Draft, not yet released. In stewardship review. Not indexed until the first approved release.

The digital layer is where the systems meet

Part I describes systems and their couplings. It ranks no country or operator and assesses no authority.

6 min read2 figures1 table15 notesNR-SECTOR-CYBER-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1The digital layer is where the systems meet
    1. 1.1 The questions this part answers
    2. 1.2 The argument
    3. 1.3 Twenty couplings between five systems
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Provider failure under a ransomware wave
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

1.1The questions this part answers

Key questions

  • Where is cyber and digital systems risk concentrated?
  • Which couplings carry cyber and digital systems shocks into other systems?
  • Which cyber and digital systems capabilities hold under compound stress?
  • What must 2027 evidence measure first?

In this part

  • Narrative
  • Headline finding
  • Lead figure
  • Five coupling chapters
  • Twelve-domain reading
  • Sector screens
  • Dependency matrix
  • Risk objects
  • Capability ladder
  • Scenario
  • Three lenses
  • Portfolio

1.2The argument

Digital systems are usually reported as a sector: networks, software, crime. The 2026 evidence reads them as the layer on which almost every other system now runs. Clinics, power and treatment control rooms, payments, logistics and public services all depend on connectivity, software and data1923.

Connection is still unequal. About 6 billion people use the Internet, 2.2 billion do not, and use is 94% in high-income countries against 23% in low-income countries48. Where people connect, crime follows. US victims reported USD 20.877 billion in losses to the FBI in 2025, and phishing opened about 60% of the intrusions that ENISA analysed in Europe23.

Concentration is the structural risk. A single content update with a mismatch between 21 expected and 20 supplied inputs crashed endpoints14, and the World Bank notes that cloud market concentration can pose systemic risks to vital sectors30. Physical routes are also concentrated: about 200 submarine cable faults occur each year12.

Governance is catching up unevenly. 139 of 194 countries had a national incident response team in 20244, a UN treaty opened for signature in October 20259, and EU duties for incident reporting, product security and financial entities apply in stages192021. Evidence on outcomes lags the rules.

Figure 1.1How uneven is connectivity? Internet use by group, 2025 (% of population)

The gap between high-income and low-income countries is 71 percentage points. People who come online late meet the same threats with less capacity: only 88 countries have submitted ICT skills data since 202048.

ItemBar, scaled to the largest valueValue
High-income countries94
Asia-Pacific77
Arab States70
Africa36
Low-income countries23

Source: as cited in the note to this figure. Year 2025.

Figure ID FIG-SECTOR-CYBER-GLOBAL-2026-BASELINE-01-003

2.2billion

people offline, 202548

55%

of the world’s population covered by 5G, 202548

4%

of people in low-income countries covered by 5G48

88countries

submitting ICT skills data since 202048

1.3Twenty couplings between five systems

The cyber and digital systems-centred matrix types the twenty couplings between the five core systems, read for their cyber and digital systems content. Strengths are Nexus estimates (ESTIMATED) from the cited evidence and analogue events; they set the graph that 2027 evidence will test.

Figure 1.2Couplings between the five systems

Each line is one coupling from one system to another, drawn by the strength the edition assigns. Strengths are Nexus estimates from the cited evidence and analogue events.

  • Strong
  • Moderate
  • Weak

Source: this edition’s coupling matrix (Table 1.1); status Estimated.

Table 1.1Coupling matrix: from the row system to the column system
From, toWATENEFOOHLTBIO
WAT Water·MODERATE
shared control networks · pump and cooling load		WEAK
irrigation telemetry		MODERATE
treatment control · clinic supply		WEAK
monitoring sensors
ENE EnergySTRONG
power for treatment and control systems		·MODERATE
cold chain · logistics systems		STRONG
hospital IT · devices · backup power		WEAK
monitoring networks
FOO FoodWEAK
demand telemetry		WEAK
load control		·MODERATE
food safety traceability		WEAK
land data
HLT HealthWEAK
surveillance data		WEAK
load		WEAK
outbreak data		·WEAK
zoonosis data
BIO BiodiversityWEAK
catchment data		WEAK
resource data		WEAK
pest and pollinator data		WEAK
disease data		·
Strength: strong, moderate or weak; a Nexus estimate (status Estimated) from cited evidence and analogue events. The scale is defined in Annex A.

Transmission paths

  1. 01

    INF → ENE → HLT

    A digital outage or ransomware event reduces power or hospital systems; clinics lose records and devices.

    Reported 2016 to 2021 health ransomware study23

  2. 02

    INF → ALL

    A faulty update at a concentrated provider disables endpoints across sectors at once.

    Reported 2024 content update failure14

  3. 03

    INF → TRD

    A cable fault or shipping disruption degrades connectivity for regions served by few routes.

    Reported about 200 faults a year1213

  4. 04

    DAT → FIN

    Ransomware and fraud drain finance and interrupt payments.

    Reported FBI losses and on-chain payments229

  5. 05

    AIC → DAT

    AI-supported tools speed phishing and exploitation of known flaws.

    Inferred ENISA and exploit study324

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
  2. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
  3. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  4. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
  5. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  6. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
  7. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
  8. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
  9. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
  10. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
  11. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
  12. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
  13. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
  14. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
  15. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 1: The digital layer is where the systems meet. In Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems. (Baseline Edition 2026, Report No. NR-SECTOR-CYBER-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Global Cyber and Digital Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskGlobal Sector Risk and Resilience

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices