Landfall Is Not Diversity: Auditing the Seabed Beneath Your Resilient Network

A zero-trust architecture is, at heart, a set of claims about what happens when something fails. We assert that identity will be re-verified, that policy will follow the workload, and that traffic will find another route. The first two claims are usually tested with rigour. The third is often accepted on the strength of a diagram.

That is an assurance gap. In the UK, path diversity is not merely a matter of carrier selection or BGP configuration. It is a physical property of the estate, shaped by landing stations, cable corridors, coastal geology, power feeds and the permits that govern what can be dug where. A network can be logically diverse and physically convergent. When that happens, the resilience claim is not wrong so much as unproven.

The diagram stops at the beach

Most enterprise network maps end at a point of presence. They show two lines leaving a data centre, diverging politely across a county, and arriving at two different carriers. What they rarely show is that both lines enter the same duct within a kilometre of the building, cross the same river on the same bridge, or reach the coast at beaches served by the same landing station.

This is not a failure of drawing. It is a failure of evidence standards. We would not accept an identity control that was asserted in a slide and never tested against directory data. Path diversity deserves the same treatment. The question is not whether the design says two paths exist. The question is whether a credible failure event can remove both.

Three UK geographies that reward scrutiny

The UK's subsea geography concentrates traffic in ways that are easy to overlook. Cornwall is the historic and continuing gateway for many international cables, with landing stations and cable corridors along a relatively short stretch of coast. The concentration is not accidental: deep water, favourable seabed conditions and decades of operational experience have made the peninsula a natural landfall. But concentration is concentration, however well justified.

The Irish Sea presents a different pattern. Cables crossing between Great Britain and Ireland, and routes serving the Isle of Man, share corridors that are also used for power and other infrastructure. A fault, a maintenance operation or a permitting dispute in one corridor can affect more than one service. The sea is not a blank space between two points; it is a regulated, surveyed and increasingly crowded environment.

North Sea energy links add a third dimension. Offshore wind farms, interconnectors and telecommunications cables increasingly share seabed corridors and landfall infrastructure. An energy project may not carry your packets, but it can influence where cables are permitted, how they are protected and how quickly repairs can be made. Resilience planning that ignores the energy transition is planning against last decade's seabed.

A shared-fate matrix for path claims

The practical audit test is to replace the network diagram with a shared-fate matrix. For each critical service, list the primary path and every asserted alternate. Then identify the physical assets on which each depends: landing station, beach manhole, duct, chamber, power feed, backhaul route, carrier exchange and maintenance regime. The matrix should record where those assets are shared.

A simple exercise exposes more than a policy review. Remove one physical asset at a time and ask whether the alternate path survives. Remove the landing station. Remove the duct that serves the beach. Remove the power feed to the carrier's regeneration equipment. Remove the road crossing that carries both backhaul routes. If the answer is that the alternate depends on the same asset, the diversity claim is not yet evidenced.

The exercise should be repeated with real fault history. Ask carriers for restoration evidence from the past three years, not just design documentation. Ask where maintenance windows have coincided. Ask which permits or environmental restrictions could delay repair. A path that exists on paper but cannot be restored within the service tolerance is a path that fails the test.

What to ask in procurement

Procurement is where path diversity claims are made binding. The tender should require coordinate-level evidence, not just carrier names. Ask for landing station identifiers, duct and chamber sharing declarations, and the physical route of the restoration path. Ask whether the alternate path uses the same coastal landing point or the same inland corridor. Ask for the fault and restoration record that supports the claim.

These questions are not adversarial. They are the same questions a competent carrier should be able to answer about its own estate. The difficulty is that they cross organisational boundaries: a carrier may know its own ducts but not the power feed; a landing station operator may know the beach but not the backhaul. The audit's job is to assemble the evidence across those boundaries and record where it is missing.

Contract language should follow the evidence. Service credits for diversity are useful, but they are not a substitute for proof. A clause that requires notification when a shared asset changes is more valuable than a clause that promises diversity in perpetuity. The seabed is not static, and neither is the estate above it.

Evidence before assurance

Zero trust does not remove the need for physical resilience. It sharpens it. If access decisions depend on a control plane that depends on a network that depends on a single landing station, the architecture is only as trustworthy as its least examined dependency.

The audit output should be a register, not a reassurance. Record the claims, the evidence, the shared assets and the gaps. Put the register in front of the board alongside the identity and supplier risk registers. Path diversity is a procurement and design assertion, and it deserves the same evidence standard as any access control. Until the seabed has been checked, the second path is a hypothesis.