Digital and cyber dependencies
Public services, finance, health care, logistics and energy now run on software, networks, cloud platforms and satellites. That brings efficiency and reach, and it creates new ways for failures to spread: a faulty update, a compromised supplier or a regional cloud outage can stop many services at once. The Global Centre for Risk and Innovation (GCRI) studies connected service vulnerabilities and how technological change shifts them, so that institutions can see their digital dependencies before they fail. This page is part of global challenges.
- 01In briefThe short answer
- 02The challengeDigital dependence is deep, shared and often invisible
- 03What changes with technologyNew capability brings new exposure
- 04How GCRI approaches itDependency evidence, not threat intelligence
- 05Key termsTerms used on this page
- 06Across the programmeGovernance and finance perspectives
GCRI · Institution · service level R0
The short answer.
Digital and cyber dependencies are the reliance of public services, finance, health care, logistics and energy on shared software, networks, cloud platforms and satellites, through which a faulty update, a compromised supplier or a regional outage can stop many services at once. GCRI maps service dependencies and how failures propagate; it publishes dependency evidence, not threat intelligence.
Digital demand and connectivity in Germany.
Urban demand centres and the hubs that anchor digital and data infrastructure, shown for Germany as an example geography for this subject.
Digital dependence is deep, shared and often invisible.
Few providers, many users
Cloud regions, operating systems, identity services and payment rails are shared by thousands of organizations.
Software built on software
Open-source components, vendor updates and managed services carry risk from one organization into many others.
Cables, power and space
Subsea cables, data-centre power and cooling, and satellite timing services link digital risk to physical hazards.
New capability brings new exposure.
- AI systems embedded in services add model failure and misuse to existing cyber risk
- Quantum computing is expected to weaken some current public-key cryptography, so long-lived data needs planning now
- Digital public infrastructure widens access and concentrates dependence on identity and payment systems
- Connected industrial control systems bring operational technology within reach of network attacks
Dependency evidence, not threat intelligence.
GCRI maps service dependencies, studies how failures propagate and tests resilience options in controlled settings, drawing on cybersecurity and cryptography and safety-critical systems engineering. Field work is organized through the Cybersecurity and Digital Resilience platform and Digital Public Infrastructure platform, both in development.
GCRI is not an incident response service and does not monitor networks. Report a vulnerability in a GCRI service to the security address.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Cyber resilience | The ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses and attacks on systems that use cyber resources, in NIST usage. |
| Supply chain attack | An attack that compromises a supplier's product or service to reach its customers. |
| Concentration risk | Exposure arising from many users depending on the same provider or component. |
| Single point of failure | A component or supplier whose loss stops a function because no substitute exists. |
Governance and finance perspectives.
The Global Risks Forum (GRF) examines institutional choices under digital and AI governance. The Global Risks Alliance (GRA) examines financial-sector exposure under cyber and operational risk. See also infrastructure dependencies and the cyber and digital resilience field gateway.
Questions and answers.
Can GCRI help during a cyber incident?
How do I report a security issue in a GCRI website or service?
Does GCRI publish vulnerability details?
Why include digital public infrastructure?
Around GCRI.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.