Attacks on critical infrastructure: Sri Lanka
Sri Lanka's power, water, ports and telecommunications sustain both daily life and an island economy tied to global shipping, which makes them a first-order target from the network and the air at once. On an island where infrastructure is concentrated and interdependent, a single cascading failure carries consequences across the whole country.
Concentrated systems an island depends on
Generation, water treatment, port operations and the digital backbone that ties them together are interdependent across Sri Lanka, and much of it runs on supervisory control built for reliability rather than adversarial resilience. An attacker can strike through an intrusion into that control layer, a physical or drone attack on a plant or substation, or the cascade that follows when one utility fails on an island with limited fallback. Infrastructure hardening reduces the attack surface of those control systems so an intruder cannot force a shutdown or defeat a safety interlock.
Where concentration turns a local failure national
What sharpens the island's exposure is that its infrastructure is concentrated and its ports are also economic lifelines, so a well-placed intrusion can propagate before operators can isolate it. Defensive cybersecurity provides continuous monitoring and incident response around those control networks, while counter-UAS addresses the drone threat to fixed plant. Because all three come from independent, non-aligned makers, the protection, and the knowledge of where the system is weakest, is accountable to the national operator rather than visible to a foreign supplier.
How engagement works in Sri Lanka
As an independent, non-aligned prime vendor, Unstrat fields one accountable team that assesses which control systems are most exposed and where a single failure would cascade, then hardens what matters most first. Equipment is end-use certified and sustained in-region rather than supplied and left, with localisation arrangements scoped per programme and subject to export controls and end-use approvals. Because critical infrastructure is where a state is most coercible, the non-aligned position keeps the knowledge of the island's vulnerabilities national.
Assessment first on a compact, coupled island
An engagement here begins with a briefing and a joint assessment of which supervisory control systems behind the island's power, water and port operations are most exposed and where one failure would cascade with limited fallback. Because the hardening, cyber-defence and counter-UAS capabilities involved are controlled, export-control clearance and end-use confirmation are established before any representation. The remedy is then matched to Sri Lanka's real conditions: systems concentrated and interdependent, ports that are economic lifelines, control built for reliability rather than adversaries. What protects the most is hardened first. Delivery is phased and sustained in-region rather than supplied and left, keeping essential services running under deliberate pressure. Because critical infrastructure is where a state is most coercible, localisation arrangements are scoped per programme, subject to export controls and end-use approvals, so the map of the island's vulnerabilities and the defensive advantage stay national.
Relevant capability
Critical infrastructure resilience
Capability page →
Monitoring and incident response
Capability page →
Layered defence against the drone threat
Capability page →Adjacent priorities in Sri Lanka
Ministries, registries and national databases are under continuous attack from criminal and state-linked actors. Around-the-clock defensive operations, authorised red-teaming and architectures for disconnected environments protect the systems a state runs on, accountable to your government, not a foreign one.
Problem pageCheap unmanned aircraft now threaten airports, energy sites, borders and public events in every region. Layered counter-UAS, combining detection radar tuned to small slow targets, passive sensing and defeat systems, is the affordable answer recent conflicts demand.
Problem pageTapping, bunkering and sabotage of oil infrastructure drain national revenue and cause environmental damage. Persistent overhead surveillance detects illegal connections and vessel movements, while control-system hardening protects the pipeline network itself.
Problem pageRelevant solutions
Power, water, transport and port systems assessed, hardened and watched continuously, by a team with no foreign government to report the findings to.
Solution page →Layered defence against hostile unmanned aircraft: detection, tracking and defeat priced for the mass threat rather than a missile economy that empties the magazine first.
Solution page →Sri Lanka: security context
Sri Lanka's island position shapes its priorities: maritime domain awareness astride busy sea lanes, protection of its exclusive economic zone and fisheries, coastal surveillance, and security of critical infrastructure. It is an environment where the approaches around the island matter as much as the coast itself.
An accountable single-channel engagement gives Sri Lanka a coherent counterpart for those priorities, maritime domain awareness, EEZ and fisheries protection, coastal surveillance and infrastructure protection. A security agency gains end-use certified equipment, disciplined export-control handling and localisation arrangements scoped per programme rather than promised in advance.
About this challenge
Power grids, water systems and transport networks face both physical and cyber attack. Hardening the control systems behind them, defending the networks around them and countering the drone threat above them keeps essential services running under pressure.
Frequently asked questions
Why does Sri Lanka's concentrated infrastructure need defending as one problem?
Because generation, water, ports and the digital backbone are interdependent on a compact island with limited fallback, a single intrusion or strike can cascade beyond the site where it began. Hardening control systems, defending the surrounding networks and countering the drone threat together closes the door piecemeal defence leaves open. We would welcome the chance to brief your team on an assessment-first programme.
What does hardening the control systems actually prevent?
It reduces the attack surface of the supervisory systems behind power, water and port operations, so an intruder cannot manipulate a process, defeat a safety interlock or force a shutdown. Combined with continuous cyber monitoring, it keeps essential services running under deliberate pressure.
Who holds the picture of the island's infrastructure weaknesses?
The national operator does. Hardening, cyber defence and counter-UAS all come from independent, non-aligned makers, so the map of where the system is most exposed stays accountable to Sri Lanka, with localisation arrangements scoped per programme and subject to export controls and end-use approvals.