Digital Dependencies and Organisational Resilience: An Analytical Grid for Cyber Risk in a Geopolitical Context

Abstract

Background. Cyber risk is still largely framed around the technical perimeter an organisation administers itself. Recent institutional reports and several major incidents show, however, that exposure also stems from resources the organisation does not control: software suppliers, service intermediaries, infrastructure, hardware components and computing capacity. Purpose. The article asks under what conditions an external dependency becomes a vector for the propagation of cyber risk, including when that risk arises in a geopolitical context, what role the geopolitical dimension plays, and how cyber risk governance can account for it. Method. A conceptual analysis yields a typology of five categories of dependency and a five-dimension grid (dependency, concentration, substitution, propagation, resilience). The grid is then applied to six situations documented in public sources: NotPetya and Maersk, SolarWinds, the 2015 Ukrainian power grid attack, Change Healthcare, rare earths, and dependencies linked to artificial intelligence. Each case is given an evidence level for its geopolitical dimension. Findings. Distinguishing the technical security perimeter from the dependency perimeter makes it possible to read very different events together. In the cases examined, the criticality of a dependency appears to be linked more to supply concentration, substitution time and the lack of a degraded mode than to the nature of the actor behind the disruption. A formally established geopolitical link exists for only some of the cases. Implications. Six orientations are proposed to governance, risk and compliance (GRC) functions, from mapping real dependencies to testing degraded-mode operation and accounting for the AI supply chain. Limitations. The study relies on public documentary sources, a small number of cases and coding by a single analyst. It provides no original empirical validation.