Energy Sector’s Resilience Gap Exposed as Threats Escalate, DNV Warns

More than half of the world’s oil and gas operators are running critical infrastructure without a defined resilience strategy. That is not a projection or a consultancy estimate. It is the finding of a global survey of 1,095 senior energy professionals across 96 countries, published today by DNV in its 2026 Energy Industry Insights series.

The timing matters. The energy sector is operating in a threat environment that has visibly escalated: grid operators have faced targeted cyberattacks, undersea pipelines have been deliberately destroyed, LNG terminals have come under missile threat, and the April 2025 Spain-Portugal blackout confirmed that power failures can escalate to national emergencies with alarming speed. Each of these threat categories is active, documented, and worsening.

Here is what this data tells you about the energy assets in your portfolio, and specifically what questions it raises about whether operational risk is being priced correctly. The survey findings give you a quantified benchmark for a problem most annual reports treat as a governance footnote, and the sections that follow break down how that gap converts into financial exposure you can measure, challenge, and act on.

What DNV’s 2026 survey actually found, and why the numbers are striking

The survey’s credibility comes from its scale and consistency. DNV conducted the research with FT Longitude between January and March 2026, drawing on responses from senior energy professionals spanning electrical power, renewables, and oil and gas, with respondents ranging from board level to senior engineers. This is the series’ 16th edition.

DNV’s 2026 Energy Industry Insights survey of over 1,000 energy leaders establishes that only 49% have a clearly defined and regularly updated resilience strategy, giving investors a quantified sector-wide benchmark against which individual operator disclosures can be directly measured.

The headline finding: only 49% of surveyed energy leaders have a clearly defined and regularly updated resilience strategy. That means the majority do not. When DNV isolated the oil and gas subsector, the deficit was sharper still: 53% of oil and gas respondents lack a defined strategy, placing the readiness gap squarely in the highest-consequence part of the energy system.

The numbers get more uncomfortable when you look at what those same professionals say they are worried about. 45% cite political risk as the single biggest barrier to growth. 69% say reliance on imported energy makes their systems vulnerable. They know the threat environment is worsening. They have not built the strategies to manage it.

DNV’s structural diagnosis: “resilience lags awareness.” The sector broadly recognises escalating risk yet has not converted that recognition into maintained, operational strategies. Awareness without action is the defining feature of the current readiness deficit.

That gap between what energy leaders say they understand and what they have actually built tells you something direct: the infrastructure assets in your portfolio are, on a probability-weighted basis, more likely to be held by operators without a coherent plan for the threats they themselves identify as their biggest challenges.

The threat environment these strategies are failing to address

The resilience deficit would matter in a stable operating environment. In the current one, it is an open exposure against a threat trajectory that is accelerating across multiple dimensions simultaneously.

The risk character facing energy operators has shifted in kind, not just degree. Threats no longer arrive as discrete, containable incidents. They span geopolitical, climatic, digital, and supply-chain dimensions at the same time, and they interact. Active, documented threat categories across the sector include:

• Deliberate physical attacks on critical undersea infrastructure
• Digital intrusions targeting the control systems of power networks
• Weapons-based threats aimed at LNG shipping and onshore receiving facilities
• Climate-driven events placing mounting stress on infrastructure past its design life
• Fractures in international supply chains producing cascading failures across multiple operators

Each of these is documented, not speculative. And DNV’s analysis points to how geopolitical instability, accelerating digitalisation, and deepening cross-border supply-chain dependencies are combining to generate risks that no longer stay confined to a single asset, company, or incident. The 53% of oil and gas operators without a defined resilience strategy have no coherent framework for managing any of them.

Weapons-based threats to LNG facilities have moved from hypothetical planning scenarios to active intelligence assessments in the Gulf, where maritime chokepoints and onshore receiving terminals represent the highest-consequence nodes in global liquefied gas supply chains.

The April 2025 Spain-Portugal blackout as a resilience case study

In April 2025, Spain and Portugal suffered a major blackout that rapidly overwhelmed transport systems, hospital operations, and communications networks, turning an electrical grid failure into a full national emergency. What began as a technical fault became a multi-system crisis through the absence of adequate organisational controls.

SEPA’s analysis of the Iberian blackout documents how the loss of generation cascaded through interconnected systems at a speed that outpaced standard contingency protocols, illustrating precisely the multi-system failure dynamic that a maintained resilience strategy is designed to detect and contain.

For investors, this is not a European curiosity. It is a live illustration of the kind of multi-system, cascading failure that a maintained resilience strategy is specifically designed to detect, prepare for, and recover from faster. The operators that had one fared measurably better. The majority, according to DNV’s data, would not have had one at all.

Four ways the resilience gap translates into investor risk

The readiness deficit is not an abstract governance concern. It transmits into financial loss through four distinct channels, each of which maps to assets investors already hold.

1. Earnings and asset impairment. Long-lived infrastructure (pipelines, LNG terminals, offshore platforms, grid assets) derives its value from continuous operation. Where resilience strategies are undefined, the probability and severity of disruption rises, and with it direct losses, insurance costs, and the risk of permanent asset impairment. An operator that cannot articulate its maximum tolerable downtime has not quantified its own vulnerability.
2. Regulatory and liability exposure. Resilience and cyber preparedness are moving from voluntary to mandated. Operators without strategies in place face rising compliance costs, potential penalties, and reputational damage as regulatory expectations tighten across jurisdictions.
3. Counterparty and supply-chain contagion. Even operators with strong internal practices are exposed to failures among grid operators, suppliers, logistics providers, and offtakers. These cascading disruptions transmit directly into financial performance, and the interconnection is deepening as supply chains globalise.
4. Geopolitical and cyber threat escalation. With 45% of energy leaders citing political risk as their biggest growth barrier and 69% flagging import vulnerability, these are not peripheral concerns. They are central earnings constraints operating in an environment where the threat trajectory is consistently upward.

The geopolitical risk premium embedded in energy markets has historically been treated as a transient pricing component that reverts once a specific incident resolves, but the convergence of supply-chain fragility, targeted infrastructure attacks, and persistent regional conflict has caused analysts to reassess whether that premium should now be treated as structural.

DNV’s assessment of the direction of travel: threats are becoming more frequent, more sophisticated, and more interconnected. Weak resilience programmes represent unpriced exposure at precisely the moment that exposure is growing.

Each of these four channels operates independently. An investor who treats resilience as a secondary governance screen is effectively ignoring four distinct risk transmission pathways at once.

The due-diligence questions investors should be asking right now

The DNV data gives investors both a benchmark and a methodology. Resilience strategy maturity belongs alongside safety, ESG, and financial metrics as a core due-diligence variable, not a peripheral governance line item.

For any energy or mining asset, these eight questions establish baseline resilience posture:

1. Does the operator have a formally documented resilience strategy reviewed and updated on a defined cycle?
2. Does that strategy explicitly cover cyber security, physical security, extreme weather, geopolitical scenarios, and critical supply-chain dependencies, or is it limited to conventional operational risk?
3. Who owns resilience at the board and executive level? Is it embedded in risk committees, audit functions, and capital-allocation processes?
4. How often are stress tests, simulations, or scenario exercises conducted, and do they include multi-hazard and cascading-failure scenarios?
5. What are the operator’s key dependencies (grid operators, suppliers, logistics providers, data centres) and how are their resilience capabilities assessed?
6. How are incident lessons captured and translated into changes in strategy, controls, and investment priorities?
7. Is resilience performance measured with KPIs such as maximum tolerable downtime, recovery time objectives, and frequency of critical incidents?
8. How does resilience planning interact with the company’s energy transition strategy and capital-expenditure plans?

An operator that cannot answer these questions clearly and with documented evidence is, by definition, among the majority that DNV’s survey identifies as lacking a maintained strategy.

For investors applying the same due-diligence framework to mining assets, our full explainer on mining sector resilience strategies covers how the financial, technological, and organisational adaptation levers available to mining operators differ from those available in energy infrastructure.

At the portfolio level, positive signals include:

• Public disclosure aligned with recognised cyber and resilience frameworks
• Evidence that resilience considerations are embedded in project selection, design, and financing
• Demonstrated engagement with national or regional critical-infrastructure programmes
• Regular, independently reviewed maturity assessments of cyber and physical security

Three ways to apply the DNV findings in investment decisions

As a benchmark. Compare each operator’s resilience strategy and disclosure against the sector-wide picture DNV has now quantified. Operators that cannot demonstrate a coherent, maintained strategy are likely below sector best practice and may warrant a risk premium or reduced allocation.

As an engagement agenda. Use the specific gaps the report highlights, including organisational preparedness, supply-chain fragility, and grid constraints, as structured themes in stewardship conversations with boards and management teams.

As a pricing and scenario-planning input. Integrate resilience metrics into valuation models through higher expected downtime, elevated insurance cost assumptions, or wider risk discounts where resilience practices are weak. This is an active valuation technique, not a conceptual exercise. Explicitly model multi-hazard scenarios in long-term forecasts rather than treating disruptions as independent, low-probability events.

What the resilience deficit means for the energy transition’s most exposed assets

The assets the energy transition most depends on are the same ones the resilience gap leaves most exposed. LNG terminals, grid infrastructure, and offshore platforms sit simultaneously at the centre of transition-era portfolios and at the intersection of every documented threat category: cyber, physical, geopolitical, and climate.

DNV’s research makes clear that resilience must be built into project selection, design, and financing from the outset, rather than added once assets are already committed. The two governance streams, transition strategy and resilience planning, are not separable. Transition assets extend and deepen exactly the dependencies (digital systems, grid interconnection, supply chains routed through geopolitically sensitive corridors) that the threat environment is most actively targeting.

Systemic risk in resource markets operates through interdependencies that are difficult to observe until a failure event makes them visible; the same cascading-failure dynamics that DNV’s multi-hazard scenario analysis identifies in energy infrastructure have analogues across mining and resource supply chains that share many of the same logistics and digital control systems.

Operators without strategies in place face not just operational disruption but higher insurance costs and the potential for permanent asset impairment. Engagement with national or regional critical-infrastructure and grid-modernisation programmes is a practical positive signal that an operator is managing this interaction rather than ignoring it.

The DNV data confirms that the resilience gap is a current, quantified condition in the energy sector, not a hypothetical future risk. Investors who explicitly price and manage that gap are better positioned to protect value as disruptions become more frequent and more interconnected.

The investment case for treating resilience as a first-order variable

Three findings from the DNV 2026 survey matter most for investment decision-making. The readiness deficit is majority-wide, with 53% of oil and gas operators specifically lacking a defined strategy. The threat environment is documented, escalating, and multi-dimensional. And the deficit transmits into financial loss through four distinct channels: earnings impairment, regulatory exposure, supply-chain contagion, and geopolitical threat escalation.

The decision this data puts in front of you is direct: continue treating resilience as a secondary governance screen, or integrate it as a primary risk variable in selection, valuation, and engagement. The DNV benchmark provides the tool. Operators that cannot demonstrate a coherent, maintained strategy are likely below sector best practice and may warrant a risk premium or reduced exposure.

Operators unable to demonstrate a coherent resilience strategy may warrant a risk premium or reduced exposure, according to the benchmarking framework established by DNV’s 2026 Energy Industry Insights.

Disruptions are becoming more frequent and more interconnected. The cost of the resilience gap rises over time, not because the thesis is speculative, but because the condition is documented and the threat trajectory has not reversed. Pricing that gap into your portfolio is a response to evidence, not a prediction.

This article is for informational purposes only and should not be considered financial advice. Investors should conduct their own research and consult with financial professionals before making investment decisions. Past performance does not guarantee future results. Forward-looking statements regarding threat trajectories and regulatory developments are subject to change based on market conditions and geopolitical developments.