Readings from the other desks
The cyber and digital systems baseline is read through each steward’s lens, then once as a whole. Each lens is a projection of reviewed findings, not a separate argument. The other desks’ own editions of this subject are listed first, as cross-references, not copies.
Contents
- ·Edition home
- ·Executive summary
- 1The digital layer is where the systems meet
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Provider failure under a ransomware wave
- 6Readings from the other desks
- 6.1 The other desks’ editions of this subject
- 6.2 Three lenses
- 6.3 Standards, Academy and steward contributions
- 6.4 GCRI reading: the model card
- 6.5 Global Risks Forum reading: editorial essays
- 6.6 Global Risks Alliance reading: 2027 cyber and digital systems readiness pack
- 6.7 Nexus Standards reading: standards and regulatory watch
- 6.8 Risk Academy reading: literature and evidence review, science and assessments
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
6.1The other desks’ editions of this subject
Federation: each desk writes its own edition for the subjects in its remit. Until a desk releases, its edition shows its frame and the reading this edition printed for it.
| Desk | Edition | State | Identifier |
|---|---|---|---|
| GCRI Systems Evidence | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| GRF Public Deliberation | Outside this desk’s remit | Not in remit | |
| GRA Capital Readiness | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| Standards Progress | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| Academy Capability | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| Index Measurement | Outside this desk’s remit | Not in remit |
6.2Three lenses
One edition, read by each steward. The lens of this site comes first.
GCRI · KEY T
Technical Truth
The evidence supports reading the digital layer as the coupling layer of the WEFH+B system. Connection is spreading, crime follows it, and concentration is the structural risk. Evidence is strongest for connectivity and for US and EU incident data, and weakest for utility incidents and for losses outside the United States.
INF-001 · DAT-004 · INF-011 · SYS-012
GRF · KEY M
Public Meaning
For most people cyber risk arrives as a scam, a locked hospital system or a service that stops. The baseline asks that public debate keep the 2.2 billion people offline in view alongside the security story, and treat digital resilience as shared infrastructure.
INF-001 · DAT-002 · HLT-009
GRA · KEY F
Capital Meaning
Readiness implications only. Reported losses are large, ransomware payments are volatile and law now sets reporting duties for financial entities and essential services22921. These show where finance-readiness evidence will matter. Nothing here is advice, a rating or an approval.
DAT-002 · FIN-003
NEXUS
Synthesis
The digital layer is well measured at the level of connection and crime reports and thinly measured at the level of utility incidents, patch speed and outcomes. The 2027 programme should bind regional route evidence, test provider failure under ransomware, and bind incident data on a common basis.
SYS-012 · C-01 · C-02
6.3Standards, Academy and steward contributions
How the Nexus Standards drafts, the Risk Academy and the three stewards feed each quarterly edition for cyber and digital systems. The standards are a preparatory working draft (2026) and are cited as drafts, never as adopted standards.
| Quarter | Edition | Question | Boundary |
|---|---|---|---|
| Q1 | State and Agenda | What matters this year, and what is the starting position? | observed baseline stays distinct from planned work |
| Q2 | Evidence and Build | What new evidence and capability exist? | a configured capability is not a validated result |
| Q3 | Stress Test and Readiness | What do scenarios and tests show? | simulated loss or performance is not observed impact |
| Q4 | Annual Synthesis and Renewal | What changed in the year, and what renews? | release follows review, not event publicity deadlines |
| Steward or body | Role | Contribution route |
|---|---|---|
| The Global Centre for Risk and Innovation (GCRI Canada) | Lead Institution and Consortium Secretariat; publisher of record; technical truth (key T) | science and practice communities · GCRI gateway |
| The Global Risks Forum (GRF) | leadership, dialogue and the Universe programme; public meaning (key M) | policy, Universe and national adoption · GRF gateway |
| The Global Risks Alliance (GRA) | finance, insurance and development readiness; capital meaning (key F) | finance and insurance · GRA gateway |
| Nexus Standards | preparatory drafts on vocabulary, hazards, indicators and methods | Standards site · working groups HAZ, IND, MTH, FIN, AI |
| Risk Academy | learning pathways tied to the agenda questions | Academy gateway · learning by review |
| Reports sector desks | cyber and digital chapter inputs: GCRI evidence, GRA readiness, NXS standards, RA capability | sector editorial board |
Standards drafts used in this edition
- Risk vocabulary NRS-C1 (424 terms) for terms in the glossary
- Hazard atlas NHS-1 1.1.0 (905 hazards in 120 families) for risk objects
- Seven risk classes: global, catastrophic, existential, emerging, planetary, exponential, frontier-tech
Standards calendar to watch
- Founding calls from 20 October 2026; working groups meet from 5 November 2026
- Inaugural Global Standards Council session, 12 January 2027
- Quarterly reviews in March, June, September and December, aligned with each edition
6.4GCRI reading: the model card
GCRI’s reading of this edition is its model card: what the national model is, what it computes and where it stops. It is printed in full in Annex A, with the methods it belongs to. Annex A, methodology
6.5Global Risks Forum reading: editorial essays
Four signed essays by the Reports editorial team set out the positions this edition takes. They are interpretation, labelled as such; the evidence they draw on is in the findings register.
Every large digital failure this decade has been a health event, a payments event and a services event at once. Treating cyber as a security specialism understates how it carries risk between systems. This edition asks where a digital failure goes next.
EDITORIAL ESSAY · 01
The digital layer is a coupling, not a sector
A single update, a single route or a single platform can reach many sectors. The evidence on concentration is partial and mostly qualitative. Measuring dependence on shared providers and routes is the first adaptation.
EDITORIAL ESSAY · 02
Concentration is the common factor
Reporting duties for incidents, products and financial entities now apply or are scheduled, and a UN treaty has opened for signature. The data to show whether they work will take years to accumulate [9] [19] [20] [21].
EDITORIAL ESSAY · 03
Rules are arriving faster than outcome data
The 2.2 billion people offline and the countries without a national response team sit outside most security debates. Closing the gaps is not separate from resilience; it is part of it.
EDITORIAL ESSAY · 04
Connection is the unfinished half
6.6Global Risks Alliance reading: 2027 cyber and digital systems readiness pack
The registers that open the 2027 global cycle. At baseline each is initialised from this edition.
| Item | Register | State at baseline | First 2027 entry |
|---|---|---|---|
| E1 | Cyber and digital systems risk state delta | baseline set by this edition | changes against the baseline |
| E2 | WEFH+B state delta | five global system readings set | indicator updates and freshness |
| E3 | Agenda and Portfolio movement | eight agenda items · 6 proposed objects | admission decisions |
| E4 | Federation delivery register | national chapters in preparation | national chapters |
| E5 | Consortium capability register | national consortia forming | first contributions |
| E6 | Leadership questions and challenges | none yet | first challenge log |
| E7 | Foundry technical state | national environments prepared | first federation cut |
| E8 | Publication candidates | twelve findings carried forward | PUBLISH · HOLD dispositions |
| E9 | Universe readiness | one candidate mission | admission and role spine |
| E10 | Correction register | none | first federation-wide cycle |
Publication dispositions
- Publish
- Hold
- Needs evidence
- Restricted
- Superseded
6.7Nexus Standards reading: standards and regulatory watch
Instruments and published guidance that shape the systems in this edition, by status on the retrieval date. The edition assesses no one’s compliance.
- IN FORCE
- ADOPTED
- PUBLISHED · GUIDANCE
- PUBLISHED · VOLUNTARY
| Instrument | Body | Scope | Status | Relevance |
|---|---|---|---|---|
| NIS2 Directive (EU) 2022/255519 | European Union | EU | IN FORCE | essential entities |
| Cyber Resilience Act (EU) 2024/284720 | European Union | EU | IN FORCE | products |
| Digital Operational Resilience Act (EU) 2022/255421 | European Union | EU | IN FORCE | financial entities |
| AI Act (EU) 2024/168922 | European Union | EU | IN FORCE | AI systems |
| UN Convention against Cybercrime9 | United Nations | global | ADOPTED 2024 · NOT IN FORCE | cybercrime |
| NIST Cybersecurity Framework 2.015 | NIST | global use | PUBLISHED · VOLUNTARY | governance |
| FIPS 203 module-lattice key encapsulation16 | NIST | US federal | PUBLISHED 2024 | post-quantum |
| IEC 62443 control-system security42 | IEC | global | PUBLISHED · VOLUNTARY | control systems |
| ISO/IEC 27001:202241 | ISO and IEC | global | PUBLISHED · VOLUNTARY | management systems |
Changed since 2024
6.8Risk Academy reading: literature and evidence review, science and assessments
The review behind this edition covers cyber and digital systems assessments, peer-reviewed science and the institutional reports that bind its findings. Systematic reviews for each agenda item begin in 2027.
Review protocol
- Question
- What does the published evidence establish about the world’s cyber and digital systems and its couplings?
- Sources searched
- agency flagships; regulator and national statistical reports; peer-reviewed studies; legal texts
- Window
- releases available at evidence close, 30 September 2026
- Selection
- sources that bind or contextualise a finding in this edition
- Next step
- systematic reviews for agenda items 01 to 05 in 2027
| Reference | Type | Year | Role | Used for |
|---|---|---|---|---|
| Neprash et al.23 | journal article | 2022 | supports | health ransomware trends |
| Fang et al.24 | preprint | 2024 | context | exploit of one-day flaws |
| Dameff et al.45 | journal article | 2024 | context | care effects of ransomware |
| NIST post-quantum project17 | project record | 2025 | context | standardisation status |
| NIST Cybersecurity Framework 2.015 | framework | 2024 | context | governance function |
| IMF Global Financial Stability Report ch. 335 | assessment | 2024 | context | financial-sector cyber risk |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| Facts and Figures 202548 | ITU | 2025 | supports | connectivity |
| Facts and Figures 20261 | ITU | 2026 | post-close, context only | connectivity |
| Global Cybersecurity Index 20244 | ITU | 2024 | supports | national capacity |
| Submarine cable resilience article12 | ITU and ICPC | 2026 | supports | cable faults |
| Inflection Point report11 | UNODC | 2025 | context | scam centres |
| Digital Progress and Trends Report 202530 | World Bank | 2025 | context | compute and concentration |
| Global Digital Compact31 | UN General Assembly | 2024 | context | connectivity commitments |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| Annual Report 20252 | FBI IC3 | 2026 | supports | victim-reported losses |
| Threat Landscape 20253 | ENISA | 2025 | supports | intrusion vectors |
| Global Cybersecurity Outlook 20265 | WEF | 2026 | context | executive survey |
| Workforce Study 20256 | ISC2 | 2025 | context | skills and resources |
| Ransomware analysis 202629 | Chainalysis | 2026 | supports | on-chain payments |
| Cyber Security Breaches Survey 2025/2628 | UK Government | 2026 | supports | business prevalence |
| Crypto Crime Report 202633 | Chainalysis | 2026 | context | not used for a figure |
| Data Breach Investigations Report 202632 | Verizon | 2026 | context | not used for a figure |
| Cost of a Data Breach 202538 | IBM | 2025 | context | not used for a figure |
| Annual Review 202536 | UK NCSC | 2025 | context | not used for a figure |
| Threat Assessment 202537 | Europol | 2025 | context | not used for a figure |
| Digital Defense Report 202539 | Microsoft | 2025 | context | not used for a figure |
| DDoS threat report47 | Cloudflare | 2025 | context | not used for a figure |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| NIS2 Directive19 | European Union | 2022 | supports | incident reporting duties |
| Cyber Resilience Act20 | European Union | 2024 | supports | product duties |
| Digital Operational Resilience Act21 | European Union | 2022 | supports | financial entities |
| AI Act22 | European Union | 2024 | context | AI duties |
| UN Convention against Cybercrime9 | UNODC | 2025 | supports | treaty status |
| Budapest Convention40 | Council of Europe | 2001 | context | earlier treaty |
| Joint advisories2526 | national agencies | 2024 to 2025 | supports | state-sponsored activity |
| Catalogue of known exploited vulnerabilities7 | CISA | 2026 | supports | exploited flaws |
| National Vulnerability Database8 | NIST | 2026 | supports | published records |
| Root cause analysis14 | CrowdStrike | 2024 | supports | update failure |
| Internet Society brief13 | Internet Society | 2025 | supports | cable resilience |
| Mapping of submarine cables44 | TeleGeography | 2025 | context | cable count |
| Incident disclosure rule46 | US SEC | 2023 | context | disclosure duty |
Where the evidence agrees
Notes
Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references
- 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
- 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
- 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
- 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
- 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
- 22Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), Official Journal of the European Union, 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
- 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
- 15NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
- 16NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (13 August 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
- 42UNVERIFIED, not opened: IEC (ed.), IEC 62443 series, Security for industrial automation and control systems, cited from memory. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
- 41UNVERIFIED, not opened: ISO and IEC (eds.), ISO/IEC 27001:2022, Information security management systems: requirements, cited from memory. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
- 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03.back
- 17NIST (ed.), Post-Quantum Cryptography standardisation project page (FIPS 203, 204 and 205 published 13 August 2024; HQC selected 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
- 18Moody, D. et al., Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (November 2024; proposes deprecation after 2030 and disallowance after 2035 for quantum-vulnerable algorithms; a draft). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
- 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
- 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back
- 45UNVERIFIED, not opened: TeleGeography (ed.), Submarine Cable Map (570 cables in 2025 with 81 planned, as quoted in the Internet Society brief [13]); the source was not opened. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03.back
- 35UNVERIFIED, not opened: International Monetary Fund (ed.), Global Financial Stability Report, April 2024, chapter 3 on cyber risk and financial stability; the page returned an access error and no figure is used. IMF, Washington. Observation year 2024. Accessed 2026-11-03.back
- 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
- 1POST-CLOSE, context only: Post-close, context only: ITU (ed.), Measuring digital development: Facts and Figures 2026 (released 3 November 2026, after the 30 September 2026 evidence close; supports no baseline claim). International Telecommunication Union, Geneva. Observation year 2026 (estimates, with 2025 comparison). Accessed 2026-11-03.back
- 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
- 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
- 11UNODC (ed.), Inflection Point: Global Implications of Scam Centres, Underground Banking and Illicit Online Marketplaces in Southeast Asia (April 2025). United Nations Office on Drugs and Crime, Bangkok. Observation year 2025. Accessed 2026-11-03.back
- 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
- 31United Nations General Assembly (ed.), Global Digital Compact, A/79/L.2 (September 2024). United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
- 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
- 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
- 6ISC2 (ed.), 2025 ISC2 Cybersecurity Workforce Study (December 2025; 16,029 respondents; states that it includes no estimate of the workforce gap). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
- 28UK Department for Science, Innovation and Technology and partners (eds.), Cyber Security Breaches Survey 2025/2026 (30 April 2026; survey of businesses and charities). UK Government, London. Observation year 2026 (survey covering the preceding 12 months). Accessed 2026-11-03.back
- 33UNVERIFIED, not opened: Chainalysis (ed.), 2026 Crypto Crime Report (illicit receipts of about USD 154 billion in 2025 in search summaries); the page returned an error. Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
- 32UNVERIFIED, not opened: Verizon (ed.), 2026 Data Breach Investigations Report (third-party involvement in 48% of breaches and exploitation as 31% of initial access in search summaries; the page opened held no figures). Verizon, New York. Observation year 2025. Accessed 2026-11-03.back
- 38UNVERIFIED, not opened: IBM (ed.), Cost of a Data Breach Report 2025; gated and no figure is used. IBM, Armonk. Observation year 2025. Accessed 2026-11-03.back
- 36UNVERIFIED, not opened: UK National Cyber Security Centre (ed.), Annual Review 2025; the page address returned not found and no figure is used. NCSC, London. Observation year 2025. Accessed 2026-11-03.back
- 37UNVERIFIED, not opened: Europol (ed.), Internet Organised Crime Threat Assessment 2025: Steal, deal and repeat; the file returned not found and no figure is used. Europol, The Hague. Observation year 2025. Accessed 2026-11-03.back
- 39UNVERIFIED, not opened: Microsoft (ed.), Microsoft Digital Defense Report 2025; access denied and no figure is used. Microsoft, Redmond. Observation year 2025. Accessed 2026-11-03.back
- 47UNVERIFIED, not opened: US Securities and Exchange Commission (ed.), Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, final rule, 2023, cited from memory and no figure is used. SEC, Washington. Observation year 2023. Accessed 2026-11-03.back
- 40UNVERIFIED, not opened: Council of Europe, Convention on Cybercrime (Budapest Convention), CETS No. 185, 2001, cited from memory; the site blocked access and no figure is used. Council of Europe, Strasbourg. Observation year 2001. Accessed 2026-11-03.back
- 25CISA, FBI, NSA and partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, joint cybersecurity advisory (27 August 2025). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
- 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
- 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
- 8NIST (ed.), National Vulnerability Database, CVE API version 2.0 (records published in 2024 and in 2025, excluding rejected records, counted by the editors from four quarterly queries per year; 39,953 and 48,150). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
- 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
- 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
- 44ITU (ed.), Measuring digital development: Facts and Figures 2025 (released 17 November 2025; pages on Internet use, mobile network coverage, Internet use in urban and rural areas and ICT skills opened, with the press release; 2025 aggregates are ITU estimates). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
- 46UNVERIFIED, not opened: Dameff, C. et al., Ransomware Attacks, ED Visits and Inpatient Admissions in Targeted and Nearby Hospitals, JAMA, 2024, pages 2129 to 2131; listed in a literature index and the text was not read. American Medical Association, Chicago. Observation year 2024. Accessed 2026-11-03.back