Methodology
How the edition was made: methods, the model card, the evidence cut and its age, the acceptance record and the glossary.
Contents
- ·Edition home
- ·Executive summary
- 1The digital layer is where the systems meet
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Provider failure under a ransomware wave
- 6Readings from the other desks
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- A.1 Methods
- A.2 Model card, Cyber and Digital Sector Model v0
- A.3 The baseline evidence cut
- A.4 Evidence age and coverage
- A.5 Evidence cards, two anchor sources
- A.6 Publication acceptance record
- A.7 Status words
- A.8 How the edition is made, released and corrected
- A.9 Glossary and abbreviations
- A.10 Technical annex
- BData appendix
- CReferences and record
- ·Complete edition, for print
A.1Methods
The global baseline uses published values and four simple derivations. Each is shown in full so that any reader can reproduce it.
| No. | Derivation | Calculation | Result |
|---|---|---|---|
| (1) | Share of catalogue entries flagged for ransomware use, 3 November 2026 | 361 ÷ 1,767 | ≈20.4% |
| (2) | Growth in NVD records published, 2025 against 2024, excluding rejected records (sum of four quarterly counts each year) | 48,150 ÷ 39,953 | ≈20.5% more |
| (3) | FBI reported ransomware losses against on-chain ransomware payments, 2025 | USD 820 million ÷ USD 32.3 million | ≈25 times, a scope difference, not an error |
| (4) | Countries without a national incident response team, 2024 | 194 − 139 | 55 |
| Strength | Definition |
|---|---|
| STRONG | a disruption in the source system has historically changed the target system’s service or output within one season, in more than one region |
| MODERATE | an effect is documented but buffered or slower |
| WEAK | an effect is plausible but not documented at global scale |
| Label | Rule |
|---|---|
| Reported | value as issued by its source, with year |
| Inferred | reasoned from cited evidence; never a measurement |
| Estimated | Nexus analytical value with stated method |
| Scenario | conditional on stated assumptions |
| Expert input | structured editorial judgement awaiting evidence |
A.2Model card, Cyber and Digital Sector Model v0
- Model ID
- MDL-GS13-CYBER · v0.1
- Purpose
- represent the global digital layer and its couplings to water, energy, food, health and nature
- Family
- graph-based system of systems
- Inputs
- the cited sources of this edition; no proprietary data
- Method
- expert-specified coupling strengths (STRONG · MODERATE · WEAK) from assessments and analogue events
- Validation
- none yet, first validation against federation evidence in 2027
- Uncertainty
- qualitative; strengths are hypotheses, not measurements
- Domain of validity
- global scale; not for asset-, site- or country-level use
- Reproducibility
- strength table and sources published in this edition
20couplings
typed in v0
2strong
documented within one season
4moderate
documented, buffered
14weak
plausible, undocumented
A.3The baseline evidence cut
Every Nexus edition is published from a frozen evidence cut. The global baseline cut is documentary: it pins the exact edition of every source cited. Federation cuts begin with the first national Foundry cuts in 2027.
- Cut ID
- DC-SECTOR-CYBER-GLOBAL-2026-B0
- Type
- baseline documentary cut
- Resolution policy
- pinned · as of 30 September 2026
- Sources pinned
- 48 cited sources, each at the edition and access date in the references
- Model runs
- none at baseline, analytical values are stated with their method
- Digest
- computed at freeze and recorded in the publication record
- Supersedes
- nothing, first cut of the series
- Superseded by
- the 2027 cyber and digital systems annual cut
Lineage
- 01
source edition
- 02
pinned citation
- 03
finding
- 04
page
- 05
publication record
| Element | Baseline 2026 | 2027 global annual |
|---|---|---|
| Sources | cited global publications, pinned by edition | national, regional and sector cuts through one graph |
| Analysis | stated methods and editorial estimates | typed analysis specifications |
| Models | Cyber and Digital Sector Model v0 specification | model runs with receipts |
| Findings | twelve baseline findings | findings re-bound to federation evidence |
| Review | five passes scheduled | five passes on the exact digest |
A.4Evidence age and coverage
A 2026 global edition rests on evidence observed in many different years. This page shows each time base, so that no single year label hides older evidence.
| Indicator | Observed | Released | Cadence | Next release |
|---|---|---|---|---|
| Internet use and coverage | 2025 | November 2025 | annual | next Facts and Figures |
| Victim-reported cybercrime | 2025 | 2026 | annual | next IC3 report |
| Intrusion vectors in the EU | July 2024 to June 2025 | October 2025 | annual | next Threat Landscape |
| Known exploited vulnerabilities | 2021 to 2026 | 3 November 2026 | continuous | continuous |
| National cybersecurity capacity | 2024 | 2024 | periodic | next index |
| Treaty signatures and parties | 2026 | 3 November 2026 | continuous | continuous |
| Submarine cable faults | about 200 a year | February 2026 | one-off | follow-up reports |
| Internet shutdowns | 2025 | March 2026 | annual | next KeepItOn report |
| Ransomware payments | 2025 | February 2026 | annual | next analysis |
| Health ransomware trends | 2016 to 2021 | 2022 | one-off | follow-up studies |
| System | Coverage | Thinnest dimension |
|---|---|---|
| Connectivity | GOOD | quality and affordability by country |
| Crime and fraud | PARTIAL | losses outside the United States |
| Threat landscape | PARTIAL | regions beyond the EU and US |
| Vulnerabilities | GOOD | time to patch, by vendor |
| Governance | GOOD | treaty status after access |
| Critical services | THIN | utility incident data on a common basis |
| Health | PARTIAL | data after 2021 |
| Resilience | PARTIAL | tested capabilities beyond recovery from one update failure |
| Field | Source that would fill it | Blocker |
|---|---|---|
| Global cybercrime losses on one basis | national police and crime agencies; UNODC | the FBI series covers United States victims only and no common global series was found; a commercial figure for illicit crypto receipts33 was seen only in search summaries and is not used |
| Ransomware: reconciliation of claimed attacks, payments and reported losses | Chainalysis29; FBI IC32; national reporting channels | the series use different bases and are not reconciled in this edition |
| Third-party involvement and exploitation shares in breaches, 2026 | Verizon Data Breach Investigations Report 202632 | the report body was not accessible; only search summaries were read and no figure is used |
| Final count of people affected by the 2024 health claims processor breach | US Department of Health and Human Services breach portal; company notice34 | portal and notice not accessible as text; a count seen in search summaries is not used |
| Cyber incidents at utilities, by sector and region | operators, regulators and national authorities | incident data are not published on a common basis; only advisories on compromise were opened26 |
| Time between vulnerability disclosure and exploitation, by vendor | CISA catalogue7; ENISA3 | the catalogue holds dates added, not dates of first exploitation; only ENISA’s statement of exploitation within days is cited |
| Cybersecurity workforce shortfall | ISC2 Cybersecurity Workforce Study6 | the 2025 study states that it includes no estimate of the workforce gap |
| Share of Internet users with digital safety skills | ITU Facts and Figures 202548 | only 88 countries have submitted ICT skills data since 2020, rarely for all skill areas; no global share is published |
| Financial stability losses from cyber incidents | IMF Global Financial Stability Report, April 2024, chapter 335 | the page was not accessible; no figure is used |
| Operation of the UN Global Mechanism after 2026, from the final report text | working group final report A/80/25743 | the report text was not opened; only the General Assembly resolution that endorses it was read10 |
| Treaty ratifications after the access date | UN Treaty Collection; UNODC9 | status changes continuously; the page was read on 3 November 2026 only |
| Application dates of EU acts after any later amendment | Official Journal consolidated versions19202122 | the texts as first published were opened; later amendments were not checked |
| Capability rungs beyond recovery from one update failure and asset freezes | operators, regulators, ministries | not reviewed |
| Cost of a data breach, by sector and region | IBM Cost of a Data Breach Report 202538 | report is gated; not opened and no figure used |
A.5Evidence cards, two anchor sources
Issued by the European Union Agency for Cybersecurity (October 2025) from 4,875 incidents curated from open sources and member state reports. Annual. Role: binds DAT-004 and the intrusion vector figure.
EVD-GS13-001
ENISA Threat Landscape 20253
Compiled by the ITU from official national statistics and ITU estimates (November 2025). Annual. Role: binds INF-001 and the connectivity tiles.
EVD-GS13-002
ITU Facts and Figures 202548
Released 3 November 2026, after the evidence close. Annual. Role: context only. It binds no baseline claim and no figure in this edition.
EVD-GS13-003
ITU Facts and Figures 20261 (post-close, context only)
| Dimension | EVD-GS13-001 | EVD-GS13-002 |
|---|---|---|
| Completeness | open sources and shared reports; not a census | 2025 aggregates are ITU estimates computed with the published method |
| Timeliness | about 4 months after the period ends | weeks after the end of the year |
| Revision | annual edition | annual edition with revised back series |
| Method transparency | methodology published | indicator definitions published |
| External validation | reviewed by national liaison and response teams | member state review |
Evidence cards to follow in 2027
A.6Publication acceptance record
Editorial self-check at evidence close. Every applicable item carries a disposition; the remaining items are review, approval and deposit.
| Group | Area | Items | Pass | N/A | Pending |
|---|---|---|---|---|---|
| D1 | Identity and scope | 8 | 8 | 0 | 0 |
| D2 | Source and data | 12 | 9 | 1 | 2 |
| D3 | Analysis and models | 12 | 3 | 8 | 1 |
| D4 | Findings and claims | 9 | 8 | 0 | 1 |
| D5 | Figures, tables, maps | 10 | 6 | 2 | 2 |
| D6 | Editorial and citations | 10 | 8 | 0 | 2 |
| D7 | Review and approval | 13 | 0 | 0 | 13 |
| D8 | Artefact and design | 12 | 7 | 0 | 5 |
| D9 | Registry and release | 9 | 0 | 0 | 9 |
Publication gate
- Conditions met
- 14 of 23 at evidence close
- Blocking problems
- none recorded
- Open conditions
- reviews, approval of the exact digest, deposit, registry pointer
Not applicable at baseline
- Model runs
- first runs in Q1 2027
- Maps
- plates in Q2 2027
- Waivers
- none
A.7Status words
| Status | What it means |
|---|---|
| Observed | Measured directly and published by the source. |
| Reported | Published statistics of an official or institutional source. |
| Declared | Stated by the body concerned; not independently measured. |
| Estimated | A Nexus estimate from cited evidence, with its method in Annex A. |
| Modelled | Produced by a stated model from cited inputs. |
| Inferred | Reasoned from cited evidence; not measured. |
| Forecast | A projection by the cited source. |
| Simulated | A simulation result under stated assumptions. |
| Scenario | A conditional statement under stated assumptions; never a prediction. |
| Expert input | Expert judgement, recorded with its basis. |
| Candidate | Proposed for a later edition; not yet evidence. |
| Evidence-quality levels (EQL 1 to 5) grade the source behind a value; they are not a score of the subject. | |
A.8How the edition is made, released and corrected
Every edition is built from a sealed evidence cut, reviewed under three keys, signed and deposited before any site shows it as published; corrections go to Nexus Standards as change proposals and feed the next cut.
| Step | What happens | Source |
|---|---|---|
| 01 Evidence arrives from the pillars | Foundry seals observations and indicator series, Universe hands over after-action and scenario findings, and contributions are screened at every gateway, including this site’s. | |
| 02 The cut is sealed | On the cut date the evidence is pinned under one identifier, so anyone can rebuild the edition from exactly what it was built on. | |
| 03 The edition is assembled | The edition is drafted from its template and content pack. Agents may draft; they never publish and never decide. | |
| 04 The keys turn | At the publisher of record the truth key comes first: every value is checked against its source or stated method before the meaning and capital keys turn. No edition moves on until every key has been turned by a named steward. | |
| 05 The gate opens | A named approver releases one exact digest of the edition; any change after this point is a new version, never a silent edit. | |
| 06 Signed and deposited | The PDF, the web edition and the data bundle are signed together with a manifest and an RO-Crate description, and deposited on Zenodo with a concept and a version DOI. | |
| 07 Published on its desk’s site | Only then does the edition show as published on its desk’s Reports site, and the Collection lists it as a part. | |
| 08 Corrections go to Standards | Method and correction findings go to Nexus Standards as change proposals; citations, corrections and new contributions feed the next evidence cut. |
A teaching model of the process, not a forecast and not a record of any run; dates and counts on this page come from the programme record. Sources: Reports governance at GCRI Canada (2026); Zenodo, repository of record for Reports deposits (2026).
Lifecycle, one state at a time: Draft, Computed, Evidence bound, Reviewed, Approved for release, Published, Corrected, Superseded. This edition is a draft.
A.9Glossary and abbreviations
| Term | Meaning |
|---|---|
| Baseline Edition | the inaugural annual edition that fixes the reference state for the series |
| WEFH+B | cyber and digital systems, energy, food, health and biodiversity, the national nexus core |
| Coupling | a typed dependency through which one system transmits to another |
| Protection gap | the share of losses not covered by insurance |
| Capability ladder | LISTED → EXISTS → ADEQUATE → TESTED → DEMONSTRATED |
| EQL | evidence-quality level, 1–5 |
| Evidence cut | a frozen resolution of exact sources and versions |
| NNC · NLC · NWG | National Nexus Consortium · National Leadership Council · National Working Groups |
| Abbreviation | Expansion |
|---|---|
| CIRT | computer incident response team |
| CISA | US Cybersecurity and Infrastructure Security Agency |
| DORA | Digital Operational Resilience Act |
| ENISA | European Union Agency for Cybersecurity |
| FBI IC3 | Federal Bureau of Investigation Internet Crime Complaint Center |
| GCI | Global Cybersecurity Index |
| ITU | International Telecommunication Union |
| KEV | known exploited vulnerabilities |
| NIS2 | second Network and Information Security Directive |
| NVD | National Vulnerability Database |
| OT | operational technology |
| WEF | World Economic Forum |
A.10Technical annex
| Item | Annex | Contents | Status |
|---|---|---|---|
| A.1 | Indicator definitions | the global indicator set, with units and sources | IN THIS EDITION |
| A.2 | Coupling strengths | the twenty-cell matrix and its rationale | IN THIS EDITION |
| A.3 | Scenario specification | SCN-GS13-CPF-01 assumptions and signposts | IN THIS EDITION |
| A.4 | Capability placements | rung evidence for fifteen functions | IN THIS EDITION |
| A.5 | Model diagnostics | first runs and validation | 2027 |
| A.6 | Sensitivity analyses | influence of coupling strengths | 2027 |
| A.7 | Route and exchange notes | cards for the major shared cable routes and exchange points | WITH REGIONAL EDITIONS |
| A.8 | Review statements | pass-by-pass review record | AT RELEASE |
A.1 · indicator definition: national incident response team
- Construct
- a national team with responsibility for responding to cyber incidents, as reported by countries
- Unit
- count of countries
- Method
- country questionnaire compiled by the ITU for the Global Cybersecurity Index
- Source
- ITU Global Cybersecurity Index 20244
- Uncertainty
- self-reported; verified with country focal points where possible
- Known limits
- presence of a team does not measure its capacity, staffing or independence
Notes
Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references
- 33UNVERIFIED, not opened: Chainalysis (ed.), 2026 Crypto Crime Report (illicit receipts of about USD 154 billion in 2025 in search summaries); the page returned an error. Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
- 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
- 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
- 32UNVERIFIED, not opened: Verizon (ed.), 2026 Data Breach Investigations Report (third-party involvement in 48% of breaches and exploitation as 31% of initial access in search summaries; the page opened held no figures). Verizon, New York. Observation year 2025. Accessed 2026-11-03.back
- 34UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, breach portal entry for the Change Healthcare breach (192.7 million individuals in search summaries); the portal opened without the record. HHS OCR, Washington. Observation year 2025. Accessed 2026-11-03.back
- 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
- 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
- 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
- 6ISC2 (ed.), 2025 ISC2 Cybersecurity Workforce Study (December 2025; 16,029 respondents; states that it includes no estimate of the workforce gap). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
- 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
- 35UNVERIFIED, not opened: International Monetary Fund (ed.), Global Financial Stability Report, April 2024, chapter 3 on cyber risk and financial stability; the page returned an access error and no figure is used. IMF, Washington. Observation year 2024. Accessed 2026-11-03.back
- 43UNVERIFIED, not opened: United Nations General Assembly (ed.), Final report of the open-ended working group on security of and in the use of information and communications technologies 2021 to 2025, A/80/257; read only through resolution 80/16 [10]. United Nations, New York. Observation year 2025. Accessed 2026-11-03.back
- 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03.back
- 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
- 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
- 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
- 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
- 22Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), Official Journal of the European Union, 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
- 38UNVERIFIED, not opened: IBM (ed.), Cost of a Data Breach Report 2025; gated and no figure is used. IBM, Armonk. Observation year 2025. Accessed 2026-11-03.back
- 1POST-CLOSE, context only: Post-close, context only: ITU (ed.), Measuring digital development: Facts and Figures 2026 (released 3 November 2026, after the 30 September 2026 evidence close; supports no baseline claim). International Telecommunication Union, Geneva. Observation year 2026 (estimates, with 2025 comparison). Accessed 2026-11-03.back
- 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back