When we think about extreme weather, we tend to focus on the immediate impact: flooding, water shortages, extreme heat, power outages and damage to buildings or infrastructure.

From a security perspective, I’m often more interested in what happens next.

Climate disruption doesn’t stay local

These past weeks we have seen El Niño develop across the tropical Pacific and strengthened rapidly, with current forecasts indicating it could become a strong event as we move through the rest of 2026. Its effects will vary considerably by region, but El Niño can bring drought to some parts of the world and unusually heavy rainfall to others, with consequences for food production, water, energy, transport and international trade.

We saw some of this during the 2023 El Niño. Drought reduced water levels in the Panama Canal to the point that restrictions had to be placed on the number of ships passing through. In October 2023, rainfall in the Canal watershed was 41% below normal. The same reservoir system also supplies water to more than half of Panama’s population.

For a business thousands of miles away, the drought itself might have felt remote. The resulting shipping delays, supply chain disruption and increased costs were much harder to ignore.

When disruption changes how people work

Spend any time looking at how buildings actually operate during very hot weather and you’ll see windows that are normally closed left open and doors propped open to get some air through. The access control may be working exactly as intended, but that doesn’t make the building secure if someone has wedged open the back door to try and create some form of breeze.

It’s a basic example, but it says quite a lot about how security works in practice. Controls are designed around a set of assumptions about how a building, system or organisation will operate and disruption changes those assumptions.

Working patterns can change very quickly too. Schools closing because of heat or flooding can mean parents working from home at short notice. Problems with trains or roads can keep people away from the office, while power or water problems can make a workplace unusable.

For most businesses, remote working is nothing unusual. However, having a significant proportion of the workforce change their plans at short notice is different. People may be working from locations they wouldn’t normally use, managers may be covering for absent colleagues and established routines may be relaxed because the priority is keeping things moving.

The hidden human and organisational risks

There can be an impact on people too. Extreme weather can put pressure on food production, energy and supply chains, which can eventually feed through into higher costs. If disruption is prolonged, employees may be dealing with financial and personal pressures at the same time as the organisation is dealing with its own problems.

This is important when we look at insider risk. It doesn’t follow that someone experiencing financial difficulty or frustration becomes an insider threat, but changes in circumstances matter. So does distraction, fatigue and the tendency to take shortcuts when people are under pressure. The difficulty is that these effects don’t sit neatly in one place.

If we’re looking at a period of extreme heat, for example, there will be an obvious business continuity question around whether a building can remain operational. But there are other things worth considering at the same time. What will people actually do if the building becomes uncomfortable? Will doors and windows be opened? Will more people work elsewhere? What happens if schools close at the same time and a significant part of the workforce suddenly has childcare problems?

Understanding security dependencies

There are similar questions around critical suppliers. A supplier may have good continuity arrangements on paper, but prolonged drought, flooding, power disruption or problems further down its own supply chain could still affect its ability to deliver. The important thing is understanding how dependent you are on that supplier and how quickly disruption elsewhere becomes a problem for your own organisation.

None of these issues sits neatly within one area of security. A change in how a building is being used can affect physical security. A shortage of resources for critical infrastructure will have wide reaching effects. Different working arrangements can affect cyber and information security. Problems with suppliers can become operational issues, while wider economic pressures can affect people.

El Niño is a useful example because the original event can feel a long way from the day-to-day security concerns of an organisation. But the effects don’t have to be local. They can reach a business through its suppliers, infrastructure, workforce or the wider economy.

For organisations, that means understanding where those dependencies are and noticing when the assumptions behind existing security arrangements no longer hold. Importantly, it requires foresight and planning for longer term disruptions.

Sometimes that change will be significant. Sometimes it will be as simple as the back door being left open.