References and record
Every source the edition rests on, the publication record, the corrections log and the open record.
Contents
- ·Edition home
- ·Executive summary
- 1The digital layer is where the systems meet
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Provider failure under a ransomware wave
- 6Readings from the other desks
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
C.148 sources
NR-CIT-1, editor first. A DOI is linked where the source has one; Nexus records carry a UNI once the catalogue allocates it (NS-1).
- 1POST-CLOSE, context only: Post-close, context only: ITU (ed.), Measuring digital development: Facts and Figures 2026 (released 3 November 2026, after the 30 September 2026 evidence close; supports no baseline claim). International Telecommunication Union, Geneva. Observation year 2026 (estimates, with 2025 comparison). Accessed 2026-11-03. Cited in chapter 6
- 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6
- 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03. Cited in chapter 2, chapter 3, chapter 4, chapter 6
- 6ISC2 (ed.), 2025 ISC2 Cybersecurity Workforce Study (December 2025; 16,029 respondents; states that it includes no estimate of the workforce gap). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7
- 8NIST (ed.), National Vulnerability Database, CVE API version 2.0 (records published in 2024 and in 2025, excluding rejected records, counted by the editors from four quarterly queries per year; 39,953 and 48,150). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 2, chapter 6
- 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6
- 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03. Cited in chapter 2, chapter 4, chapter 6
- 11UNODC (ed.), Inflection Point: Global Implications of Scam Centres, Underground Banking and Illicit Online Marketplaces in Southeast Asia (April 2025). United Nations Office on Drugs and Crime, Bangkok. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
- 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 4, chapter 6, chapter 7, chapter 8
- 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 8
- 15NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 16NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (13 August 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
- 17NIST (ed.), Post-Quantum Cryptography standardisation project page (FIPS 203, 204 and 205 published 13 August 2024; HQC selected 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
- 18Moody, D. et al., Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (November 2024; proposes deprecation after 2030 and disallowance after 2035 for quantum-vulnerable algorithms; a draft). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03. Cited in chapter 1, chapter 3, chapter 4, chapter 6, chapter 8
- 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 6, chapter 8
- 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 3, chapter 4, chapter 6
- 22Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), Official Journal of the European Union, 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
- 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 8
- 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 3, chapter 4, chapter 6
- 25CISA, FBI, NSA and partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, joint cybersecurity advisory (27 August 2025). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
- 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 3, chapter 8
- 28UK Department for Science, Innovation and Technology and partners (eds.), Cyber Security Breaches Survey 2025/2026 (30 April 2026; survey of businesses and charities). UK Government, London. Observation year 2026 (survey covering the preceding 12 months). Accessed 2026-11-03. Cited in chapter 6
- 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7
- 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 31United Nations General Assembly (ed.), Global Digital Compact, A/79/L.2 (September 2024). United Nations, New York. Observation year 2024. Accessed 2026-11-03. Cited in chapter 2, chapter 6
- 32UNVERIFIED, not opened: Verizon (ed.), 2026 Data Breach Investigations Report (third-party involvement in 48% of breaches and exploitation as 31% of initial access in search summaries; the page opened held no figures). Verizon, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 33UNVERIFIED, not opened: Chainalysis (ed.), 2026 Crypto Crime Report (illicit receipts of about USD 154 billion in 2025 in search summaries); the page returned an error. Chainalysis, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 34UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, breach portal entry for the Change Healthcare breach (192.7 million individuals in search summaries); the portal opened without the record. HHS OCR, Washington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 8
- 35UNVERIFIED, not opened: International Monetary Fund (ed.), Global Financial Stability Report, April 2024, chapter 3 on cyber risk and financial stability; the page returned an access error and no figure is used. IMF, Washington. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
- 36UNVERIFIED, not opened: UK National Cyber Security Centre (ed.), Annual Review 2025; the page address returned not found and no figure is used. NCSC, London. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 37UNVERIFIED, not opened: Europol (ed.), Internet Organised Crime Threat Assessment 2025: Steal, deal and repeat; the file returned not found and no figure is used. Europol, The Hague. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 38UNVERIFIED, not opened: IBM (ed.), Cost of a Data Breach Report 2025; gated and no figure is used. IBM, Armonk. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 39UNVERIFIED, not opened: Microsoft (ed.), Microsoft Digital Defense Report 2025; access denied and no figure is used. Microsoft, Redmond. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 40UNVERIFIED, not opened: Council of Europe, Convention on Cybercrime (Budapest Convention), CETS No. 185, 2001, cited from memory; the site blocked access and no figure is used. Council of Europe, Strasbourg. Observation year 2001. Accessed 2026-11-03. Cited in chapter 6
- 41UNVERIFIED, not opened: ISO and IEC (eds.), ISO/IEC 27001:2022, Information security management systems: requirements, cited from memory. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
- 42UNVERIFIED, not opened: IEC (ed.), IEC 62443 series, Security for industrial automation and control systems, cited from memory. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6, chapter 8
- 43UNVERIFIED, not opened: United Nations General Assembly (ed.), Final report of the open-ended working group on security of and in the use of information and communications technologies 2021 to 2025, A/80/257; read only through resolution 80/16 [10]. United Nations, New York. Observation year 2025. Accessed 2026-11-03.
- 44ITU (ed.), Measuring digital development: Facts and Figures 2025 (released 17 November 2025; pages on Internet use, mobile network coverage, Internet use in urban and rural areas and ICT skills opened, with the press release; 2025 aggregates are ITU estimates). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 45UNVERIFIED, not opened: TeleGeography (ed.), Submarine Cable Map (570 cables in 2025 with 81 planned, as quoted in the Internet Society brief [13]); the source was not opened. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 46UNVERIFIED, not opened: Dameff, C. et al., Ransomware Attacks, ED Visits and Inpatient Admissions in Targeted and Nearby Hospitals, JAMA, 2024, pages 2129 to 2131; listed in a literature index and the text was not read. American Medical Association, Chicago. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
- 47UNVERIFIED, not opened: US Securities and Exchange Commission (ed.), Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, final rule, 2023, cited from memory and no figure is used. SEC, Washington. Observation year 2023. Accessed 2026-11-03. Cited in chapter 6
- 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6
C.2Publication record
Publication
- Title
- Global Cyber and digital systems Risk & Resilience Report 2026: Baseline Edition
- Series
- Reports · Global Sector Series GS-13
- Edition
- Baseline Edition 2026 · inaugural annual
- Version
- v1.0.0 · draft for stewardship review
- Publication ID
- NR-SECTOR-CYBER-GLOBAL-2026-BASELINE-v1.0.0
- Evidence close
- 30 September 2026
- Publication date
- October 2026
- DOI
- concept and version DOI at deposit
Publisher
- Publisher of record
- The Global Centre for Risk and Innovation (GCRI), for the Nexus Consortium
- Place
- Toronto
- Editor
- Saeed Valadbaygi, Chief Steward and Managing Editor
- Stewards
- GCRI · technical truth · the Global Risks Forum (GRF) · public meaning · the Global Risks Alliance (GRA) · capital meaning
- Licence
- text CC BY 4.0; data on the terms of each source
- Copyright
- © 2026 GCRI · Nexus Consortium
- Language
- English (en-GB) source edition
- Correspondence
- Registry correction pathway · editorial office
Colophon
- Format
- A4 portrait · screen, print and archival PDF
- Typefaces
- Space Grotesk (display) · Geist (text) · IBM Plex Sans Italic (standfirsts) · IBM Plex Mono (data)
- Design standard
- Reports Foundational Edition, Volume I, Part VII
- Accessibility
- tagged PDF and HTML targets; text alternatives for every figure
- Production
- Reports editorial team, GCRI
Release path for this version
| Step | What happens | When |
|---|---|---|
| Draft | editorial self-check complete at evidence close | October 2026 |
| Steward review | five passes on the exact draft (keys T · M · F · N) | Q4 2026 |
| Approval | publication authority approves the exact digest | before release |
| Deposit | concept and version DOI minted; registry pointer set | at release |
| Succession | the 2027 cyber and digital systems edition reports changes against this baseline | 2027 |
- Current version
- v1.0.0 draft, stewardship review
- Previous edition
- none, first edition of the series
- Next edition
- NR-SECTOR-CYBER-GLOBAL-2027-v1.0.0
- Latest version
- resolve the concept DOI or the registry record
- Correction route
- Registry correction pathway
- Notice types
- erratum · addendum · supersession · withdrawal
C.3Corrections log
0correction notices. No edition has been released yet, so none can be corrected; the log below lists each edition’s current version.
| Edition | Version | Date | State | Change | Notice |
|---|---|---|---|---|---|
| GS-13 | NR-SECTOR-CYBER-GLOBAL-2026-BASELINE-v1.0.0 | October 2026 | Draft | Baseline Edition 2026, inaugural annual edition, | None |
Notice types: erratum, addendum, supersession, withdrawal. A correction is a new version with a published notice; the earlier version stays resolvable, and no edition is ever edited in silence.
C.4Open record
This edition’s open record
- Publication ID
- NR-SECTOR-CYBER-GLOBAL-2026-BASELINE-v1.0.0
- Desk identifier and series alias
- NR-SEC-GS-13-2026-BL
- Collection
- None
- DOI
- Concept and version DOI at deposit, on Zenodo with DataCite metadata
- Versions
- Each correction is a new version (isNewVersionOf); the concept DOI resolves to the latest
- Bundle
- RO-Crate 1.2 with CITATION.cff, CodeMeta and PROV-O provenance; a signed manifest
- Licence
- CC BY 4.0 (SPDX CC-BY-4.0) for original material; metadata CC0 1.0
Credit and identity
- ORCID
- Your iD in the deposit and the contribution record; DataCite can then add the work to your ORCID record
- ROR
- Your organisation by its ROR identifier, never by a typed name alone
- CRediT
- Conceptualization, Data curation, Formal analysis, Investigation, Methodology, Software, Validation, Visualisation, Writing, review and editing
- Account
- None needed to contribute; never a password
Find and follow
Search the open indexes for Global Cyber and Digital Systems; software is cited by its SWHID from Software Heritage, and a quantified scenario run is preregistered on OSF before it is run. Annotation is your choice: Hypothesis opens this page in its own viewer.
Mirrors and harvest
The DOI is canonical. At release each signed bundle is also given an IPFS content identifier and a bloxberg anchor as mirrors; both are listed in the record once they exist. Zenodo exposes every record over OAI-PMH, and reviews and endorsements can arrive through COAR Notify where the repository supports it.
{
"metadata": {
"resource_type": {
"id": "dataset"
},
"title": "Evidence on Global Cyber and Digital Systems for Nexus Reports",
"publication_date": "YYYY-MM-DD",
"creators": [
{
"person_or_org": {
"type": "personal",
"family_name": "Your family name",
"given_name": "Your given name",
"identifiers": [
{
"scheme": "orcid",
"identifier": "0000-0000-0000-0000"
}
]
},
"affiliations": [
{
"id": "ROR identifier of your organisation"
}
]
}
],
"description": "What it is, where its record is kept and how it bears on Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems..",
"rights": [
{
"id": "cc-by-4.0"
}
],
"subjects": [
{
"subject": "Nexus Reports"
},
{
"subject": "Global Cyber and Digital Systems"
},
{
"subject": "Global Sector Report · GS-13"
}
],
"related_identifiers": [
{
"identifier": "https://therisk.global/nexus-reports/editions/gs-13/",
"scheme": "url",
"relation_type": {
"id": "issupplementto"
},
"resource_type": {
"id": "publication-report"
}
}
],
"version": "1.0.0"
},
"custom_fields": {},
"access": {
"record": "public",
"files": "public"
},
"files": {
"enabled": true
},
"parent": {
"communities": {
"default": "nexusreports"
}
}
}C.5Where this edition sits among the six pillars
Foundry seals the evidence and Universe tests it; Reports publishes it; Standards takes its corrections and Academy teaches from it.
- F03 Sealed observations and indicator series Foundry Sealed observations and indicator series behind a profile (closeout).
- F04 After-action and scenario findings for Universe After-action and scenario findings for chapters 10 and 13 (after action review).
- F05 National Portfolio movement for chapter Foundry National Portfolio movement for chapter 11 (after action review).
- Applied in editions Standards Nexus Standards: applied in editions.
- GS-13 edition Reports Global Cyber and Digital Systems 2026, published in every format with its sources, citation and corrections.
- F06 Method and correction findings as change Standards Method and correction findings as change proposals (correction).
- F12 Q4 synthesis informs the next-year Universe Q4 synthesis informs the next-year mandate (renewal).
- Taught in the open Academy Risk Academy: taught in the open.
What Foundry and Universe hand to this edition, and what it hands to Standards, Universe and Academy. From the programme spine; GS-13 is a drafted Baseline Edition, so these handoffs run from its first operational quarter.
| Handoff | Between | What crosses, and when |
|---|---|---|
| F03 | Foundry to Reports | Sealed observations and indicator series behind a profile (closeout). |
| F04 | Universe to Reports | After-action and scenario findings for chapters 10 and 13 (after action review). |
| F05 | Foundry to Reports | National Portfolio movement for chapter 11 (after action review). |
| Ring | Nexus Standards to Reports | Nexus Standards: applied in editions. |
| F06 | Reports to Nexus Standards | Method and correction findings as change proposals (correction). |
| F12 | Reports to Universe | Q4 synthesis informs the next-year mandate (renewal). |
| Ring | Reports to Risk Academy | Risk Academy: taught in the open. |