Your risk models are wrong. It's not your fault, but it's still your problem.
Risk models are not keeping pace
In every infrastructure organization, a single number often dictates the flow of millions in mitigation capital. That number, embedded in a risk score, feeds a prioritization matrix and ultimately informs the capital plan presented to the board. The challenge is not that the math is wrong. It is that the underlying assumptions have become decoupled from reality.
These models fail not from engineering error, but because their assumptions no longer fit a fundamentally changed world. If negligence were the issue, accountability would be the answer. But since the problem is structural, the response has to be strategic.
The reliance on historical baselines
Most infrastructure risk models are built on historical data: asset failures, incident history by location, and age-based inspection cadences. These frameworks were calibrated for a world where the primary threats were aging steel and corrosion.
Today, the dominant hazards are atmospheric rivers, vegetation-driven ignitions, and third-party encroachment, events with little to no historical signature. While the engineers who built these models were precise in encoding the best available knowledge, the environment has moved beyond the frameworks they designed.
The data confirms this shift. According to the Fifth National Climate Assessment, heavy precipitation falling on the most extreme storm days has increased 60% in the Northeast and 45% in the Midwest since 1958. These are not future projections. They are the observed record. Most risk models still rely on exceedance curves drawn before these shifts were measurable.
The changing nature of consequence
On the consequence side, the landscape is equally unstable. Customer criticality, network interdependencies, and post-event restoration constraints are all intensifying. A risk score that treats a localized failure the same as one with significant cascade potential is not measuring consequence. It is counting customers.
Engineering delivered what was asked of it: a defensible, auditable model consistent with regulatory expectations. In a rapidly changing hazard environment, consistent is no longer sufficient.
The architecture is the problem
The core issue is the update cycle. Most organizations refresh risk assumptions on rate case or regulatory cadences, not on the cadence at which the environment is actually moving. That mismatch creates a structural dependency on a historical baseline that no longer describes the operating reality.
GeoAI, dynamic probabilistic modeling, and real-time environmental inputs can close a significant portion of this gap. But the technology is only as useful as the governance process it feeds. If the decision to act on updated risk assumptions still runs on a regulatory schedule, the model can be perfect and the capital allocation will still be wrong.
Your risk models are wrong. The engineers who built them did everything right. The gap between those two facts is now sitting in your capital plan, your board presentation, and your next rate case.
It is not your fault. It is still your problem.