Mesh architectures and immune-inspired mechanisms in defending critical infrastructure

Critical infrastructure increasingly operates in interconnected, software-defined environments and is simultaneously subject to targeted cyberattacks that disrupt key services. Traditional perimeter approaches are proving insufficient as they allow attackers to remain in systems for long periods of time and leave recovery mechanisms vulnerable. The article explored the applicability of the principles of mesh cybersecurity architecture and digital immune systems, which have been developed in cloud environments, to the public and industrial sectors. The aim of the study was to evaluate the transfer of mesh and immune approaches to the water supply, energy, and municipal services sectors and to demonstrate their impact on resilience in real incidents. The methodology combined a review of cloud security patterns, comparative case studies, and threat scenario modeling. Two events were considered: a cyberattack on the municipal infrastructure of a large US city and a transnational campaign against operational technologies in the water and gas sector. In the first case, the lack of segmentation allowed the virus to spread unhindered between network segments, while in the second, the lack of automated monitoring led to a delay in detecting the intrusion. For each event, the progression of the attack was compared with control points where distributed control nodes, identity-based segmentation, and feedback loops could limit the impact and initiate automated recovery. The results confirmed that mesh combined with immune-like responses provided faster isolation, controlled degradation, and recovery based on behavioral signals such as abnormal commands or configuration changes. Simulation modeling showed that the average system recovery time was reduced by 35-40% in scenarios with a mesh architecture, and the spread of the attack was limited to one segment instead of four. The practical value of this work lies in providing a roadmap for the gradual improvement of monitoring systems without a complete redesign, which is useful for operators of critical infrastructure and industrial enterprises