Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Key findings

Twelve findings carry the cyber and digital systems baseline. They are grouped by coupling and never ranked. Each resolves to its source or, where Nexus analysis is involved, to its stated method.

6 min read1 figure0 tables17 notesNR-SECTOR-CYBER-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1The digital layer is where the systems meet
  4. 2Key findings
    1. 2.1 Headline finding
    2. 2.2 Infrastructure
    3. 2.3 Data and digital
    4. 2.4 Finance
    5. 2.5 Governance
    6. 2.6 Health
    7. 2.7 AIC
    8. 2.8 Systemic
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Provider failure under a ransomware wave
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

2.1Headline finding

ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-001

In 2025 about 6 billion people use the Internet and 2.2 billion remain offline; use is 94% in high-income countries and 23% in low-income countries.

Figure 2.1Internet use by group, 2025 (% of population)
ItemBar, scaled to the largest valueValue
High-income countries94
World74
Low-income countries23

Source: ITU, Measuring digital development: Facts and Figures 202548.

Implication

Connectivity is the precondition for digital services and for the exposure that comes with them. Africa stands at 36% Internet use and least developed countries at 34%. Urban dwellers use the Internet at 85% against 58% for rural dwellers, and 77% of men against 71% of women48.

What would move it

The next ITU estimates, the 2030 connectivity targets in the Global Digital Compact and the pace of affordable mobile data in low-income countries would each move this finding4831.

2.2Infrastructure

  1. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-001

    An estimated 6 billion people (74%) use the Internet in 2025, up from 5.8 billion (71%) in 2024; 2.2 billion remain offline, and use is 94% in high-income countries against 23% in low-income countries.48

  2. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-005

    The catalogue of known exploited vulnerabilities held 1,767 entries on 3 November 2026, of which 361 are flagged as used in ransomware campaigns; 283 entries were added in 2026 by that date against 245 in 2025. The NVD published 48,150 records in 2025 against 39,953 in 2024, excluding rejected records.78

  3. ReportedEQL 3NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-008

    Submarine cables suffer about 200 faults a year, over 80% caused by fishing and anchoring according to the ITU, while the Internet Society reports that most are natural or human error; the two issuers also differ on the share of international traffic carried (over 99% against 97 to 98%).1213

  4. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-011

    The vendor’s root cause analysis of the July 2024 content update failure found a mismatch between 21 inputs validated and 20 supplied, which caused an out-of-bounds read and system crashes on endpoints; the World Bank notes that cloud market concentration can pose systemic risks to vital sectors.1430

2.3Data and digital

  1. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-DAT-002

    Victims in the United States filed 1,008,597 complaints with the FBI in 2025 and reported USD 20.877 billion in losses, up 26%; cyber-enabled fraud was 45% of complaints.2

  2. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-DAT-004

    ENISA analysed 4,875 incidents from July 2024 to June 2025: phishing opened about 60% of intrusions, exploitation of vulnerabilities 21.3%, and hacktivism made up almost 80% of recorded incidents, mostly low-impact denial of service.3

2.4Finance

  1. ReportedEQL 3NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-FIN-003

    On-chain ransomware payments were about USD 820 million in 2025, down about 8%, while claimed attacks rose 50%; the FBI recorded 3,611 ransomware complaints with reported losses of more than USD 32 million. The two series measure different things.292

2.5Governance

  1. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-GOV-006

    The 2024 Global Cybersecurity Index covered 194 countries with an average score of 65.7 out of 100; 139 had a national incident response team and 55 did not, and 46 countries sit in the highest of five tiers.4

  2. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-GOV-007

    The UN Convention against Cybercrime was adopted on 24 December 2024 and opened for signature on 25 October 2025; at the access date it had 96 signatories and 3 States Parties against the 40 needed for entry into force.910

2.6Health

  1. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-HLT-009

    From 2016 to 2021, 374 ransomware attacks on US health care delivery organisations exposed the data of nearly 42 million patients; annual attacks rose from 43 to 91 and 44.4% disrupted care.23

2.7AIC

  1. ReportedEQL 3NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-AIC-010

    ENISA reports that AI-supported phishing reportedly made up more than 80% of observed social engineering activity worldwide by early 2025, and in the WEF survey 87% of respondents named AI-related vulnerabilities as the fastest-growing risk; a 2024 preprint found that one model exploited 87% of 15 one-day vulnerabilities.3524

2.8Systemic

  1. Expert inputEQL 2NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-SYS-012

    The leading compound pathway for 2027 testing is a failure at a concentrated digital provider that coincides with a ransomware wave on health and public services and a loss of connectivity. § scenario

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  2. 31United Nations General Assembly (ed.), Global Digital Compact, A/79/L.2 (September 2024). United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
  3. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
  4. 8NIST (ed.), National Vulnerability Database, CVE API version 2.0 (records published in 2024 and in 2025, excluding rejected records, counted by the editors from four quarterly queries per year; 39,953 and 48,150). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
  5. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
  6. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
  7. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
  8. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
  9. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
  10. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  11. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
  12. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
  13. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
  14. 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03.back
  15. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
  16. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
  17. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 2: Key findings. In Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems. (Baseline Edition 2026, Report No. NR-SECTOR-CYBER-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Global Cyber and Digital Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskGlobal Sector Risk and Resilience

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices