Optimising Disaster Resilience Through Advanced Risk Management and Financial Analysis of Critical Infrastructure in the Serbian Defence Industry

1. Introduction

National security, as well as overall security, heavily depends on the robustness of critical infrastructure. Initially viewed as a logistical function that supports other logistical operations, critical infrastructure has gained prominence due to the rising threat of asymmetric attacks, particularly terrorism. Both theoretical analyses and practical experiences have shown that critical infrastructure systems, services, and assets—whether physical or virtual—are crucial for societal well-being. The disruption or destruction of these systems can severely impact citizens' health, safety, economic stability, and the effective functioning of government (Škero & Ateljević, 2015).

Critical infrastructure comprises large-scale, man-made systems that are crucial for the production and distribution of essential goods and services. These systems include but are not limited to, the provision of energy, water, data, transportation, finance, and healthcare. According to the Council Directive 2008/114/EC, an infrastructure is deemed critical if its incapacitation or destruction would have a significant impact on public health, safety, security, economic stability, and social well-being. The failure or disruption of critical infrastructure can lead to severe societal and economic repercussions, potentially causing cascading failures across other interconnected infrastructures, and resulting in catastrophic consequences (Carreras et al., 2004; Zio, 2016).

Recent research underscores the growing interconnectedness of critical infrastructure systems, which heightens their susceptibility to both natural and human-made hazards. For instance, the rising integration of information and communication technologies has introduced new cyber risks that could jeopardize physical infrastructure (Petit et al., 2015). Additionally, climate change has brought about new challenges, such as extreme weather events, that can disrupt essential services and demand stronger resilience planning (Rinaldi et al., 2001). Hence, a thorough approach to risk management is crucial to safeguarding these essential systems and maintaining their operation amid various threats.

Regarding that, the objective of this paper is to systematically examine the vulnerabilities and risk factors associated with the critical infrastructure of the Serbian defence industry through a financial performance analysis. This study reflects on the inherent complexities of these systems, identifies related challenges, and proposes potential solutions for their analysis and management. Specifically, the paper explores the framework of vulnerability and risk analysis in protecting and enhancing the resilience of six key entities within Serbia's defence industry. Given the complexity of these systems, the study argues for the integration of various modelling perspectives and innovative analytical approaches (Bouchon, 2006). This integration is crucial for accurately capturing the structural and dynamic complexities of critical infrastructures, thereby enabling confident decision-making regarding protection and resilience actions (Zio, 2016).

2. Critical Infrastructure Resilience: A Risk and Vulnerability Approach

The Republic of Serbia has a wealth of experience in handling disasters, particularly those stemming from electrical incidents. In the last ten years, the country has recorded over 150,000 fires (Cvetković, Pavlović, & Janković, 2021; Cvetković, Pavlović, & Janković, 2021; Cvetković et al., 2022; Cvetković & Marković, 2021; Cvetković & Janković, 2021). Significant incidents, such as the 2014 floods in Obrenovac and the 2009 earthquakes in Kraljevo, have driven Serbia to establish a comprehensive protection and rescue system to effectively address threats to critical national resources (Cvetković, Babić, & Gačić, 2017; Cvetković, Bošković, & Ocal, 2021; Cvetković & Martinović, 2020; Cvetković, 2016). The legislative framework, including the Law on Emergency Situations and various strategic documents, lays the groundwork for adopting the Critical Infrastructure Law and aligns with numerous European regulations in this area (Cvetković & Synodinou, 2024; Cvetković, Nikolić, & Lukić, 2024; Cvetković, Nikolić, & Lukić, 2024; Cvetković & Šišović, 2023; Cvetković & Šišović, 2024; Cvetković et al., 2021).

Serbia's defence industry's critical infrastructure faces numerous hazards, risks, and threats, including natural disasters, ageing components, increased load demands, climate change, intentional attacks, and terrorism. As a result, protecting critical infrastructure (CIP) has become a major global priority. Regional countries like Slovenia and Croatia are actively addressing these issues through specific legislation that outlines institutional roles during disasters (Lewis, 2006), with a focus on physical protection and asset reinforcement (Cimellaro et al., 2010). To protect the defence industry's critical infrastructure, it is crucial to model its components under various threats and perform thorough risk and vulnerability assessments at the system level.

The importance of resilience in critical infrastructure—its ability to endure, adapt, and quickly recover from disruptions—has been highlighted by recent catastrophic disasters (Moteff, 2012). The 2005 World Conference on Disaster Reduction emphasized the need for disaster resilience, fostering a new culture of disaster response (Zio, 2016). Systems must be not only reliable but also capable of recovering from disruptions. Government policies now encourage efforts to ensure systems can continue operating at some level or return to full functionality after a disruption (Cvetković, Rikanović, & Knežević; Cvetković & Šišović, 2024; Grozdanić & Cvetković, 2024). Consequently, resilience is now seen as an essential attribute for critical infrastructure, integrated into its design, operation, and management. Serbia should play a significant role in further defining and regulating this area.

The national well-being of Serbia's defence industry, along with all interconnected entities and stakeholders, relies on secure and resilient critical infrastructure—resources, systems, and networks crucial for the seamless functioning of society. To achieve security and resilience, critical infrastructure partners must collaboratively prioritize goals, mitigate risks, measure progress, and adapt to changing conditions (U.S. DHS, 2013). Although Serbia has recently established and prioritized critical infrastructure compared to the European Union, the United States, and neighbouring countries, substantial efforts by the academic, professional, and scientific communities, along with institutional support, guide national efforts toward critical infrastructure risk management.

The community involved in critical infrastructure risk management is diverse, including partnerships between owners and operators, government entities at various levels, regional organizations, non-profit groups, and academia. Effective risk management requires an integrated approach across this community (Carla, 2019; Cvetković, 2019; Goyal, 2019; Mano & Rapaport, 2019; Öcal, 2019; Vibhas, Bismark, Ruiyi, Anwaar, & Rajib, 2019; Xuesong & Kapucu, 2019): a) identify, deter, detect, disrupt, and prepare for threats against the state's critical infrastructure, including the defence system, the Ministry of Defence, the Armed Forces of Serbia, and the defence industry; b) reduce the vulnerability of critical assets, systems, and networks within the defence industry and its external relations; c) mitigate the potential impacts of incidents or adverse events on critical infrastructure. The success of this integrated approach depends on leveraging a broad spectrum of skills, expertise, and experience within the critical infrastructure community and related stakeholders. This has become increasingly evident in Serbia in recent years. Effective information sharing among partners is crucial for building situational awareness and enabling risk-based decision-making (U.S. DHS, 2013).

Traditionally, risk has been defined as a function of three elements: the threats to which an asset is susceptible, the asset's vulnerabilities to the threat, and the potential consequences of asset degradation (Petit et al., 2013). Today, resilience has emerged as a fourth component, alongside vulnerability, threat/hazard, and consequences, forming the comprehensive risk function. In the context of critical infrastructure, risk at an asset (such as an office building, hangar, factory, or machinery) for a given threat/hazard type is a function of the threat/hazard likelihood (Carlson et al., 2012), the asset's vulnerability (the likelihood of a successful threat event), the asset's resilience, and the magnitude of the resulting consequences (Petit et al., 2013). As depicted in Figure 1, the risk components are inherently interdependent. When considering a threat or hazard—whether manmade or natural—the vulnerability and resilience of the asset (infrastructure) will determine the resultant consequences. The intrinsic complexity of risk is amplified by dependencies and interdependencies that affect the components of risk (Petit et al., 2015). In today's interconnected world, the potential impacts are exacerbated by these dependencies and the diverse range of threats capable of exploiting them. Critical infrastructure now spans national borders and global supply chains, a crucial point in this case study.

Within the context of the risk framework depicted, policy, and operating environments, the structures of critical infrastructure sectors and cross-sector partnerships provide a framework to guide the collective efforts of partners. The national effort to enhance critical infrastructure security and resilience relies on the ability of public and private critical infrastructure owners and operators to make risk-informed decisions when allocating limited resources during both steady-state and crisis operations (U.S. DHS, 2013). The complex and uncertain risk environment affecting critical infrastructure, particularly the defence industry, has evolved significantly over the past decade. Daily threats to vital state entities have become increasingly relevant, as evidenced by developments globally, regionally, and in Serbia's southern province. For example, critical infrastructure that has long faced physical threats and natural disasters is now increasingly exposed to cyber risks, stemming from the integration of information and communication technologies with critical infrastructure operations and the hostile exploitation of potential cyber vulnerabilities.

As the number of threats in modern analyses and practice continues to grow, protecting critical infrastructure becomes increasingly important (Carla S., 2019; Cvetković, 2019; Frosdick, 1997; Kumiko & Shaw, 2019; Öcal, 2019; Perić & Cvetković, 2019; Vibhas et al., 2019). This protection is crucial not only because of the potential damage to the infrastructure itself but also because of the broader societal and economic consequences such damage can cause. Protecting critical infrastructure during emergencies should be viewed as part of a comprehensive prevention process and emergency response strategy. In this context, organizations establish, implement, and maintain procedures to identify potential incidents that could negatively impact them, their activities, and the environment (Cvetković, 2024b). These procedures aim to protect lives and property, prevent emergencies or disasters, minimize operational downtime, recover critical activities, return to normal operations, and safeguard the organization's reputation. As Rinaldi, Peerenboom, and Kelly note, “It is impossible to adequately analyze or understand the behaviour of a given infrastructure [organization] in isolation from the environment or other infrastructures” (Rinaldi, Peerenboom, and Kelly, 2001). Critical infrastructure constantly interacts with its environment, utilizing and transforming inputs from the environment to provide outputs back to it. Figure 1 illustrates how the critical infrastructure of Serbia's defence industry influences and interacts with its environment.

Figure 2. Influence and interaction between critical infrastructure of Serbian defence industry and environment.

Figure 2. Influence and interaction between critical infrastructure of Serbian defence industry and environment.

These interactions can be classified into three main categories: a) upstream dependencies: which refer to the essential products or services provided to one infrastructure by another external infrastructure. In the context of the Serbian defence industry, there is a direct dependency on companies and entities that supply vital raw materials, supplies, and resources for the production of weapons and military equipment. Additionally, these external entities offer services that the defence industry cannot provide independently.

Protecting these upstream dependencies from various risks and threats across all operational domains is crucial; b) internal dependencies: involve the interactions among the internal operations, functions, and missions within the infrastructure itself. Internal dependencies are the internal connections among the assets that make up critical infrastructure. For example, the production of ammunition at “Prvi Partizan” a.d. Užice is directly reliant on the propulsion machinery and the moulds that determine the calibre; c) downstream dependencies: These pertain to the effects on a critical infrastructure’s consumers or recipients resulting from the degradation of the resources provided by that infrastructure. In a more specific sense, the Ministry of Defence and all units of the Serbian Armed Forces would be directly impacted. In a broader sense, the entire state, the population, the environment, and the functioning of interstate entities and organizations would also be affected.

3. Improving National Efforts for Strengthening the Security of Critical Infrastructure

The government, particularly through the Ministry of Defence and the defence industry sector, has a vested interest in ensuring the robustness of critical infrastructure and the continuous provision of essential services under all conditions. Owners and operators of critical infrastructure often stand to gain the most from investing in their security and resilience. They are motivated by both the direct benefits and a sense of social responsibility to adopt these practices. However, production sectors and companies may be rightfully concerned about the return on investments in security and resilience, as these may not yield immediately measurable benefits. Effective incentives can help justify the costs associated with enhanced security and resilience by balancing short-term expenses with near-term benefits (U.S. DHS, 2013).

Market-based incentives can drive significant changes in business practices and foster the development of markets such as insurance for cyber, chemical, biological, or radiological risks. Additionally, the Republic of Serbia and local governments can explore offering incentives to encourage investment in security and resilience measures. Effective measures and activities for implementation include: a) continuously identifying, analyzing, and, where appropriate, implementing incentives; b) supporting research and data collection to quantify the potential costs resulting from inadequate critical infrastructure security and resilience, and insufficient cyber preparedness; c) establishing innovation challenge programs to incentivize new solutions for strengthening infrastructure security and resilience during the planning, design, and redesign phases, including technological, engineering, and process improvements.

The dependencies and interdependencies of critical infrastructure represent complex elements that are challenging to identify and analyze. They are characterized by various interactions (e.g., upstream, internal, and downstream), classes (e.g., physical, cyber, logical, and geoFigureic), and dimensions (e.g., operating environment, coupling and response behaviour, type of failure, infrastructure characteristics, and state of operation). These factors influence all components of risk (threat/hazard, vulnerability, resilience, and consequence), can themselves become threats or hazards, affect the resilience and protection performance of critical infrastructure, and lead to cascading and escalating failures. It is essential to integrate dependencies and interdependencies into risk and resilience methodologies.

A data-driven capability that operationalizes the analysis of dependencies and interdependencies would not only provide an unprecedented level of situational awareness but also enable decision-makers to anticipate disruptions. Achieving this ultimate goal requires the development of a comprehensive and interactive assessment of critical infrastructure dependencies and interdependencies. This necessitates the combination of multiple areas of expertise (e.g., engineering, social sciences, business continuity, and emergency management) within an adaptive and flexible assessment framework (Petit et al., 2015).

Furthermore, the integration of advanced technologies and innovative methodologies plays a crucial role in enhancing the security and resilience of critical infrastructure (Vladimir Cvetković, 2024a, 2024b). Emerging technologies such as artificial intelligence, machine learning, and big data analytics can be leveraged to predict and mitigate potential risks more effectively (V. Cvetković & Filipović, 2017). By utilizing these technologies, critical infrastructure systems can benefit from real-time monitoring, predictive maintenance, and automated response mechanisms that can significantly reduce vulnerabilities and enhance overall resilience. Additionally, collaboration with international partners and participation in global initiatives can provide valuable insights and best practices, fostering a more comprehensive approach to critical infrastructure protection (Baruh, Dey, & Dutta, 2023; V. M. Cvetković, 2023; El-Mougher, Abu Sharekh, Abu Ali, & Zuhud, 2023; Rajani, Tuhin, & Rina, 2023; Sudar, Cvetković, & Ivanov, 2024). The Republic of Serbia, by embracing these advancements and fostering a culture of continuous improvement, can strengthen its national efforts to secure and sustain its critical infrastructure, ultimately contributing to the stability and prosperity of the nation (Cvetković & Kezunović, 2021; Hromada & Lukas, 2012; Murray & Grubesic, 2012).

4. Recommendations for Enhancing the Security and Resilience of Critical Infrastructure in Serbia's Defence Industry

The following recommendations aim to bolster the security and resilience of critical infrastructure within Serbia's defence industry, ensuring robust protection and sustained functionality:

a)

Continuously identify, analyze, and implement incentives to justify the costs of improved security and resilience;

b)

Balance short-term expenses with near-term benefits to support additional investments;

c)

Develop market-based incentives to drive significant changes in business practices and foster markets for insurance against cyber, chemical, biological, and radiological risks;

d)

Support research and data collection to quantify the potential costs of inadequate infrastructure security, resilience, and cyber preparedness;

e)

Utilize collected data to enhance risk management strategies and enable data-driven decision-making;

f)

Establish innovation challenge programs to incentivize new solutions for infrastructure security and resilience during the planning, design, and redesign phases;

g)

Collaborate with international partners and participate in global initiatives to gain valuable insights and best practices;

h)

Apply emerging technologies such as artificial intelligence, machine learning, and big data analytics to predict and mitigate potential risks more effectively;

i)

Use these technologies for real-time monitoring, predictive maintenance, and automated response mechanisms to reduce vulnerabilities and enhance resilience;

j)

Continue national efforts in Serbia to propose a resilience assessment framework for critical infrastructures, focusing on risk assessment to address identified gaps;

k)

Ensure this framework captures interdependencies across different infrastructures, sectors, and borders, with a particular focus on resilience;

l)

Promote effective information sharing among partners to build situational awareness and enable risk-based decision-making;

m)

Foster collaboration between infrastructure owners and operators, government entities, academia, and non-profits to ensure successful risk management;

n)

Achieve consensus on common risk metrics across sectors to ensure consistency and effectiveness in measuring and managing risks;

o)

Harmonize the national risk assessment framework with EU policies and strategies for critical infrastructure;

p)

Recognize the rapid integration of the defence industry into economic flows as a vital element of Serbia's national security policy;

q)

Align with European standards and regulations, and establish preventive and control mechanisms for critical defence infrastructure to maintain Serbia's defence, security, and foreign policy interests;

r)

Develop mechanisms to protect critical infrastructure from global, regional, and internal threats, making this a national security priority for Serbia;

s)

By implementing these recommendations, Serbia can significantly enhance its efforts to secure and sustain critical infrastructure, contributing to national stability and prosperity.

5. Conclusions

The impact of infrastructure disruption is typically quantified in terms of aggregated figures that represent economic losses. This approach allows policymakers to evaluate various disruption scenarios, including cascading effects across sectors, and to assess the costs and benefits of mitigation measures (Giannopoulos et al., 2012). A comprehensive risk assessment is achievable when the impact data is combined with the likelihood of these scenarios. Without this information, the analysis remains an impact assessment and cannot effectively prioritize risk mitigation measures, especially for High Impact Low Probability (HILF) events. A significant challenge for risk assessment methodologies is to address these gaps and develop a harmonized framework at the national level, extending to the defence industry.

• Such a framework should accurately capture interdependencies across different infrastructures, sectors, and borders—a critical requirement for the West Balkan countries in coordination with EU critical infrastructure policies and strategies. Additionally, there must be consensus on a common risk metric across sectors. In summary, risk assessment for critical infrastructures should be an integral part of a broader framework, with resilience analysis as the primary tool. The continuation of this work at the national level in Serbia should focus on proposing a resilience assessment framework for critical infrastructures, where risk assessment serves as a subset to bridge the gaps identified in this research.
• The social and economic stability of the world now heavily relies on the reliable supply of basic goods and services, transported and distributed through extensive technological network infrastructures. National security today depends significantly on these capacities, including the smooth functioning of the defence industry's complexes, as seen in Serbia. These critical infrastructures are subject to potential disruptive factors from hazardous natural and human environments, such as the global political climate, human capital, financial crises, severe damage, explosions in warehouses, and organized (cyber) crime or cyber warfare (Zio, 2016). The infrastructure systems within the Serbian defence industry are exposed to numerous external and internal influences, creating a potential base from which dangerous hazards and harmful events can quickly and globally spread throughout the system. This has increased systemic risk exposure, characterized by cascading failures that can significantly impact both national and regional levels. Indeed, significant disruptions have highlighted the need for the protection and resilience of critical infrastructures as a national and international priority.
• In conclusion, the integrity, economic, and security stability of Serbia is closely tied to the state and developmental potential of the defence industry. Its rapid development and integration into national and international economic flows, through the acquisition of new technologies, has been recognized as a vital element of Serbia's national security policy. Aligning with European standards and regulations, and establishing preventive and control mechanisms for critical defence infrastructure, are fundamental prerequisites for maintaining the integrity of defence, security, and foreign policy interests, as well as enhancing the overall credibility of Serbia. Given the context of global, regional, and internal threats, developing adequate mechanisms for the protection of critical infrastructure has become a national security priority for Serbia.