Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Executive summary

The edition on a few pages: the abstract, the key messages, the headline finding and what each steward reads in it.

6 min read1 figure0 tables13 notesNR-SECTOR-CYBER-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
    1. S.1 Abstract
    2. S.2 Key messages
    3. S.3 Headline finding
    4. S.4 At a glance
    5. S.5 What each steward reads in it
    6. S.6 What this edition is, and is not
  3. 1The digital layer is where the systems meet
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Provider failure under a ransomware wave
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

S.1Abstract

The world enters 2027 with a digital layer that is larger, more concentrated and more contested than at any earlier baseline. An estimated 6 billion people (74%) use the Internet in 2025, yet 2.2 billion remain offline, and use is 94% in high-income countries against 23% in low-income countries48. Crime follows the connection. Victims in the United States reported 1,008,597 complaints and USD 20.877 billion in losses to the FBI in 2025, up 26% in losses2. On-chain ransomware payments fell about 8% to USD 820 million in 2025 while claimed attacks rose 50%29. In Europe, phishing opened about 60% of the intrusions that ENISA analysed and vulnerability exploitation 21.3%3. The catalogue of known exploited vulnerabilities held 1,767 entries on 3 November 20267. Governance is moving: 139 of 194 countries had a national incident response team in 20244, the UN Convention against Cybercrime opened for signature in October 20259, and EU reporting duties for products begin on 11 September 202620. Resilience is the weak point. A single faulty content update crashed endpoints through a mismatch of 21 expected and 20 supplied inputs14, submarine cables suffer about 200 faults a year12, and ransomware disrupted care in 44.4% of US provider attacks studied for 2016 to 202123. This baseline sets out what the evidence supports and where it is thin. It ranks no country and recommends no policy.

S.2Key messages

Six readings that frame the cyber and digital systems baseline, and the eight questions this edition answers, each with its status and source.

  1. About 6 billion (74%) in 2025; 2.2 billion are offline.48

    How many people are online?Reported

  2. No global figure exists on one basis. US victims reported USD 20.877 billion in 2025.2

    What does cybercrime cost?Reported

  3. Claimed attacks rose 50% in 2025 but on-chain payments fell about 8%.29

    Is ransomware growing?Reported

  4. Phishing about 60% and exploitation of vulnerabilities 21.3% in the EU data.3

    How do intrusions begin?Reported

  5. 1,767 entries in the catalogue; 361 flagged for ransomware use.7

    How exposed are exploited flaws?Reported

  6. 139 of 194 countries had a national incident response team in 2024.4

    Are states building capacity?Reported

  7. A UN treaty opened for signature in 2025; EU duties apply in stages from 2025 to 2027.92021

    Is law catching up?Reported

  8. A failure at a concentrated provider that coincides with ransomware on health and public services. SCN-GS13-CPF-01

    What will 2027 test first?Expert input

S.3Headline finding

ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-001

In 2025 about 6 billion people use the Internet and 2.2 billion remain offline; use is 94% in high-income countries and 23% in low-income countries.

Figure S.1Internet use by group, 2025 (% of population)
ItemBar, scaled to the largest valueValue
High-income countries94
World74
Low-income countries23

Source: ITU, Measuring digital development: Facts and Figures 202548.

Connectivity is the precondition for digital services and for the exposure that comes with them. Africa stands at 36% Internet use and least developed countries at 34%. Urban dwellers use the Internet at 85% against 58% for rural dwellers, and 77% of men against 71% of women48.

S.4At a glance

74%

people using the Internet, 202548

20.9USD billion

losses reported to the FBI, 20252

820USD million

on-chain ransomware payments, 202529

4,875incidents

analysed by ENISA, July 2024 to June 20253

1,767entries

known exploited vulnerabilities, 20267

313shutdowns

recorded in 52 countries, 202527

S.5What each steward reads in it

GCRI · KEY T

Technical Truth

The evidence supports reading the digital layer as the coupling layer of the WEFH+B system.

GRF · KEY M

Public Meaning

For most people cyber risk arrives as a scam, a locked hospital system or a service that stops.

GRA · KEY F

Capital Meaning

Readiness implications only. Reported losses are large, ransomware payments are volatile and law now sets reporting duties for financial entities and essential services.

NEXUS

Synthesis

The digital layer is well measured at the level of connection and crime reports and thinly measured at the level of utility incidents, patch speed and outcomes.

S.6What this edition is, and is not

What this edition is

A baseline: the 2026 state of the world’s cyber and digital systems and the couplings through which it carries risk into other systems. It synthesises published evidence and ranks no country, company or asset.

What it is not

Not a ranking of countries or companies, a forecast of attacks, an attribution of any incident, a vulnerability disclosure or an assessment of any operator, vendor, regulator or government. Cybersecurity law, incident response and the operation of networks rest with national authorities, operators and companies.

What comes next

National, regional and sector evidence feeds the 2027 cyber and digital systems edition through the federation. Each edition reports what changed against this baseline: observations, source revisions, method changes, scenario updates and corrections.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  2. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
  3. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
  4. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  5. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
  6. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
  7. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
  8. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
  9. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
  10. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
  11. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
  12. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
  13. 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03.back

Cite this summary

Valadbaygi, S. (Ed.). (2026). Executive summary: Executive summary. In Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems. (Baseline Edition 2026, Report No. NR-SECTOR-CYBER-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Global Cyber and Digital Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskGlobal Sector Risk and Resilience

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices