Coordinated Cyberattacks on Power Grids Are 4× Worse Than the Sum of Their Parts — and Current Resilience Models Miss It Entirely

A new index shows that coordinated cyber-physical attacks on power grids produce resilience losses 3.7–4.1× their additive estimates. The gap is structural, not incremental.

Imagine you're stress-testing a bridge. You test wind load alone — it holds. You test heavy traffic alone — it holds. So you add the two stress numbers together and declare the bridge safe under both. But the real failure mode is that wind-induced oscillation changes the load distribution of traffic, which amplifies the oscillation, and the bridge collapses at a combined stress far below what your addition predicted. That's the core mechanism of this paper: interaction effects in coordinated attacks on power grids are non-additive, and every resilience framework that treats them as additive is structurally blind to the actual collapse threshold. The committed claim: existing power-grid resilience assessments that score physical, cyber, and operational disruptions independently — then sum them — systematically underestimate coordinated attack severity by a factor of roughly 4×. The authors propose GRID-MRI (Grid Multidimensional Resilience Index), a composite metric that captures endogenous disruption severity, cross-domain coordination amplification identified via counterfactual simulations, and exogenous stressors like climate and regulatory conditions. Applied to a modified IEEE 39-bus test system under three escalating scenarios drawn from the December 2025 Polish cyberattack incident, GRID-MRI jumps from 0.062 (mild, single-vector) to 1.188 (coordinated cyber-physical) to 6.081 (coordinated plus exogenous stress) — a 98× range that additive scoring would compress into something far narrower. The ladder position is honest but limited. The baseline here isn't a competing resilience index with published numbers on the same test system — it's the additive assumption itself. The authors demonstrate that resilience losses under coordinated attack are 3.72× and 4.09× their additive estimates. This is a useful structural result, but the comparison is methodological rather than competitive: they're not benchmarking GRID-MRI against named alternatives like REDI or Panteli's trapezoid model on the same scenarios with the same inputs. The IEEE 39-bus system is a standard test network, but it's a 10-generator, 39-bus model — orders of magnitude simpler than real continental grids. Architecturally, GRID-MRI sits in the scenario-based simulation family for infrastructure resilience. The method decomposes disruption into physical, cyber, and operational dimensions, runs counterfactual what-if simulations for individual attacks versus coordinated attacks, and computes interaction terms as the residual between the coordinated outcome and the sum of individual outcomes. Exogenous stressors (climate severity, economic-regulatory pressure) enter as multiplicative scaling factors on the composite index. This is fundamentally a structured scoring framework with simulation-backed calibration, not a machine learning or optimization approach. The computational backbone is power-flow simulation on the IEEE test case. Integrity is the weakest link. The validation is entirely same-team simulation on a single test network. The three attack scenarios are informed by the December 2025 Polish incident, which adds real-world grounding, but the connection is inspirational rather than empirical — they didn't replay actual attack telemetry. No code release is mentioned, no pre-registration, and no independent validation. The counterfactual simulation design is sound in principle — comparing coordinated vs. individual attack outcomes to isolate interaction effects — but the authors chose both the scenarios and the test system, which introduces selection bias risk. The 3.72× and 4.09× multipliers are striking numbers, but they're products of specific scenario construction on a specific network topology. The milestone question is where this gets interesting for practitioners. The paper demonstrates the non-additivity principle at 39-bus scale. The next concrete threshold would be demonstrating the same interaction-amplification pattern on a realistic national-scale model (hundreds to thousands of buses with real topology and protection schemes) and showing that the multiplier effect holds or changes predictably with network complexity. If the 4× factor scales or grows with system size, that's a finding that changes how national grid operators run risk assessments. If it shrinks, the concern is less urgent at scale. The obvious experiment not run: applying GRID-MRI to a real operator's network model with actual SCADA/EMS topology and historical incident data. The honest read is (a) — access. Real grid models and attack data are classified or proprietary in every jurisdiction. The authors used the Polish incident as scenario inspiration precisely because they couldn't access the actual operational data. A partnership with a European TSO would be the natural next step, but those partnerships take years to establish and clear security review.