Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Systems and sectors at baseline

7 min read0 figures2 tables19 notesNR-SECTOR-CYBER-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1The digital layer is where the systems meet
  4. 2Key findings
  5. 3Systems and sectors at baseline
    1. 3.1 Where each system stood at evidence close
    2. 3.2 Domain posture
    3. 3.3 Sector screens
  6. 4Risks and capability
  7. 5Provider failure under a ransomware wave
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

3.1Where each system stood at evidence close

INF · Connectivity

People using the Internet

74%

6 billion; 2.2 billion offline.

Reported2025ITU48

DAT · Data

Losses reported to the FBI by victims in the United States

20.9USD billion

1,008,597 complaints; losses up 26%.

Reported2025FBI IC32

FIN · Finance

On-chain ransomware payments

820USD million

down about 8%; claimed attacks up 50%.

Reported2025Chainalysis29

INF · Infrastructure

Entries in the known exploited vulnerabilities catalogue

1,767entries

361 flagged as used in ransomware campaigns.

Reported2026CISA7

GOV · Governance

Countries with a national incident response team

139of 194

55 had none or none in progress.

Reported2024ITU4

SYS · Cross-system

Survey respondents naming AI-related vulnerabilities as the fastest-growing risk

87%

perception in an executive survey, not a measured rate.

Reported2026WEF5

3.2Domain posture

Each of the twelve coupled domains is read through cyber and digital systems, in words, not scored. The coupling column names the dependency that carries cyber and digital systems risk into each domain.

Table 3.1Each domain read in words, not scored
DomainPosture at baselineCouplingStatus
WATTreatment, pumping and distribution depend on control systems and telemetry; the EU lists drinking and waste water as sectors under its cyber law, and a joint advisory names the sector among those where state-sponsored actors were found. Incident counts are not consolidated here.INF → WATReported EQL 3
ENEGrid and fuel operations run on digital control; a joint advisory reports pre-positioning on networks of energy providers and the EU lists energy under its cyber law. Operational incident data are not consolidated here.INF → ENEReported EQL 3
FOOCold chains, traceability and logistics run on software; no consolidated series of digital incidents in food systems was found.INF → FOOExpert input EQL 2
HLT374 ransomware attacks on US providers in 2016 to 2021 exposed nearly 42 million patients and 44.4% disrupted care.INF → HLTReported EQL 4
BIOMonitoring networks and sensor data support nature observation; the evidence is not consolidated here.DAT → BIOExpert input EQL 2
CLIWeather and climate services depend on data links and compute; no consolidated cyber evidence for these services was found.DAT → CLIExpert input EQL 2
INFNetworks, cables, devices and software carry the layer: 74% of people online, about 200 cable faults a year and a 2024 update failure show how concentration cascades.the core systemReported EQL 4
FINUSD 20.877 billion in US victim-reported losses; USD 820 million in on-chain ransomware payments; EU financial entities fall under DORA from 17 January 2025.DAT → FINReported EQL 4
DATData are the target and the evidence: incident data are voluntary, partial and not on a common basis worldwide.the core systemReported EQL 4
AICAI changes both attack and defence: reported AI-supported phishing, a survey of fast-growing AI vulnerabilities and an exploit study on one-day flaws; measured effects are thin.AIC → DATReported EQL 3
MINChips, cables and devices rest on materials and manufacturing; no consolidated cyber evidence for these supply chains was found in this edition.MIN → INFExpert input EQL 2
TRDCable routes carry over 97% of international data traffic by two issuers’ estimates; maritime and logistics were a high-value target in the EU threat data.INF ↔ TRDReported EQL 3

3.3Sector screens

All sixteen sectors are screened for their dependence on cyber and digital systems, on the same grammar as every national edition. The evidence column describes coverage of the baseline evidence, not the performance of the sector.

Table 3.2Sectors: baseline evidence and the exposure to watch
CodeSectorBaseline evidenceExposure to watchEvidence coverage
GS-00Cross-systemone digital layer under every system30concentrated provider failurePARTIAL
GS-01Watercontrol systems named in advisories2619treatment control compromiseTHIN
GS-02Energygrid operators fall under EU cyber law1926attack on control systemsTHIN
GS-03Food and Agrifood Systemstraceability and cold-chain software; no serieslogistics outageTHIN
GS-04Health and One Health374 attacks on US providers, 2016 to 202123ransomware and care deliveryPARTIAL
GS-05Finance and EconomyUSD 20.877 billion in US losses2; DORA21payment and fraudPARTIAL
GS-06Development and Humanitarian2.2 billion offline48; 313 shutdowns27access and disconnectionGOOD
GS-07Climate and Earth Systemsno consolidated cyber evidence founddata link lossTHIN
GS-08Disaster and Resilience2024 update failure14; cable faults12cascading outagePARTIAL
GS-09Infrastructure, Transport and Logisticsabout 200 cable faults a year12; maritime targets3route and port disruptionPARTIAL
GS-10Cities and Urban Systemsurban Internet use 85%, rural 58%48service dependenceTHIN
GS-11Biodiversity and Ecosystemsmonitoring networks only; no figuresensor and data lossTHIN
GS-12Earth Observation and Planetary Intelligencespace dependence named by 15% of survey respondents5loss of data linksTHIN
GS-13Cyber and Digital Systemsthis edition; twelve findingsprovider failure under ransomwarePARTIAL
GS-14Policy, Institutions and Governance194 countries in the index4; UN treaty9law and capacity gapsGOOD
GS-15Science and Engineering Frontierpost-quantum standards1617; exploit study24cryptographic transitionPARTIAL

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  2. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
  3. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
  4. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
  5. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
  6. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
  7. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
  8. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
  9. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
  10. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
  11. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
  12. 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03.back
  13. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
  14. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
  15. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  16. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
  17. 16NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (13 August 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  18. 17NIST (ed.), Post-Quantum Cryptography standardisation project page (FIPS 203, 204 and 205 published 13 August 2024; HQC selected 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
  19. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 3: Systems and sectors at baseline. In Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems. (Baseline Edition 2026, Report No. NR-SECTOR-CYBER-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Global Cyber and Digital Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskGlobal Sector Risk and Resilience

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices