The AI reckoning
AI agents will transform business in 2027, bringing new cyber, infrastructure, regulatory and social risks. Explore how organisations can build resilience.
From ports and pipelines to satellites, subsea cables, desalination plants, and data centres, infrastructure is a primary target in the no rules/new rules world. Disruptive and destructive attacks on critical assets signal that the geopolitical gloves are off and that resilience must be a strategic priority for countries and organisations alike in 2027.
Infrastructure assets are concentrated points of critical capability – complex, expensive, and hard to replace. Like AI data centres, imaging satellites, and oil refineries, they are often dual-use, serving both the mainstream economy and the defence industrial base. Increasingly, private companies are developing, owning, or operating these strategic capabilities, sometimes giving them control over domains once regarded as the preserve of states. At the same time, governments are becoming more interventionist about infrastructure they regard as strategically important. This makes them valuable, politically contested – and increasingly strategic – targets.
Recorded number of attacks worldwide on critical infrastructure
In order to play this media, we need your consent to add cookies to your device. Do you accept these cookies? Find out More.
Four key factors will drive rising threats to infrastructure in 2027:
Geopolitics is getting more combative
The number of armed conflicts worldwide is historically high, and state and non-state actors are looking for any edge over their adversaries. Threats against infrastructure are being used as leverage and deterrence. Hybrid and asymmetric attacks target civilian assets to undermine economic growth, social cohesion, and political stability – as well as warfighting ability.
Ownership and control
Governments need private capital and capabilities to build and operate infrastructure, everything from energy networks and data centres to satellites, communications and defence-adjacent infrastructure. At the same time, geopolitical competition is making states less comfortable allowing strategically important capabilities to sit beyond their direct control, particularly where they depend on foreign or privately controlled technology. The result is a more contested boundary between public and private infrastructure, bringing greater scrutiny of ownership, investment and operating rights, and in some markets greater risks of state intervention, forced localisation, changes to concessions or expropriation.
Technology is making it cheaper and easier to attack critical assets
AI can help threat actors analyse targets and identify vulnerabilities, while long-range armed drones, AI-enabled cyber attacks, and gig-working operatives recruited online are putting even hardened assets within range of more threat actors in more locations. The front line is potentially everywhere.
Activism against infrastructure is increasing
From power plants to data centres, activated societies are challenging the social license and operational security of infrastructure projects. It’s not mere NIMBYism: local communities have legitimate environmental, health, and economic concerns.
Source: Seerist
What to do
Infrastructure operators, financers, and insurers should focus on preparation. They need a clear understanding of the changing threat environment, evaluation of plausible scenarios, and active risk management from front-end design through long-term operation to reduce the likelihood or impact of incidents.
Infrastructure customers – companies, civil society groups, and government organisations – should focus on resilience: the ability to maintain operations during periods of disruption.
- Identify dependencies and plan for disruption during periods of geopolitical tension. Then assess disruption impacts and plan contingencies. Redundancy, diversification, self-insurance, and failover protocols are all valid responses to infrastructure concentration risk.
- Assess not only the physical vulnerability of infrastructure, but who ultimately controls the capability, under what political conditions access could change, and what alternatives exist.
- Review threat registers to account for emerging capabilities and methods that make it easier for threat actors to target critical assets.
- In response to increasingly activated social hostility to infrastructure, undertake robust stakeholder engagement before building or buying infrastructure assets.
Explore the Top Risks for business in 2027
The hottest year is coming for us all
Extreme heat will intensify pressure on infrastructure, supply chains and food security. Explore how organisations can adapt and build resilience.
Playing it too safe
Volatility is unavoidable, but opportunity remains. Explore how new markets and emerging frontiers can be pursued with greater confidence.
The AI-human hybrid
As AI moves from advice to decisions, human oversight matters more than ever. Explore how organisations can balance automation with judgement and accountability.
Explore more
Explore the changing global risk landscape
Where is risk rising, falling or changing? Explore our global and regional RiskMap 2027 maps and country risk ratings to see how the operating environment is evolving across the markets that matter to you.
A leadership perspective on 2027
Control Risks CEO Bill Udell looks beyond the individual risks to consider what they mean collectively for leaders making decisions in an increasingly complex global environment, and how businesses can prepare for what comes next.
Work with us
Explore what the RiskMap outlook means for your markets, investments, operations, people and strategic priorities with our experts. From a bespoke briefing to specialist advice, our strategic intelligence and security teams can help you understand your exposure, and make confident business decisions.
