Ensuring the resilience of energy systems – or their capacity to prepare for disruptions, withstand shocks while maintaining operations, and rapidly restore service – plays a key role in managing many of today’s emerging security risks, from weather disruptions to geopolitical tensions. Energy security encompasses both long-term adequacy through infrastructure investment and diverse supply sources, and short-term resilience for events beyond standard planning conditions. While countries face different threats – from extreme and severe weather to cyberattacks and infrastructure failures – a common challenge is to design adaptable systems that can respond rapidly, isolate affected components, and restore supply services swiftly when disruptions occur. While resilience investments require upfront funding, integrating resilience at the planning phase proves more cost-effective than retrofitting systems later or recovering from failures – and it delivers broader societal value by ensuring that critical services remain functional and daily life can continue should disruptions occur.

The resilience measures developed in Ukraine to bolster a system under extreme stress offer universal insights that transcend the specific context of armed conflict. The scale and systematic nature of Russian attacks on Ukraine's energy infrastructure – often compounded by severe winter conditions – represent a profound challenge. Since the onset of the full-scale invasion in 2022, Russia has exploited its detailed knowledge of Ukraine's energy system – inherited from the Soviet era – to strategically target critical nodes such as electrical substations. The resulting failure in these nodes disrupts connections to key generators and requires costly, time-intensive repairs. The measures Ukraine has taken to enhance energy system resilience under these extreme conditions – in many cases improvised, rather than the result of long-term planning – can provide broader lessons.

Since January 2026, Ukraine has faced a severe convergence of threats, creating a catastrophic humanitarian and energy crisis. Russian missile and drone strikes on electricity and gas infrastructure have intensified, and their impact has been compounded by one of the harshest winters in recent years. The power system has been hit especially hard. Ukrainian households have endured severe blackouts, with some areas – including the capital, Kyiv – losing access to power for 17 hours or more on a daily basis. As of mid-January, Ukraine's electricity demand reached 18 gigawatts (GW), while the power system's capacity stood at roughly only 11 GW – a 7 GW deficit that has forced rolling blackouts, threatened heating and water systems during severe sub-zero conditions, and endangered essential services. In response to these extreme challenges, Ukraine has showed extraordinary determination to pursue a new architecture of energy resilience through decentralised electricity and heat generation, complemented by mobile generators and underground control systems.

These 10 lessons, drawn from Ukraine's experience under extreme conditions, provide a toolkit of resilience measures that policy makers around the world can adapt and implement based on their own circumstances and cost-benefit analysis. For each lesson, the report provides a snapshot of how Ukraine has addressed these challenges alongside practical recommendations that policymakers and regulators can tailor to their national risk profiles and priorities.

1.    Put resilience at the centre of energy system planning. Power systems designed for resilience return to normal operation far faster during extreme events and can avoid catastrophic societal impacts and costs. Integrating resilience at the planning phase – through holistic risk assessments involving operators, regulators and energy ministries – reduces overall costs compared with retrofitting and it should not slow planning processes if incorporated systematically.

2.    Implement physical hardening and defence measures. Physical hardening protects infrastructure from both intentional threats and natural hazards, with many techniques providing cross-cutting protection regardless of the threat faced. Effective hardening combines infrastructure that is designed for protection with the ability to rapidly deploy equipment to shield priority assets during emergencies.

3.    Build comprehensive emergency response capabilities that cover multiple threat scenarios. Effective emergency response requires trained teams, technical expertise, specialised equipment, and coordination mechanisms to respond rapidly under extreme conditions. Pre-established legal frameworks, decision protocols, and in-house technical capacity enable faster action than improvisation during crises.

4.    Ensure effective emergency communication mechanisms to reach citizens. No single communication channel is perfectly reliable during extreme crises. Multi-layered systems where backup channels function independently – from battery-powered repeaters and radios to sirens and community networks – ensure critical information can reach populations when digital infrastructure fails.

5.    Leverage decentralisation and distributed resources as strategic security assets. Distributed assets are inherently harder to target and easier to restore when damaged. They also allow for the maintenance of some essential services when interconnected systems are damaged and can help restart them in the event of disruptions. Enabling regulatory frameworks and intelligent grid platforms are essential to coordinate these resources as decentralisation grows.

6.    Maintain emergency oil stocks as a buffer against supply shocks. Emergency reserves provide critical buffers when fuel disruptions threaten essential services, supporting critical mobility and enabling backup generators to sustain hospitals, water utilities, telecommunications and emergency services during prolonged outages. Legal frameworks must mandate minimum reserves with clear ownership, custody arrangements, and release protocols that are established before crises occur.

7.    Standardise and stockpile critical equipment. Equipment standardisation dramatically accelerates repair timelines by enabling the rapid deployment of compatible components, while strategic and tracked stockpiles ensure availability during emergencies. Long-term manufacturer agreements with emergency priority access enhance the security of supplies for critical infrastructure.

8.    Treat data as a strategic asset and continue its collection during emergencies. Crises disrupt data collection precisely when information becomes most critical for assessing damage, prioritising restoration, evaluating response effectiveness, and conveying both short-and medium-term needs to partners. Emergency legislation must ensure continuation of critical data flows through both technical measures and clear reporting responsibilities.

9.    Embed cyber resilience into all aspects of system planning and operations. As distributed architectures create thousands of potential entry points, layered security with strict network segmentation, continuous monitoring, and international threat intelligence sharing becomes essential. Ukraine's successful prevention of attacks targeting millions demonstrates the value of combining secure-by-design principles, prompt cyber incident response and rapid coordination among stakeholders.

10.  Build mechanisms for cross-border cooperation. Countries often cannot respond to high-impact events alone. International cooperation enables the necessary distribution of equipment, expertise and resources. Mutual assistance agreements with clear obligations and cost-sharing, established in advance rather than during crises, enable rapid deployment under established protocols and prevent months-long delays.