PENTESTY · EDITORIAL ANALYSIS · · 5 min read
Undersea cables: does your backup connection really take another route?
Two internet contracts can conceal a shared physical dependency. The UK undersea infrastructure consultation prompts a closer look at the evidence supporting business continuity.
By Pentesty
What is being consulted on, and why it matters
On October 22, 2026, the UK government published undersea infrastructure proposals, with consultation running until January 14, 2027. They propose sentences of up to 14 years for intentional conduct compromising this infrastructure, alongside security duties for providers. These are proposals, rather than new obligations already in force. The Brazilian news reference was published on October 26.
For technology managers, this discussion is useful for continuity planning. A business does not need to attribute an outage to sabotage to recognize its commercial impact. Nor should it infer that a UK proposal created a duty for every Brazilian company. The analysis below proposes operational checks; it does not replace a legal assessment of an individual organization.
Ask for diversity evidence beyond two invoices
Consider a business using two connectivity suppliers. Different names and contracts do not, by themselves, demonstrate independent physical paths. One possibility to investigate is a shared entry point, upstream carrier or transport segment. Document what each supplier can substantiate and make the remaining unknowns explicit.
Request a diversity statement appropriate to the contract, circuit identifiers and confirmation of relevant concentration points. Avoid sharing detailed infrastructure maps through open channels. A logical route measurement can support the investigation but cannot demonstrate an entire undersea path. The distinction between a supplier record and a real dependency also appears in our supply chain resilience analysis.
Define minimum service before testing the switch
Choose an important journey: authenticating an employee, recording a payment or receiving an order. Agree with its business owner how much interruption is acceptable and what transaction volume must work over the alternative connection. Record latency, packet loss and supplier access constraints as well. Acceptance should describe a task the user can complete.
Check the dependencies participating in that journey. DNS, identity, administrative access and observability must remain usable in the chosen scenario. Redirecting an application will not help if the team loses the means to authorize that change. The same reasoning guides cloud dependency recovery testing.
Turn the result into a decision with an owner
If the evidence reveals a shared dependency, discuss options with procurement, networking and the business owner. A second route, a different access design or a temporary procedure may involve different costs and delivery times. Record the selected option, accepted limitation and decision maker. A known gap needs an owner and a review date.
Include the exercise in change management. A new supplier, entry point or identity service can invalidate the previous conclusion. The aim is to maintain a current justification for the continuity of the selected journey. A documented test demonstrates observed behavior in that scenario; it does not guarantee availability under every failure.
Frequently asked questions
Is the proposed 14-year sentence already in force?
No. The October 22 document sets out consultation proposals. Legal monitoring should consider the final wording and legislative process if the proposals advance.
Do two providers guarantee independent paths?
No. Request diversity evidence and identify shared dependencies. Separate contracts without substantiation of the relevant paths are insufficient to accept the scenario.
Does traceroute prove a cableâs physical route?
Not by itself. It can help observe the logical path but must be combined with supplier information and an understanding of that informationâs limits.
What result should pass a continuity exercise?
A journey completed within agreed criteria, supported by timestamps, evidence and record reconciliation. Acceptance should include the limitations the test did not cover.
Sources and references
- UK government: consultation proposals published October 22, 2026
- UK government: consultation period and status
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 26, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.