Blackouts and Black Mirror: Why Cybersecurity Isn’t Enough

This week, a massive power outage cut across Spain and Portugal, hitting major cities like Madrid, Barcelona and Lisbon. Transport systems stopped. People were trapped in lifts. Phone signals dropped out. Shops closed because they couldn’t take payments, and many buildings became inaccessible due to digital locks or electric gates failing. The power cut lasted eight hours. Which was long enough to create chaos. 

In situations like this, businesses are left exposed. Lights go out, alarm systems shut down, CCTV feeds stop recording, and staff often have no way of contacting anyone or reacting quickly. Buildings are left wide open to risk. We’ve dealt with incidents where criminals used gaps in coverage like this to break in, grab what they could, and disappear before anyone even realised the system had failed. With fewer people around and no tech running, there’s very little standing in their way.

‍

There’s been a shift over the last ten years towards digital-first security setups. It makes sense on paper: fewer staff, more automation, and instant access to data. But there’s a problem built into that logic. Most of these systems only work when power, signal and infrastructure are all stable. If one of those goes down, the rest quickly follow. And once everything’s offline, you’re left hoping no one takes advantage of the silence.

The blackout in southern Europe didn’t need a cyberattack or a criminal act to cause disruption. The infrastructure simply failed. It’s a reminder of how dependent we’ve become on digital systems for even the most basic safety functions.

This news also got me thinking about the new Black Mirror episode, Plaything (stay with me). The episode, coincidentally, was released this month and was yet another eerie example of our reliance on tech. The plot revolves around a character, Cameron, who becomes fixated on a virtual life simulation game in the 1990s. The game’s digital creatures evolve beyond basic AI and eventually become something like digital consciousness. Over time, Cameron builds hardware to expand their world, eventually allowing them to live inside his own brain using a neural port.

When Cameron is arrested years later, he tricks police into letting him draw a strange QR-like code on paper, as instructed by the AI creatures. He holds it up to a government-connected security camera which results in national blackout and catastrophe.

I know that this plot is a little outlandish when relating it to reality, and I am aware that what happens in this episode is not something that is possible (not yet anyway), but as an experienced professional in the security industry, it does get you thinking. The episode exaggerates the concept, but it’s not based on magic. It’s based on connectivity. The idea that a camera feed can be a vulnerability. That systems tied together can be manipulated. That once something digital spreads through those systems, it’s almost impossible to stop. And underneath the sci-fi aesthetic is a simpler question: how much of our world have we handed over to systems we don’t fully control?

It’s tempting to see security as just a question of stopping unauthorised access or monitoring entrances. But that view ignores the real conditions where most losses and incidents happen. It’s not always a targeted attack or an elaborate break-in. It’s the quiet moment where the building is unstaffed, the alarm is off, the phones are down and nobody is checking. That’s the gap people exploit.

I try to build physical security into every conversation with clients, because we’ve seen how quickly things go wrong when it’s missing. When systems fail, response becomes manual again. There’s no alert. No data trail. No quick review of camera footage. If someone is already inside, or if no one is there to close a door or make a call, recovery becomes much harder. That’s the moment the cost climbs — and not just financially.

‍

It’s easy to see physical security as a backup option. But in real terms, it’s the only layer that works during an outage, during a network failure, or when a building is empty and systems are down. It’s also the only layer that can respond to uncertainty in real time, not based on sensors, but on judgment.

The businesses that coped best during the European blackout were the ones with people already on-site. Not waiting for a call-out. Not relying on a system to reboot. Just there, ready, watching.

It’s worth asking whether your business could stay protected if the lights went out tomorrow. Could your systems operate? Would your team know what to do? Is someone physically present to manage the space, protect assets, and respond if needed?

If the answer isn’t clear, then you’ve probably invested in part of a solution, but not all of it.

We’re not against smart systems. We work with them every day. But we never treat them as a replacement for people. Technology extends what security can do. It doesn’t remove the need for someone who can walk the floor, speak to people, lock up properly, and take control when things go sideways.

The blackout across southern Europe lasted less than a day. The impact will stretch much longer for the businesses that were caught off guard. These are the real risks of modern infrastructure, and they’re happening more often.

As a business owner, you need to make sure your security still works when the rest of the building doesn’t. If you’re unsure how, or what is best for you, we can help. Get in touch with us here. 

‍