Most serious cyberattacks against the UK now from Russia, Iran and China, cyber chief says

The UK’s cyber chief said the most serious attacks are now coming from Russia, Iran and China, with the NCSC handling about 4 nationally significant incidents per week and more than 200 last year. Officials warned that hostile states are increasingly targeting critical infrastructure and businesses, and that AI is making it easier for attackers to find vulnerabilities faster than human teams can patch them. The message is clearly defensive: companies should prepare for cyberattacks at scale in the event of broader geopolitical conflict.

Analysis

The market is underpricing cyber risk as a geopolitical beta, not just an IT spend line. The key second-order effect is that state-linked attacks are inherently non-compensable through normal operational workarounds, which shifts the economic damage from temporary downtime to regime-level confidence in logistics, utilities, and manufacturing reliability. That means the biggest losers are not pure-play software vendors, but the industrials, infrastructure operators, and insurers that carry hidden business interruption exposure without pricing for a war-risk profile.

The most important catalyst is a change in frequency distribution, not just severity. Once incidents move from isolated outages to repeated testing of grids, water, transport, and factory systems, boards will be forced into redundant architecture, air-gapped backups, OT segmentation, and higher cyber insurance retentions over the next 6-18 months. That should create a capex tailwind for select security vendors while pressuring margins at regulated utilities and asset-heavy manufacturers that must fund resilience with limited pricing power.

AI is an accelerant on both sides, but the asymmetry favors attackers in the near term because discovery scales faster than remediation. The contrarian read is that the immediate market reaction may overvalue generic cybersecurity names already crowded by secular AI/security narratives; the better risk/reward is in beneficiaries of mandated resilience spend and in shorts of exposed end-markets whose earnings models assume low disruption. If the geopolitical backdrop worsens, the path to upside is via multiple expansion for defense-adjacent cyber providers rather than broad software beta.

Key Decisions for Investors

• Long CRWD / PANW on a 6-12 month horizon into any post-earnings pullback: both should benefit from forced enterprise spending on identity, endpoint, and incident response, but size modestly because the trade is crowded; target 15-20% upside, cut if multiples re-rate further without budget acceleration.
• Long FTNT vs. short regional utilities / infrastructure proxies over 3-9 months: pair cybersecurity budget beneficiaries against operators with high OT exposure and limited pricing power; the short leg is a hedge on rising business interruption and resilience capex.
• Buy call spreads in FSLY-like edge/security-adjacent names only if volume data confirms customer renewals tied to resilience upgrades; avoid chasing broad software because this shock is more about mandatory spend than discretionary IT expansion.
• Short UK/European industrials and logistics-sensitive names with concentrated OT exposure and thin margins for 6-12 months; the risk/reward improves if governments issue more hardening mandates, which compresses near-term free cash flow before benefits accrue.
• Consider a long cyber-defense / short insurance composite basket: long cyber vendors and short insurers with large commercial property and BI books if pricing does not re-rate within the next renewal cycle, since claims inflation from cyber-linked outages is the hidden tail risk.