States has fewer ground-based backups for timing and navigation than China or Russia, which makes this a vulnerability adversaries understand well.

Case in point: the struggle to modernize GPS

GPS shows how hard it is to fix a critical system once the whole economy depends on it.

The new ground system failed. The Next-Generation Operational Control System, known as OCX, was supposed to run a modernized GPS constellation. After nearly two decades of work and about $6.27 billion spent, the Pentagon cancelled it in April 2026. Government testing had found problems across a broad range of capability areas that would have put both military and civilian GPS at risk. GPS still runs on the older ground system OCX was meant to replace, which Lockheed Martin is now upgrading incrementally.

The satellites are ahead of the ground. The final GPS III satellite launched in April 2026, carrying the military’s encrypted M-code signal, which is far more resistant to jamming. But without a working modern ground system, the Pentagon’s own test office warned that delays put U.S. warfighters and allies at risk. The next generation, GPS IIIF, is due to start launching in late 2026 or early 2027, and how its new capabilities will be controlled is now an open question.

The backup plans keep slipping. The Space Force cancelled Resilient GPS, a planned constellation of smaller backup satellites, to fund other priorities. On the civilian side, a Transportation Department study found no commercial alternative can fully replace GPS. DOT is still testing candidates such as eLoran, a ground-based radio system that would fail differently than GPS, but no national backup has been built.

Meanwhile, a Space Force general told Congress this year that jamming and spoofing are a current and growing threat to GPS. The grid, cell networks, and financial markets that depend on GPS timing still have no fallback.

Migration: where the strain is felt locally

The immigration debate is usually argued in national averages, but the costs land locally. The Congressional Budget Office has noted that immigration generally raises state and local costs more than revenues, even when federal accounts look positive. New York City spent $1.45 billion on migrant services in fiscal 2023, and S&P warned that costs in New York, Chicago, and Denver could pressure their credit. Cities with balanced-budget rules paid for it by cutting other services.

The problem is not just numbers but speed. Schools, roads, clinics, and housing are planned years ahead. A sudden surge arrives before any budget or construction cycle can respond, and residents see crowded classrooms and strained services long before any long-run economic benefit appears. The National Academies also found that low-education immigration carries real long-term fiscal costs.

Europe shows what happens when integration fails. Sweden now has the highest rate of gang-related homicides in Europe, and its conservative prime minister has blamed an irresponsible immigration policy and failed integration. Germany has endured a string of deadly attacks, several by rejected asylum seekers who were due for deportation. Britain has seen protests at hotels housing asylum seekers spread across the country. The recent violent demonstrations in France are another example. Whatever one thinks about immigration overall, the lesson is consistent: when arrivals outpace a society’s ability to absorb them and laws go unenforced, public trust collapses.

Polarization: when elections stop relieving pressure

In a healthy democracy, elections are a pressure valve. People who lose accept the result because they trust they can win next time. That trust is wearing thin. Americans increasingly see the other party not as opponents but as threats, and when every election feels existential, losing feels intolerable.

The fight has moved from policy to the rules themselves. Texas redrew its congressional map mid-decade to gain Republican seats; California and Virginia answered with maps favoring Democrats. Republicans push proof-of-citizenship voting rules; Democrats call them voter suppression. Each side is convinced the other is trying to rig the system, and each side’s countermoves confirm the other’s fears.

Political violence has followed the temperature: two assassination attempts on President Trump, the shooting of Minnesota legislators, the killing of Charlie Kirk. Elections still change policy, but they no longer settle the underlying conflict. They decide what the government does while making the fight over who we are even fiercer. And a polarized country cannot pass the long-term fixes, on infrastructure, debt, border control, or technology, that every other problem in this post requires.

Artificial intelligence: the accelerant

AI is not one more problem on the list. It is a multiplier that makes almost every other problem move faster.

Cyberattacks get cheaper and quicker. CrowdStrike’s 2026 threat report found AI-enabled attacks rose 89% in 2025, and the average time for criminals to move through a network after breaking in fell to 29 minutes. The International AI Safety Report 2026 says fully autonomous, end-to-end attacks have not yet been reported, but AI is already automating large parts of the work. Defenders benefit too, but attackers only need to win once.

Truth gets harder to establish. Researchers counted 235 election-related deepfake incidents across 46 countries, with the United States recording the most. U.S. incidents in the first nine months of 2026 already exceeded all of 2024. The bigger danger is not any single fake. It is that real evidence can now be dismissed as fake, which is poison for a society that already distrusts its institutions.

Jobs are changing at every level, starting with tech. The first signs showed up at the bottom of the career ladder. Stanford research finds early-career employment falling in the most AI-exposed occupations as companies simply stop hiring juniors. But the disruption is already moving up. In 2026, Oracle told regulators that AI adoption led to cuts of roughly 21,000 jobs; Block cut about 40% of its staff and said AI was reshaping how work is structured, not that money was tight; Atlassian’s CEO said AI changes how many roles the company needs; and Cloudflare cut about 20% while pivoting to AI (Nairametrics). Those cuts reach mid-level engineers, managers, and specialists, not just new graduates.

The mechanics explain why. Research on AI tools finds the biggest productivity gains go to less experienced workers, letting a newer employee perform like a veteran (Business Insider via Yahoo). That undercuts what companies pay mid-career people for. Smaller teams need fewer managers, and AI agents take on coordination work that used to justify layers of middle management. The likely result over the next five years is not every job vanishing, but smaller teams, fewer promotions, pressure on mid-level pay, and senior people supervising machines, spreading from tech into customer service, back-office finance, marketing, and legal and analyst work.

Companies may be understating it. Some firms, including Microsoft, insist their layoffs are not about AI replacing workers, and economists warn that some companies engage in “AI washing,” blaming AI for ordinary cost-cutting after years of overhiring. But the reverse may be just as common. A company spending billions on AI has every reason not to say it is eliminating thousands of jobs because of it: the announcement invites public backlash, political scrutiny, and regulation, and it tarnishes the product being sold. Calling it “restructuring” or “simplifying the organization” is far safer. Motives are hard to prove either way, which is exactly the problem: if the public cannot get a straight answer about why jobs are disappearing, distrust fills the gap.

The broad statistics have not yet caught up. Stanford researchers find unemployment in the most AI-exposed occupations has not risen faster than in the least exposed, and the New York Fed finds it hard to blame the hiring slowdown on AI alone. But official data lags what companies are doing, and much of the change shows up as jobs that are never posted rather than layoffs that are counted. A workforce watching its career ladder shrink, while carrying record debt, is a workforce primed for anger.

War and power shift: The 2026 threat assessment notes AI is already being used to influence targeting and speed military decisions, and that China aims to displace the United States as the world’s AI leader by 2030. The race rewards speed over caution on both sides.

Communities are pushing back on the data centers AI needs. AI runs on enormous data centers that consume power, water, and land, and local resistance is growing fast. Data Center Watch, a tracker run by the research firm 10a Labs, counted at least 75 projects worth about $130 billion blocked or delayed in the first quarter of 2026, roughly matching all of 2025, and another $68 billion in the second quarter. Opposition groups more than doubled, to over 800 in nearly every state, driven by fears of higher electric bills, water use, noise, and pollution. Concern crosses party lines, and Gallup puts opposition to a nearby data center at 70%. This is the web in miniature: the AI race strains an already fragile grid, raises local costs, and gives residents one more reason to feel decisions are being made over their heads.

Quantum computing: the coming break in digital trust

Nearly everything private online, including banking, email, medical records, and government secrets, is protected by encryption that a large enough quantum computer could break. The 2026 threat assessment warns that such a machine could compromise the encryption protecting sensitive finance, health care, and government information. No country has built one yet.

The danger has already started anyway. Adversaries are believed to be stealing and storing encrypted data now so they can read it once the technology arrives, a strategy called “harvest now, decrypt later.” Secrets stolen today could be exposed in the 2030s.

The timeline is shrinking. Recent research cut the estimated size of the machine needed to break today’s most common encryption from about 20 million qubits to under 1 million, and possibly far fewer. The U.S. government has set 2035 as the deadline for federal systems to move to quantum-resistant encryption. Yet one industry survey found only about 5% of organizations have a defined transition plan.

Whoever gets there first gains a huge intelligence advantage. If it is an adversary, and the West has not finished upgrading, decades of secrets could spill out at once, and the trust that underpins online commerce could be badly shaken.

Debt: no cushion left for the next shock, public or private

When the 2008 crisis and the pandemic hit, the U.S. government could borrow its way through. That cushion is thinning. The Congressional Budget Office projects federal debt held by the public will rise from 101% of GDP this year to 120% by 2036, passing the record set after World War II. Interest costs alone are projected to more than double, to $2.1 trillion a year by 2036. Interest now costs more than defense or Medicare.

France shows where this leads. Its government borrowing costs hit their highest level in more than two decades even as it tried to cut debt, and the cost-of-living anger that followed spilled into some of the country’s worst riots in years.

Households are stretched too. Government debt is only half the story. Americans owe $18.8 trillion in household debt, including $1.26 trillion on credit cards and $1.65 trillion in student loans. The New York Fed says new delinquencies on credit cards and auto loans “remain at elevated levels.” Student loans are a fresh shock: collections restarted after years of pauses, the Education Department warned that nearly 10 million borrowers could end up in default, and wage garnishment began in early 2026. Borrowers who fall seriously behind have seen credit scores drop about 60 points on average.

The pressure falls hardest on the young. Nearly 10% of credit card balances held by 18- to 29-year-olds have been going 90 or more days overdue, a level last seen around the Great Recession, and the New York Fed calls delinquency for everyone under 40 “unusually elevated.” These are the same workers facing fewer entry-level jobs in AI-exposed fields and a squeezed market for mid-level tech roles. A young worker carrying student loans and card debt cannot ride out a long job search, cannot afford a home in a high-cost housing market, and has little reason to believe the system is working for them.

This is where economics turns into perception. Official statistics can show steady growth while millions of households feel one missed paycheck from trouble. That gap between the numbers and lived experience feeds distrust in institutions, makes people more receptive to anger and simple explanations, and helps explain why cost-of-living frustration spills so easily into fights over immigration, AI, and who the economy really serves.

High debt matters for every other problem in this post. A government drowning in interest payments has less to spend on grid security, quantum-safe upgrades, border enforcement, or helping workers displaced by AI. And when the next crisis hits, whether a cyberattack, a war over Taiwan, or a financial panic, it will have fewer tools to respond.

Critical minerals: the dependency underneath everything

Every force in this post runs on a handful of minerals. Rare earth magnets go into fighter jets, drones, missiles, wind turbines, and electric motors. Gallium and germanium go into chips and radar. Cobalt, lithium, nickel, and graphite go into the batteries that back up the grid and power the data centers AI depends on. The supply of almost all of them runs through one country.

China controls the choke points. China mined about 69% of the world’s rare earths in 2025 and processes up to 90%. The United States mines about 13%, but until recently had almost no ability to refine what it digs up. The 2026 threat assessment says Beijing is working to keep the United States dependent on critical minerals, energy storage systems, pharmaceutical ingredients, and drones, while cutting its own dependence on American chips and AI.

Minerals have become a weapon. In April 2025, China began requiring case-by-case licenses for seven heavy rare earths and the magnets made from them. In October 2025 it expanded those controls, then suspended the expansion under the trade truce reached in Busan. That truce has been shaky. Since August 2026, some Chinese suppliers have stopped shipping rare earths to U.S. buyers, and the September summit between President Trump and President Xi extended the suspension only to January 10, 2027. The original April 2025 controls were never lifted. American factories and defense contractors now live on two-month reprieves.

Geography turns supply into strategy. The minerals sit in specific places, and those places become contested:

• Africa. The Democratic Republic of Congo produces about 75% of the world’s cobalt. When it cut exports and imposed quotas, prices jumped about 70% in under three months. The threat assessment notes that China-based firms own more productive African mines than any other country for bauxite, cobalt, graphite, lithium, and manganese.
• Ukraine. Ukraine’s mineral wealth became part of the war’s diplomacy. The United States and Ukraine signed a minerals agreement and launched a joint reconstruction fund with an initial $150 million, tying American interests to Ukrainian territory that Russia is fighting to hold.
• Taiwan and the Arctic. Taiwan makes most of the world’s advanced chips, which is why the threat assessment warns a conflict there would disrupt technology supply chains worldwide. In the Arctic, melting ice is opening resources and shipping lanes that Russia and China both want.

The U.S. response is real but slow. The Pentagon took an equity stake in MP Materials, owner of the only U.S. rare earth mine, becoming its largest shareholder, and has put hundreds of millions of dollars into U.S. and allied supply chains. A defense official was blunt that rebuilding these industries “won’t happen overnight.” New mines and refineries take years to permit and build, often in the same communities already fighting data centers.

This is where the web tightens. A Taiwan crisis would hit chips and rare earths at the same time Chinese cyberattacks hit infrastructure. The AI race needs minerals that China controls. And a cash-strapped, polarized government must somehow fund a decade-long industrial rebuild while the other side holds the switch.

Health systems: where every weakness meets

If there is one place where all the strands of this post come together, it is the hospital. Health care depends on electricity, water, internet connections, software vendors, global shipping, and foreign factories, all at the same time. And when the health system falters, the shock spreads back into the economy and every other system.

Our medicine is made somewhere else. Senate testimony this year laid out how deep the dependence runs. The United States makes only about 12% of its own drug ingredients. Generics fill about 91% of U.S. prescriptions, yet about 83% of the 100 most-used generic drugs have no U.S.-made ingredients. India, the biggest supplier of generic pills, gets about 80% of its ingredients from China. Roughly 90% of the world’s antibiotic ingredients come from China, and about 100 drugs depend on an ingredient made in a single Chinese factory. A Defense Department review found up to 27% of the drugs it bought were entirely dependent on Chinese ingredients. The 2026 threat assessment lists pharmaceutical ingredients alongside critical minerals as a dependency Beijing works to maintain. A former official warned that if those exports stopped, U.S. hospitals, military ones included, could stop functioning within months.

Shortages are already routine. The country had 227 active drug shortages in mid-2026, the third straight quarterly rise, including cancer drugs and antibiotics. Nearly half of new shortages involve products made by a single company. One flood can do it: when Hurricane Helene damaged a Baxter plant in North Carolina in 2024, it knocked out a factory that supplied about 60% of the IV fluids used in the United States, and hospitals rationed fluids and postponed surgeries for months.

Hospitals are prime cyber targets. The Change Healthcare attack froze payments across the country for weeks. When ransomware hit Ardent Health Services on Thanksgiving Day 2023, emergency rooms in six states diverted ambulances for days. A hospital without power, internet, or its records system is a hospital that cannot safely treat patients, so every weakness in the grid and in cyber defense becomes a health risk.

A pandemic pulls every thread at once. COVID showed the pattern. China restricted exports of masks and other supplies as the world scrambled for them. Hospitals ran short of ventilators, gloves, and staff. Factory closures abroad caused chip shortages that idled car plants here. Schools closed, supply chains seized up, governments borrowed trillions, inflation followed, and public trust in health institutions split along party lines. Each of those effects fed problems described elsewhere in this post: debt, distrust, polarization, and dependence on adversaries for critical goods.

And preparedness is thinning. The law that funds hospital preparedness, the Strategic National Stockpile, and medical countermeasure programs, the Pandemic and All-Hazards Preparedness Act, has been overdue for reauthorization since 2023, surviving on stopgap funding. Federal public health agencies have lost staff, H5N1 bird flu continues to spread among dairy herds, and a polarized public is less likely to follow health guidance in the next crisis than it was in the last one.

Put it together and the danger is clear. The next pandemic, or a conflict with China that cuts off drug ingredients, would hit a health system that depends on foreign suppliers, fragile power and networks, and a public that no longer trusts its health officials, and would arrive with record government and household debt already on the books.

The feedback loops

The real danger is not any single force but the way they reinforce each other. At the center is public trust. Every problem above wears it down, and lower trust makes every problem harder to solve.

A few of the loops are worth tracing directly:

• Migration to polarization to gridlock. Visible strain on local services, combined with a sense that laws are not enforced, hardens political divisions. A polarized Congress then cannot pass lasting border or integration policy, so the strain continues.
• Cyber and AI to distrust. Outages and AI-powered fraud make institutions look incompetent. Deepfakes let people dismiss real evidence. A public that believes nothing is easier for foreign adversaries to manipulate, and those adversaries are the same ones pre-positioning in our networks.
• Debt to fragility. Interest payments crowd out spending on grid hardening, quantum-safe upgrades, and agencies like CISA, which leaves infrastructure more fragile when the next crisis hits.
• Economic stress to unrest. Rising costs and AI pressure on young workers’ jobs supply the anger. Immigration and identity politics give it a target, as France’s riots showed when a cost-of-living revolt became an immigration fight.
• Polarization to paralysis on everything. Every long-term fix in this post requires sustained, bipartisan commitment across administrations. That is the one thing a polarized system cannot provide.

The thinning defense

Look back across the sections above and a pattern emerges. In area after area, the institutions and programs meant to catch the next crisis are being cut, delayed, or abandoned, just as the threats they guard against grow.

Each of these decisions has a defender. Some programs were badly run; OCX was years late and billions over budget. Some cuts reflect real choices about priorities and a government carrying record debt. Supporters of the CISA reductions see them as a deliberate reset that ends mission creep and rebuilds the agency around its core job, and new hiring is now underway.

But the cumulative effect matters more than any single choice. Defense against interconnected threats depends on coordination: someone watching across sectors, sharing warnings, keeping backups ready, and stocking supplies before they are needed. That connective tissue is exactly what is being stripped away. More of the burden now falls on private companies, small utilities, local hospitals, and town governments, the very organizations least able to carry it. And these programs rarely get noticed until the day they are missing.

Lessons we already paid for

None of this is new. Each major shock of the past three decades taught the same lesson about connected threats, and each time we built something in response. The irony of the moment is that many of the institutions now being cut were created precisely because we learned this the hard way.

I remember when PDD-63 came out. It placed the new National Infrastructure Protection Center inside the FBI, and the Bureau was very interested in the ISAC idea. Convincing industry to support them was much harder. Companies worried that reporting an intrusion to the FBI would turn their network into a crime scene. They also feared that shared data would leak through public records requests, that talking with competitors would expose them to antitrust or liability claims, and that disclosure would damage their reputation. Congress eventually answered most of those fears. The Critical Infrastructure Information Act of 2002 protected sensitive data shared with the government, and the Cybersecurity Information Sharing Act of 2015 added liability, antitrust, and disclosure protections. That is the irony: the legal fix for industry’s original reluctance is the very law that has now lapsed once and keeps getting renewed a few months at a time.

The sharing also ran mostly one way. Industry and local governments wanted actionable threat data, the kind the FBI, NSA, and CIA held. The government was reluctant at first and treated the ISACs as a way to receive information, not to give it. That has changed most for defense contractors. Through the Defense Department’s Defense Industrial Base Cybersecurity Program and its DIBNet portal, cleared companies now receive classified and unclassified threat indicators and can talk with government analysts directly. Classified indicators were later offered to all critical infrastructure sectors through Enhanced Cybersecurity Services, but only through a small number of approved commercial providers. The water utility, the regional hospital, and the county government still get far less than a defense prime does, even though adversaries pre-position in their networks too.

The market has filled much of that gap. Private security firms, cloud providers, and threat intelligence companies now do a large share of the world’s threat indicator research. They work closely with CISA and other agencies, through channels like CISA’s Joint Cyber Defense Collaborative, and push warnings out to their customers far faster than a government bulletin could. That has reduced the need for the government to be the main source of indicators, and in my view it is part of why CISA has stepped back from that role. The catch is the same one that runs through this post: private intelligence reaches those who can pay for it. A large bank or a defense prime is well served. A rural water district or a county 911 center often is not.

There is a pattern in this history, too. Each disaster produced urgency, reform, and new institutions. Then the memory faded, budgets tightened, and the reforms were left to erode until the next disaster. The lessons are not lost. They are just not being kept.

How to bring them forward:

1. Build a fusion center for systemic risk. After 9/11, NCTC was created so no single agency would hold a piece of the puzzle alone. Today’s threats cross cyber, space, minerals, health, finance, and the information environment, yet no one is charged with watching the whole web. Fully funding CISA’s National Risk Management Center, or creating an NCTC-style body for cascading infrastructure risk, would close that gap.
2. Fix the failure of imagination. The 9/11 Commission’s core finding applies directly. Government and industry should regularly rehearse compound crises, not single-sector drills: a Taiwan blockade, a grid attack during a heat wave, a pandemic during a cyber campaign. My next post walks through one of these scenarios.
3. Hunt for single points of failure. Helene showed one plant can take down a national supply. Critical sectors, from drugs to GPS timing to rare earth magnets, should be mapped for concentration risk, with redundancy required where one failure would cascade. Some of the work led by Dr. Charles Harry at the University of Maryland has focused on categorizing and measuring the effects of cyberattacks to help state and local policymakers assess strategic risk and consequences. More of the same is needed, especially for this often-overlooked sector.
4. Build before the crisis, not during it. COVID proved that stockpiles, surge factories, and backup systems cannot be created once an emergency has started. GPS backups, domestic drug ingredients, and mineral processing all take years.
5. Treat trust as infrastructure. Helene showed that rumors can stop a relief operation as surely as a washed-out bridge. Credible local messengers, fast public corrections, and protection for responders belong in every emergency plan.
6. Make the defenders durable. PDD-63’s partnerships, the 2015 information-sharing law, and the pandemic preparedness law were all designed for the long haul. They should be authorized for years at a time, not renewed two months at a time or allowed to lapse.

Where this could lead

None of this makes collapse inevitable. But it is worth thinking through how the next decade could unfold. Here are four plausible paths, from most to least likely in my view.

1. Slow erosion. No single catastrophe, just a steady grind: more ransomware outages, rising costs, recurring riots, gridlock in Washington, and a public that trusts institutions a little less each year. This is the most likely path, and the most dangerous because nothing in it forces anyone to act.
2. The compound crisis. A conflict over Taiwan triggers Chinese cyberattacks on U.S. transportation and power, jamming of satellites, and a market panic, all at once. Deepfakes flood social media blaming the other party. A government carrying record debt has less room to respond, and a polarized public splits over whose fault it is rather than uniting.
3. The trust collapse. A close, bitterly contested election is hit by a wave of AI-generated fakes. Quantum-decrypted secrets leak, real or forged. Large shares of the public refuse to accept the result, and political violence moves from isolated attacks toward something organized and sustained.
4. The wake-up call. A serious but survivable shock, a major grid attack or a near-miss crisis, forces the country to fix what it has postponed. This has happened before: Pearl Harbor, Sputnik, and 9/11 each produced bursts of national effort. The question is whether we can find that resolve without paying the price of a disaster first.

What can still be done

Because these problems are connected, progress on any one of them eases the others. A few steps would make a real difference:

• Build slack back into infrastructure. Backup timing and navigation that do not depend on GPS, the ability to run grids and water plants manually, and less dependence on single software vendors.
• Fund the defenders. Pass a long-term renewal of the 2015 information-sharing law instead of lurching from extension to extension. Rebuild CISA’s regional and sector staff, the people whose relationships carry most real threat sharing. And restore direct help for the small utilities, hospitals, and local governments that cannot buy it themselves.
• Start the quantum upgrade now. Data stolen today can be decrypted later, so the deadline is effectively already here. NIST’s new roadmap, Transition to Post-Quantum Cryptography Standards (NISTIR 8547), lays out the timeline: federal systems must complete the move by 2035, but the most sensitive high-value systems face earlier deadlines, 2030 for encryption keys and 2031 for digital signatures, under an executive order that sped up the schedule. NIST’s advice applies well beyond government: take stock of where vulnerable encryption is used, including in the supply chain; protect long-lived sensitive data first; build systems that can swap algorithms easily; and consider hybrid approaches that pair today’s encryption with the new standards during the transition.
• Run immigration with control and capacity. Enforce the law visibly, deport people whose claims are rejected, and coordinate with the communities that absorb new arrivals so local schools and services are not overwhelmed.
• Put guardrails on AI. Invest in AI-powered defense, require clear labeling of synthetic media in elections, and require companies to be honest about when AI is the reason jobs are cut, and prepare workers at every career level for the change.
• Rebuild fiscal room. A government that cannot respond to the next crisis because interest payments have swallowed its budget is a national security risk.
• Lower the temperature. The hardest step and the most important. Durable, bipartisan deals that survive a change of government would take issues like immigration and election rules off the table as weapons in every campaign.

The forces described here are powerful, but they are not fate. They feed each other in a downward spiral, and the same connections can run in reverse. A more secure grid, a credible border, a working information-sharing system, and a little more trust across party lines would each make the next crisis smaller. The first step is simply to stop cutting the margin. Rebuilding the defenders costs far less than recovering from the crisis they exist to prevent. The question is whether we start pulling the strands apart before the next shock does it for us.

Coming next: what a compound crisis would actually look like, traced step by step as one shock cascades through the systems described here.

Sources

• 2026 Annual Threat Assessment of the U.S. Intelligence Community
• CBO: The Budget and Economic Outlook, 2026 to 2036
• CBO: Effects of the Immigration Surge on the Federal Budget and the Economy
• CRS: The Cybersecurity Information Sharing Act of 2015, expiring provisions
• Infosecurity Magazine on CISA budget cuts
• Help Net Security on MS-ISAC funding
• Nextgov on NIST’s post-quantum roadmap
• Surfshark: election-related deepfakes
• Cloud Security Alliance on AI-enabled attacks

• IBM X-Force Threat Intelligence Index 2026
• IBM Think, “Cyberthreats in 2026: X-Force and industry experts weigh in” (March 10, 2026)
• World Economic Forum, on cyber inequity and the security workforce gap
• The Next Web on Data Center Watch’s Q1 2026 findings
• Tom’s Hardware on Q2 2026 data center opposition

• Mining Technology on China’s rare earth share and export controls
• Kitco/Reuters: Chinese rare earth firms halt some U.S. shipments
• Rinnovabili on the Trump-Xi truce extension
• S&P Global on Congo’s cobalt export quotas
• Mining Weekly on the U.S.-Ukraine minerals fund
• NBC/CNBC on the Pentagon’s MP Materials stake

• New York Fed: Household Debt and Credit Report, Q2 2026
• Yahoo Finance on student loan defaults and wage garnishment
• Fox Business on young borrowers’ credit card delinquency

• Senate Special Committee on Aging testimony on foreign drug dependence (March 2026)
• AJMC on active U.S. drug shortages, Q2 2026
• ABC News/AP on the IV fluid shortage after Hurricane Helene
• CPO Magazine on the Ardent Health ransomware attack
• ASTHO on the future of PAHPA

• White House fact sheet on PDD-63 (1998)
• Christian Science Monitor on the 9/11 Commission findings
• Axios on threats and misinformation during the Helene response

• CRS: National Security Memorandum on Critical Infrastructure Security and Resilience (NSM-22)
• FEMA: National Response Framework
• CISA: Critical Infrastructure and Key Resources Support Annex
• CISA: Incident response
• SealingTech on NSM-22 and Executive Order 14239
• Cloud Security Alliance on CISA during the 2026 funding lapse
• Sen. Warner letter on CISA regional leadership (June 2026)
• Paubox on the CIRCIA final rule going to the White House

What are your views on the polycrisis? How should we be planning for the future? What more can be done from a cyber policy and resource perspective to create a more resilient critical infrastructure? Give me your views on the future cyber security state of USA and globally. And thanks to my subscribers and visitors to my site for checking out ActiveCyber.net! Please check out my companion podcast site at the Active Cyber Zone which you can find at many podcast providers. Please give us your feedback because we’d love to know some topics you’d like to hear about in the area of active cyber defenses, artificial intelligence, authenticity, quantum cryptography, risk assessment and modeling, autonomous security, digital forensics, securing OT / IIoT and IoT systems, Augmented Reality, or other emerging technology topics. Also, email chrisdaly@activecyber.net if you’re interested in interviewing or advertising with us at Active Cyber™.