Intrusion detection continues to represent a formidable obstacle in the safeguarding of contemporary networked systems, especially within essential infrastructures such as smart grids. This investigation assesses three deep learning architectures utilizing the NSL-KDD benchmark dataset emphasizing classification efficacy training efficiency and readiness for practical implementation. All models subjected to evaluation exhibited commendable outcomes, each surpassing 98% accuracy, thereby substantiating the efficacy of deep learning methodologies in the identification of cyber intrusions. Among the analysed methodologies, the Hybrid Model emerged as the most efficacious, attaining an accuracy of 99.01% accompanied by an F1-Score of 99.08%. By amalgamating the sequential learning capabilities of CNN-GRU with the relational feature extraction capabilities of Graph Neural Networks (GNN). the Hybrid Model adeptly captures both temporal dynamics and feature interdependencies within network traffic. This architectural design facilitates the model in achieving an optimal equilibrium between precision (99.35%) and recall (98.82%), thereby reducing both false positives and missed detections—two critical considerations for practical application. Notwithstanding its structural intricacy, the Hybrid Model also exhibited enhanced training efficiency, finalizing the training process in 65.78 seconds through the implementation of frozen base layers and optimized design methodologies. Furthermore, the Receiver Operating Characteristic (ROC) analysis yielded an Area Under the Curve (AUC) of 0.9978, underscoring the model’s nearly flawless aptitude for differentiating between normative and malicious activities. These findings assert that the Hybrid Model not only achieves exemplary performance but is also primed for deployment presenting a scalable and dependable solution for intrusion detection within critical infrastructures. The evidence strongly indicates that hybrid deep learning frameworks possess substantial potential for enhancing cybersecurity resilience in intricate and evolving threat environments.