GCRI · Global challenges
Digital and cyber dependencies
Public services, finance, health care, logistics and energy now run on software, networks, cloud platforms and satellites. A faulty update, a compromised supplier or a regional cloud outage can stop many services at once. The Global Centre for Risk and Innovation (GCRI) maps connected service dependencies and how technology shifts them, so institutions see them before they fail. Part of global challenges.
01Contents
Digital and cyber dependencies in seven parts.
In this dossier7 parts
- 01The challengeDigital dependence is deep, shared and often invisible
- 02Reference framesThe frameworks that define cyber and digital resilience in 2026
- 03How digital failure spreadsMechanisms of propagation, and the measures that describe exposure
- 04GCRI’s partDependency research, not incident response or threat intelligence
- 05What changes with technologyNew capability brings new exposure
- 06How GCRI approaches itDependency evidence, not threat intelligence
- 07Across the programmeGovernance and finance perspectives
02The challenge
Digital dependence is deep, shared and often invisible.
Concentration
Few providers, many users
Cloud regions, operating systems, identity services and payment rails are shared by thousands of organisations.
Supply chains
Software built on software
Open-source components, vendor updates and managed services carry risk from one organisation into many others.
Physical layer
Cables, power and space
Subsea cables, data-centre power and cooling, and satellite timing services link digital risk to physical hazards.
03Reference frames
The frameworks that define cyber and digital resilience in 2026.
| Framework | Body and date | What it sets |
|---|---|---|
| Cybersecurity Framework 2.0 | NIST, 2024 | Six functions (govern, identify, protect, detect, respond, recover) for organising cyber risk management |
| NIS2 Directive | European Union, 2022, applied from October 2024 | Security and incident reporting duties for essential and important entities |
| Cyber Resilience Act | European Union, Regulation 2024/2847, applying in stages to 2027 | Security requirements for products with digital elements across their life |
| Post-quantum cryptography standards FIPS 203, 204 and 205 | NIST, August 2024 | Key encapsulation and signature algorithms intended to resist quantum attack |
| ATT&CK knowledge base | MITRE | A shared vocabulary of adversary techniques used in threat modelling |
These are named as references. GCRI claims no conformity with any of them; organisations assess themselves or are assessed by the competent bodies.
04How digital failure spreads
Mechanisms of propagation, and the measures that describe exposure.
| Mechanism | How it spreads | Measure of exposure |
|---|---|---|
| Faulty update | One defective release reaches every system that installs it automatically | Number of services on one update channel; rollback time in hours |
| Software supply chain compromise | A compromised component or build system passes into many products | Software bill of materials coverage; depth of dependency trees |
| Concentration in shared platforms | Many organisations depend on the same cloud region, identity service or payment rail | Share of critical services hosted in one region or provider class |
| Physical coupling | Subsea cables, data-centre power and cooling, satellite timing | Cable route diversity; hours of backup power; timing holdover duration |
| Harvest now, decrypt later | Encrypted data captured today may be read once quantum computers can break current public-key schemes | Volume and lifetime of data protected only by RSA or elliptic-curve keys |
Incident data are the weakest link. Reporting regimes are new and differ by jurisdiction, many incidents are never disclosed, and annual threat landscapes such as ENISA’s rest on reported cases. Studies state that limit next to every estimate.
05GCRI’s part
Dependency research, not incident response or threat intelligence.
GCRI maps service dependencies, studies propagation and helps public institutions plan migrations such as the move to post-quantum cryptography. It runs no security operations, publishes no vulnerability detail and responds to no incidents; national computer emergency response teams hold that role. Field work sits with the Cybersecurity and Digital Resilience platform and the Digital Public Infrastructure platform.
Public findings are designed for the Exponential Technology series; software and models used in the programme would carry bills of materials and model cards under NS-12 of the proposed Nexus Standards. Helpful contributions are anonymised dependency structures, post-incident reviews an organisation chooses to publish, and migration lessons from cryptographic inventories.
06What changes with technology
New capability brings new exposure.
- AI systems embedded in services add model failure and misuse to existing cyber risk
- Quantum computing is expected to weaken some current public-key cryptography, so long-lived data needs planning now
- Digital public infrastructure widens access and concentrates dependence on identity and payment systems
- Connected industrial control systems bring operational technology within reach of network attacks
07How GCRI approaches it
Dependency evidence, not threat intelligence.
GCRI maps service dependencies, studies how failures propagate and tests resilience options in controlled settings, drawing on cybersecurity and cryptography and safety-critical systems engineering. Field work is organised through the Cybersecurity and Digital Resilience platform and Digital Public Infrastructure platform.
GCRI is not an incident response service and does not monitor networks. Report a vulnerability in a GCRI service to the security address.
08Across the programme
Governance and finance perspectives.
The Global Risks Forum (GRF) examines institutional choices under digital and AI governance. The Global Risks Alliance (GRA) examines financial-sector exposure under cyber and operational risk. See also infrastructure dependencies and the cyber and digital resilience field gateway.
09Sources
Where this page’s references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- NIST Cybersecurity Framework 2.0 (NIST CSWP 29, 2024)
- Directive (EU) 2022/2555 on measures for a high common level of cybersecurity (NIS2)
- Regulation (EU) 2024/2847, the Cyber Resilience Act
- NIST FIPS 203, 204 and 205, post-quantum cryptography standards (NIST, 2024)
- MITRE ATT&CK knowledge base (MITRE, a not-for-profit operator of federally funded research centres)
- ENISA Threat Landscape, annual edition (European Union Agency for Cybersecurity)
- NS-12, Software, model and AI/ML artefacts, a proposed standard
10Questions
Questions and answers.
Can GCRI help during a cyber incident?
No. GCRI does not provide incident response. Contact your national computer emergency response team or your service provider. GCRI’s work is preparatory research and testing.
How do I report a security issue in a GCRI website or service?
Write to the security report form with a description of the issue. Do not include personal data or exploit material beyond what is needed to understand it.
Does GCRI publish vulnerability details?
No. Public pages describe mechanisms and reviewed findings. Sensitive technical detail is handled under agreed terms and is not published.
Why include digital public infrastructure?
Identity, payment and data-exchange systems serve whole populations. Their benefits are large, and so is the effect of their failure, which makes their dependencies a public question.
ReportsContribute
Contribute evidence from this page.
Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
GCRI
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
The Global Centre for Risk and Innovation
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.