Pre-positioning in Critical Infrastructure: Dormant Access for Future Crisis

'Pre-positioning' describes the implantation of dormant access in critical infrastructure — energy, water, telecom, transportation — without immediate disruptive effect, retaining the capability to act during a future geopolitical crisis. Five Eyes agencies have repeatedly warned of such campaigns, most prominently the Chinese 'Volt Typhoon' activity tracked in US and allied networks since 2023.

The strategic logic differs from immediate espionage or disruption. Pre-positioning is about optionality and signalling: the attacker preserves the ability to degrade or disrupt an adversary's civilian infrastructure if a crisis escalates, while also demonstrating reach that may itself deter. Living-off-the-land techniques (using legitimate admin tools rather than malware) make these footholds extremely hard to detect, because the activity blends with normal operations.

Defence therefore demands baseline behavioural understanding: defenders must know what 'normal' looks like on OT and ICS networks to spot the subtle deviations pre-positioning creates. The US CISA 'Secure by Design' initiative and joint Five Eyes guidance on Volt Typhoon emphasise this shift from signature-based detection to anomaly-based hunting in critical sectors.