Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems.

S.1Abstract

S.2Key messages

Six readings that frame the cyber and digital systems baseline, and the eight questions this edition answers, each with its status and source.

1. About 6 billion (74%) in 2025; 2.2 billion are offline.⁴⁸

   How many people are online?Reported

2. No global figure exists on one basis. US victims reported USD 20.877 billion in 2025.²

   What does cybercrime cost?Reported

3. Claimed attacks rose 50% in 2025 but on-chain payments fell about 8%.²⁹

   Is ransomware growing?Reported

4. Phishing about 60% and exploitation of vulnerabilities 21.3% in the EU data.³

   How do intrusions begin?Reported

5. 1,767 entries in the catalogue; 361 flagged for ransomware use.⁷

   How exposed are exploited flaws?Reported

6. 139 of 194 countries had a national incident response team in 2024.⁴

   Are states building capacity?Reported

7. A UN treaty opened for signature in 2025; EU duties apply in stages from 2025 to 2027.⁹²⁰²¹

   Is law catching up?Reported

8. A failure at a concentrated provider that coincides with ransomware on health and public services. SCN-GS13-CPF-01

   What will 2027 test first?Expert input

S.3Headline finding

ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-001

In 2025 about 6 billion people use the Internet and 2.2 billion remain offline; use is 94% in high-income countries and 23% in low-income countries.

Connectivity is the precondition for digital services and for the exposure that comes with them. Africa stands at 36% Internet use and least developed countries at 34%. Urban dwellers use the Internet at 85% against 58% for rural dwellers, and 77% of men against 71% of women⁴⁸.

S.4At a glance

S.5What each steward reads in it

S.6What this edition is, and is not

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
2. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
3. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
4. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
5. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
6. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
7. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
8. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
9. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
10. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
11. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
12. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
13. 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03.back

1.1The questions this part answers

Key questions

• Where is cyber and digital systems risk concentrated?
• Which couplings carry cyber and digital systems shocks into other systems?
• Which cyber and digital systems capabilities hold under compound stress?
• What must 2027 evidence measure first?

In this part

• Narrative
• Headline finding
• Lead figure
• Five coupling chapters
• Twelve-domain reading
• Sector screens
• Dependency matrix
• Risk objects
• Capability ladder
• Scenario
• Three lenses
• Portfolio

1.2The argument

1.3Twenty couplings between five systems

The cyber and digital systems-centred matrix types the twenty couplings between the five core systems, read for their cyber and digital systems content. Strengths are Nexus estimates (ESTIMATED) from the cited evidence and analogue events; they set the graph that 2027 evidence will test.

Transmission paths

1. 01

   INF → ENE → HLT

   A digital outage or ransomware event reduces power or hospital systems; clinics lose records and devices.

   Reported 2016 to 2021 health ransomware study²³

2. 02

   INF → ALL

   A faulty update at a concentrated provider disables endpoints across sectors at once.

   Reported 2024 content update failure¹⁴

3. 03

   INF → TRD

   A cable fault or shipping disruption degrades connectivity for regions served by few routes.

   Reported about 200 faults a year¹²¹³

4. 04

   DAT → FIN

   Ransomware and fraud drain finance and interrupt payments.

   Reported FBI losses and on-chain payments²²⁹

5. 05

   AIC → DAT

   AI-supported tools speed phishing and exploitation of known flaws.

   Inferred ENISA and exploit study³²⁴

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
2. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
3. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
4. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
5. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
6. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
7. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
8. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
9. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
10. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
11. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
12. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
13. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
14. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
15. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back

2.1Headline finding

ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-001

In 2025 about 6 billion people use the Internet and 2.2 billion remain offline; use is 94% in high-income countries and 23% in low-income countries.

Implication

Connectivity is the precondition for digital services and for the exposure that comes with them. Africa stands at 36% Internet use and least developed countries at 34%. Urban dwellers use the Internet at 85% against 58% for rural dwellers, and 77% of men against 71% of women⁴⁸.

What would move it

The next ITU estimates, the 2030 connectivity targets in the Global Digital Compact and the pace of affordable mobile data in low-income countries would each move this finding⁴⁸³¹.

2.2Infrastructure

1. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-001

   An estimated 6 billion people (74%) use the Internet in 2025, up from 5.8 billion (71%) in 2024; 2.2 billion remain offline, and use is 94% in high-income countries against 23% in low-income countries.⁴⁸

2. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-005

   The catalogue of known exploited vulnerabilities held 1,767 entries on 3 November 2026, of which 361 are flagged as used in ransomware campaigns; 283 entries were added in 2026 by that date against 245 in 2025. The NVD published 48,150 records in 2025 against 39,953 in 2024, excluding rejected records.⁷⁸

3. ReportedEQL 3NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-008

   Submarine cables suffer about 200 faults a year, over 80% caused by fishing and anchoring according to the ITU, while the Internet Society reports that most are natural or human error; the two issuers also differ on the share of international traffic carried (over 99% against 97 to 98%).¹²¹³

4. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-INF-011

   The vendor’s root cause analysis of the July 2024 content update failure found a mismatch between 21 inputs validated and 20 supplied, which caused an out-of-bounds read and system crashes on endpoints; the World Bank notes that cloud market concentration can pose systemic risks to vital sectors.¹⁴³⁰

2.3Data and digital

1. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-DAT-002

   Victims in the United States filed 1,008,597 complaints with the FBI in 2025 and reported USD 20.877 billion in losses, up 26%; cyber-enabled fraud was 45% of complaints.²

2. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-DAT-004

   ENISA analysed 4,875 incidents from July 2024 to June 2025: phishing opened about 60% of intrusions, exploitation of vulnerabilities 21.3%, and hacktivism made up almost 80% of recorded incidents, mostly low-impact denial of service.³

2.4Finance

1. ReportedEQL 3NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-FIN-003

   On-chain ransomware payments were about USD 820 million in 2025, down about 8%, while claimed attacks rose 50%; the FBI recorded 3,611 ransomware complaints with reported losses of more than USD 32 million. The two series measure different things.²⁹²

2.5Governance

1. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-GOV-006

   The 2024 Global Cybersecurity Index covered 194 countries with an average score of 65.7 out of 100; 139 had a national incident response team and 55 did not, and 46 countries sit in the highest of five tiers.⁴

2. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-GOV-007

   The UN Convention against Cybercrime was adopted on 24 December 2024 and opened for signature on 25 October 2025; at the access date it had 96 signatories and 3 States Parties against the 40 needed for entry into force.⁹¹⁰

2.6Health

1. ReportedEQL 4NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-HLT-009

   From 2016 to 2021, 374 ransomware attacks on US health care delivery organisations exposed the data of nearly 42 million patients; annual attacks rose from 43 to 91 and 44.4% disrupted care.²³

2.7AIC

1. ReportedEQL 3NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-AIC-010

   ENISA reports that AI-supported phishing reportedly made up more than 80% of observed social engineering activity worldwide by early 2025, and in the WEF survey 87% of respondents named AI-related vulnerabilities as the fastest-growing risk; a 2024 preprint found that one model exploited 87% of 15 one-day vulnerabilities.³⁵²⁴

2.8Systemic

1. Expert inputEQL 2NRF-SECTOR-CYBER-GLOBAL-2026-BASELINE-SYS-012

   The leading compound pathway for 2027 testing is a failure at a concentrated digital provider that coincides with a ransomware wave on health and public services and a loss of connectivity. § scenario

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
2. 31United Nations General Assembly (ed.), Global Digital Compact, A/79/L.2 (September 2024). United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
3. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
4. 8NIST (ed.), National Vulnerability Database, CVE API version 2.0 (records published in 2024 and in 2025, excluding rejected records, counted by the editors from four quarterly queries per year; 39,953 and 48,150). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
5. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
6. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
7. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
8. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
9. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
10. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
11. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
12. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
13. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
14. 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03.back
15. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
16. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
17. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back

3.1Where each system stood at evidence close

3.2Domain posture

Each of the twelve coupled domains is read through cyber and digital systems, in words, not scored. The coupling column names the dependency that carries cyber and digital systems risk into each domain.

3.3Sector screens

All sixteen sectors are screened for their dependence on cyber and digital systems, on the same grammar as every national edition. The evidence column describes coverage of the baseline evidence, not the performance of the sector.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
2. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
3. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
4. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
5. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
6. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
7. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
8. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
9. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
10. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
11. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
12. 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03.back
13. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
14. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
15. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
16. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
17. 16NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (13 August 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
18. 17NIST (ed.), Post-Quantum Cryptography standardisation project page (FIPS 203, 204 and 205 published 13 August 2024; HQC selected 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
19. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

1. ReportedEQL 4RSK-GS13-INF-001

   Concentrated provider or software update failure

   Driver

   a faulty update or outage at a provider used across sectors¹⁴

   Exposure

   endpoints, cloud services and managed platforms in many sectors

   Vulnerability

   market concentration and dependence on single vendors³⁰

   Capacity

   staged roll-outs; test environments; vendor root cause reporting¹⁴

   Cascade

   INF → HLT, FIN, TRD

   Horizon

   1 to 3 years

2. ReportedEQL 4RSK-GS13-DAT-002

   Ransomware and extortion against essential services

   Driver

   ransomware-as-a-service, access brokers and extortion³²⁹

   Exposure

   health care, public administration, manufacturing and logistics²³²³

   Vulnerability

   unpatched known flaws; weak backups; thin staffing³⁷

   Capacity

   incident reporting duties; response teams; payment tracing¹⁹²¹

   Cascade

   DAT → HLT, FIN, INF

   Horizon

   1 to 5 years

3. ReportedEQL 3RSK-GS13-INF-003

   Submarine cable and connectivity disruption

   Driver

   fishing, anchoring, natural hazards and hostile acts¹²¹³

   Exposure

   regions served by few routes and landing points

   Vulnerability

   limited repair vessels and long repair times¹³

   Capacity

   route diversity; regional repair arrangements; the ITU advisory body¹²

   Cascade

   INF → FIN, HLT, TRD

   Horizon

   1 to 5 years

4. InferredEQL 3RSK-GS13-AIC-004

   Faster exploitation and AI-supported intrusion

   Driver

   AI-supported phishing and automated exploitation of known flaws³²⁴

   Exposure

   organisations with slow patching and large attack surfaces

   Vulnerability

   days between disclosure and exploitation³

   Capacity

   basic hygiene; patch discipline; AI security assessment, now done by 64% of surveyed organisations⁵

   Cascade

   AIC → DAT → FIN, HLT

   Horizon

   1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence for cyber and digital systems at the global level.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
2. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
3. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
4. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
5. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
6. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
7. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
8. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
9. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
10. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
11. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
12. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back
13. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
14. 15NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
15. 25CISA, FBI, NSA and partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, joint cybersecurity advisory (27 August 2025). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
16. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
17. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
18. 16NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (13 August 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
19. 17NIST (ed.), Post-Quantum Cryptography standardisation project page (FIPS 203, 204 and 205 published 13 August 2024; HQC selected 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
20. 18Moody, D. et al., Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (November 2024; proposes deprecation after 2030 and disallowance after 2035 for quantum-vulnerable algorithms; a draft). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
21. 38UNVERIFIED, not opened: IBM (ed.), Cost of a Data Breach Report 2025; gated and no figure is used. IBM, Armonk. Observation year 2025. Accessed 2026-11-03.back
22. 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03.back
23. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
24. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
25. 6ISC2 (ed.), 2025 ISC2 Cybersecurity Workforce Study (December 2025; 16,029 respondents; states that it includes no estimate of the workforce gap). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back

5.1Assumptions

Scenario SCN-GS13-CPF-01: what is assumed, and what is held constant.

Baseline

the 2026 reference state in this edition

Drivers

a faulty update or outage at a provider used across sectors that coincides with a ransomware wave on health and public services and a loss of connectivity on one regional route

Analogues

the July 2024 content update failure¹⁴; health ransomware attacks of 2016 to 2021²³; cable faults¹²

Interventions

none modelled: the specification describes the unmitigated case

Run state

narrative specification; quantified run scheduled for 2027

5.2The cascade, step by step

1. 1

   INF → ALL

   a faulty update disables endpoints in several sectors at once

   2024

2. 2

   DAT → HLT

   ransomware hits hospitals while recovery teams are busy elsewhere

   2016 to 2021

3. 3

   INF → TRD

   a cable fault cuts redundancy for one region

   annual

4. 4

   INF → ENE

   control and billing systems are degraded or switched to manual operation

   not observed here

5. 5

   DAT → FIN

   payment and fraud handling is interrupted

   2025

6. 6

   HLT → INF

   clinics fall back to paper while data recovery is delayed

   2016 to 2021

5.3The scenario as a table of steps

How the shock in scenario SCN-GS13-CPF-01 would travel through Global Cyber and Digital Systems‘s coupled systems, step by step, under the assumptions the edition states.

A teaching model of a conditional scenario under the edition’s stated assumptions: not a forecast, not a prediction and not a warning. Sources: Global Cyber and Digital Systems 2026, scenario SCN-GS13-CPF-01 (2026); Global Cyber and Digital Systems 2026, references (NR-CIT-1) (2026).

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
2. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
3. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back

6.1The other desks’ editions of this subject

Federation: each desk writes its own edition for the subjects in its remit. Until a desk releases, its edition shows its frame and the reading this edition printed for it.

6.2Three lenses

One edition, read by each steward. The lens of this site comes first.

6.3Standards, Academy and steward contributions

How the Nexus Standards drafts, the Risk Academy and the three stewards feed each quarterly edition for cyber and digital systems. The standards are a preparatory working draft (2026) and are cited as drafts, never as adopted standards.

6.4GCRI reading: the model card

GCRI’s reading of this edition is its model card: what the national model is, what it computes and where it stops. It is printed in full in Annex A, with the methods it belongs to. Annex A, methodology

6.5Global Risks Forum reading: editorial essays

Four signed essays by the Reports editorial team set out the positions this edition takes. They are interpretation, labelled as such; the evidence they draw on is in the findings register.

6.6Global Risks Alliance reading: 2027 cyber and digital systems readiness pack

The registers that open the 2027 global cycle. At baseline each is initialised from this edition.

Publication dispositions

• Publish
• Hold
• Needs evidence
• Restricted
• Superseded

6.7Nexus Standards reading: standards and regulatory watch

Instruments and published guidance that shape the systems in this edition, by status on the retrieval date. The edition assesses no one’s compliance.

• IN FORCE
• ADOPTED
• PUBLISHED · GUIDANCE
• PUBLISHED · VOLUNTARY

6.8Risk Academy reading: literature and evidence review, science and assessments

The review behind this edition covers cyber and digital systems assessments, peer-reviewed science and the institutional reports that bind its findings. Systematic reviews for each agenda item begin in 2027.

Review protocol

Question

What does the published evidence establish about the world’s cyber and digital systems and its couplings?

Sources searched

agency flagships; regulator and national statistical reports; peer-reviewed studies; legal texts

Window

releases available at evidence close, 30 September 2026

Selection

sources that bind or contextualise a finding in this edition

Next step

systematic reviews for agenda items 01 to 05 in 2027

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
2. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
3. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
4. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
5. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
6. 22Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), Official Journal of the European Union, 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
7. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
8. 15NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
9. 16NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (13 August 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
10. 42UNVERIFIED, not opened: IEC (ed.), IEC 62443 series, Security for industrial automation and control systems, cited from memory. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
11. 41UNVERIFIED, not opened: ISO and IEC (eds.), ISO/IEC 27001:2022, Information security management systems: requirements, cited from memory. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
12. 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03.back
13. 17NIST (ed.), Post-Quantum Cryptography standardisation project page (FIPS 203, 204 and 205 published 13 August 2024; HQC selected 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
14. 18Moody, D. et al., Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (November 2024; proposes deprecation after 2030 and disallowance after 2035 for quantum-vulnerable algorithms; a draft). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
15. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
16. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back
17. 45UNVERIFIED, not opened: TeleGeography (ed.), Submarine Cable Map (570 cables in 2025 with 81 planned, as quoted in the Internet Society brief [13]); the source was not opened. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03.back
18. 35UNVERIFIED, not opened: International Monetary Fund (ed.), Global Financial Stability Report, April 2024, chapter 3 on cyber risk and financial stability; the page returned an access error and no figure is used. IMF, Washington. Observation year 2024. Accessed 2026-11-03.back
19. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
20. 1POST-CLOSE, context only: Post-close, context only: ITU (ed.), Measuring digital development: Facts and Figures 2026 (released 3 November 2026, after the 30 September 2026 evidence close; supports no baseline claim). International Telecommunication Union, Geneva. Observation year 2026 (estimates, with 2025 comparison). Accessed 2026-11-03.back
21. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
22. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
23. 11UNODC (ed.), Inflection Point: Global Implications of Scam Centres, Underground Banking and Illicit Online Marketplaces in Southeast Asia (April 2025). United Nations Office on Drugs and Crime, Bangkok. Observation year 2025. Accessed 2026-11-03.back
24. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
25. 31United Nations General Assembly (ed.), Global Digital Compact, A/79/L.2 (September 2024). United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
26. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
27. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
28. 6ISC2 (ed.), 2025 ISC2 Cybersecurity Workforce Study (December 2025; 16,029 respondents; states that it includes no estimate of the workforce gap). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
29. 28UK Department for Science, Innovation and Technology and partners (eds.), Cyber Security Breaches Survey 2025/2026 (30 April 2026; survey of businesses and charities). UK Government, London. Observation year 2026 (survey covering the preceding 12 months). Accessed 2026-11-03.back
30. 33UNVERIFIED, not opened: Chainalysis (ed.), 2026 Crypto Crime Report (illicit receipts of about USD 154 billion in 2025 in search summaries); the page returned an error. Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
31. 32UNVERIFIED, not opened: Verizon (ed.), 2026 Data Breach Investigations Report (third-party involvement in 48% of breaches and exploitation as 31% of initial access in search summaries; the page opened held no figures). Verizon, New York. Observation year 2025. Accessed 2026-11-03.back
32. 38UNVERIFIED, not opened: IBM (ed.), Cost of a Data Breach Report 2025; gated and no figure is used. IBM, Armonk. Observation year 2025. Accessed 2026-11-03.back
33. 36UNVERIFIED, not opened: UK National Cyber Security Centre (ed.), Annual Review 2025; the page address returned not found and no figure is used. NCSC, London. Observation year 2025. Accessed 2026-11-03.back
34. 37UNVERIFIED, not opened: Europol (ed.), Internet Organised Crime Threat Assessment 2025: Steal, deal and repeat; the file returned not found and no figure is used. Europol, The Hague. Observation year 2025. Accessed 2026-11-03.back
35. 39UNVERIFIED, not opened: Microsoft (ed.), Microsoft Digital Defense Report 2025; access denied and no figure is used. Microsoft, Redmond. Observation year 2025. Accessed 2026-11-03.back
36. 47UNVERIFIED, not opened: US Securities and Exchange Commission (ed.), Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, final rule, 2023, cited from memory and no figure is used. SEC, Washington. Observation year 2023. Accessed 2026-11-03.back
37. 40UNVERIFIED, not opened: Council of Europe, Convention on Cybercrime (Budapest Convention), CETS No. 185, 2001, cited from memory; the site blocked access and no figure is used. Council of Europe, Strasbourg. Observation year 2001. Accessed 2026-11-03.back
38. 25CISA, FBI, NSA and partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, joint cybersecurity advisory (27 August 2025). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
39. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
40. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
41. 8NIST (ed.), National Vulnerability Database, CVE API version 2.0 (records published in 2024 and in 2025, excluding rejected records, counted by the editors from four quarterly queries per year; 39,953 and 48,150). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
42. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
43. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
44. 44ITU (ed.), Measuring digital development: Facts and Figures 2025 (released 17 November 2025; pages on Internet use, mobile network coverage, Internet use in urban and rural areas and ICT skills opened, with the press release; 2025 aggregates are ITU estimates). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
45. 46UNVERIFIED, not opened: Dameff, C. et al., Ransomware Attacks, ED Visits and Inpatient Admissions in Targeted and Nearby Hospitals, JAMA, 2024, pages 2129 to 2131; listed in a literature index and the text was not read. American Medical Association, Chicago. Observation year 2024. Accessed 2026-11-03.back

7.1Questions for the operational series

1. C-01

   How would a failure at a concentrated digital provider that coincides with a ransomware wave travel through health, power and public services at once?

   INI-GS13-CPF-01 · provider failure under ransomware; first output: concurrency analysis for six regions.

2. C-02

   Which operational technology and control systems in utilities have incident data on a common basis?

   INI-GS13-OTI-02 · utility incident data; first output: reporting-channel register.

3. C-03

   How do ransomware attacks on health services change care outcomes beyond the 2016 to 2021 study period?

   INI-GS13-HRW-03 · health ransomware and care; first output: data scoping note.

4. C-04

   Which submarine routes and landing points are single points of failure, and where is repair capacity short?

   INI-GS13-CBL-04 · cable routes and repair; first output: route dependence map.

5. C-05

   Where do connectivity gaps coincide with weak cyber capacity, and what would closing them take?

   INI-GS13-GAP-05 · connectivity and capacity; first output: tier-and-access table.

6. C-06

   How are EU reporting duties for incidents and exploited vulnerabilities being used in practice?

   To be admitted in 2027; first output: duty-to-data overlay.

7. C-07

   What is the measured, not surveyed, effect of AI on intrusion speed and volume?

   To be admitted in 2027; first output: scoping note.

8. C-08

   Which cyber capabilities have been tested in real incidents, and which are only planned?

   Cyber capability register; first output: rung evidence for 15 functions.

7.2Portfolio proposed for the Q1 2027 alignment

Five initiatives and one Universe mission candidate are proposed for the 2027 cyber and digital portfolio. They are programme objects: no partner, funder or member is attached to them in this edition.

7.3The pathway

The cyber and digital edition reads national cyber and digital chapters, regional connectivity and incident evidence and the global edition through one governed evidence graph. At baseline the federation is designed; the Canada and global chapters are drafted. This page states what exists today and what comes next.

1. 01

   National cyber and digital chapters

   digital and cyber content of each national edition

   DRAFTED · further national baselines

2. 02

   Route and incident evidence

   shared cables, exchange points and reporting channels

   PLANNED · regional Baseline Editions

3. 03

   Cyber and digital sector model

   the digital layer under the system of systems

   v0 SPECIFIED · v1 with federation evidence

4. 04

   Global and strategic links

   GLB · SR-02 Critical Infrastructure and Lifeline Systems · SR-10 Digital Public Infrastructure and Systemic Cyber Risk

   PLANNED · strategic baselines

5. 05

   Universe

   annual proving environment

   CANDIDATE MISSION · mandate in 2027

6. 06

   Global Cyber and Digital Systems Report

   this series

   BASELINE DRAFT · 2027 annual edition

7. 07

   Evidence and correction

   one graph, many projections

   OPEN · first correction cycle in 2027

7.4Universe 2027: evidence pack for the cyber and digital systems candidate mission

1. 01

   Mandate

2. 02

   Core Build · 1 month

3. 03

   Action · 1 week

4. 04

   Evidence seal

5. 05

   Portfolio correction

6. 06

   Next mandate

Mission

ID

MSN-GS13-2027-01 · Provider failure under ransomware Universe mission

Role spine

Leadership sponsor · Institutional anchor · Mission lead: drawn from national pathways

Receiving actors

to be identified with the mandate

7.5Handoffs and routing

Where the baseline’s findings go next. A handoff routes a finding for awareness, review or work; it transfers no authority.

7.6Feeds and signal register

Escalation routes

• none · keep monitoring
• research question
• project
• risk object
• annual publication
• signal report

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
2. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
3. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
4. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back

8.1Digital systems and water

Treatment, pumping and distribution run on control systems and telemetry. Cyber risk reaches water services through operational technology, and the evidence on incidents is thin.

Related editions

• GLB Global Systems
• GS-02 Energy
• GS-04 Health and One Health
• GS-05 Finance and Economy
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk

8.2Digital systems and energy

Grids and fuel systems run on digital control. A joint advisory reports pre-positioning on networks of energy providers, and the EU treats energy as a sector under its cyber law.

Related editions

• GLB Global Systems
• GS-02 Energy
• GS-04 Health and One Health
• GS-05 Finance and Economy
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk

8.3Digital systems and food

Food systems depend on software for cold chains, traceability, payments and logistics. No consolidated series of digital incidents in food systems was found.

Related editions

• GLB Global Systems
• GS-02 Energy
• GS-04 Health and One Health
• GS-05 Finance and Economy
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk

8.4Digital systems and health

Health services depend on records, devices and connectivity. Ransomware attacks on providers disrupt care and expose patient data, and the best evidence is from the United States.

Related editions

• GLB Global Systems
• GS-02 Energy
• GS-04 Health and One Health
• GS-05 Finance and Economy
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk

8.5Digital systems, nature and extremes

Monitoring networks support nature and weather services, and concentration in providers and routes turns single faults into wide events. Evidence is strongest for the update failure and cable faults, and absent for nature.

Related editions

• GLB Global Systems
• GS-02 Energy
• GS-04 Health and One Health
• GS-05 Finance and Economy
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
2. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
3. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
4. 42UNVERIFIED, not opened: IEC (ed.), IEC 62443 series, Security for industrial automation and control systems, cited from memory. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
5. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
6. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
7. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
8. 34UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, breach portal entry for the Change Healthcare breach (192.7 million individuals in search summaries); the portal opened without the record. HHS OCR, Washington. Observation year 2025. Accessed 2026-11-03.back
9. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
10. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
11. 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03.back
12. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
13. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back

A.1Methods

The global baseline uses published values and four simple derivations. Each is shown in full so that any reader can reproduce it.

A.2Model card, Cyber and Digital Sector Model v0

Model ID

MDL-GS13-CYBER · v0.1

Purpose

represent the global digital layer and its couplings to water, energy, food, health and nature

Family

graph-based system of systems

Inputs

the cited sources of this edition; no proprietary data

Method

expert-specified coupling strengths (STRONG · MODERATE · WEAK) from assessments and analogue events

Validation

none yet, first validation against federation evidence in 2027

Uncertainty

qualitative; strengths are hypotheses, not measurements

Domain of validity

global scale; not for asset-, site- or country-level use

Reproducibility

strength table and sources published in this edition

A.3The baseline evidence cut

Every Nexus edition is published from a frozen evidence cut. The global baseline cut is documentary: it pins the exact edition of every source cited. Federation cuts begin with the first national Foundry cuts in 2027.

Cut ID

DC-SECTOR-CYBER-GLOBAL-2026-B0

Type

baseline documentary cut

Resolution policy

pinned · as of 30 September 2026

Sources pinned

48 cited sources, each at the edition and access date in the references

Model runs

none at baseline, analytical values are stated with their method

Digest

computed at freeze and recorded in the publication record

Supersedes

nothing, first cut of the series

Superseded by

the 2027 cyber and digital systems annual cut

Lineage

1. 01

   source edition

2. 02

   pinned citation

3. 03

   finding

4. 04

   page

5. 05

   publication record

A.4Evidence age and coverage

A 2026 global edition rests on evidence observed in many different years. This page shows each time base, so that no single year label hides older evidence.

A.5Evidence cards, two anchor sources

Evidence cards to follow in 2027

• FBI IC3²: complaints by state and sector tables
• ENISA³: incident dataset by sector
• ITU⁴: country tier table
• CISA⁷: dates of first exploitation, if published

A.6Publication acceptance record

Editorial self-check at evidence close. Every applicable item carries a disposition; the remaining items are review, approval and deposit.

A.7Status words

A.8How the edition is made, released and corrected

Every edition is built from a sealed evidence cut, reviewed under three keys, signed and deposited before any site shows it as published; corrections go to Nexus Standards as change proposals and feed the next cut.

A teaching model of the process, not a forecast and not a record of any run; dates and counts on this page come from the programme record. Sources: Reports governance at GCRI Canada (2026); Zenodo, repository of record for Reports deposits (2026).

Lifecycle, one state at a time: Draft, Computed, Evidence bound, Reviewed, Approved for release, Published, Corrected, Superseded. This edition is a draft.

A.9Glossary and abbreviations

A.10Technical annex

A.1 · indicator definition: national incident response team

Construct

a national team with responsibility for responding to cyber incidents, as reported by countries

Unit

count of countries

Method

country questionnaire compiled by the ITU for the Global Cybersecurity Index

Source

ITU Global Cybersecurity Index 2024⁴

Uncertainty

self-reported; verified with country focal points where possible

Known limits

presence of a team does not measure its capacity, staffing or independence

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 33UNVERIFIED, not opened: Chainalysis (ed.), 2026 Crypto Crime Report (illicit receipts of about USD 154 billion in 2025 in search summaries); the page returned an error. Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
2. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
3. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
4. 32UNVERIFIED, not opened: Verizon (ed.), 2026 Data Breach Investigations Report (third-party involvement in 48% of breaches and exploitation as 31% of initial access in search summaries; the page opened held no figures). Verizon, New York. Observation year 2025. Accessed 2026-11-03.back
5. 34UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, breach portal entry for the Change Healthcare breach (192.7 million individuals in search summaries); the portal opened without the record. HHS OCR, Washington. Observation year 2025. Accessed 2026-11-03.back
6. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
7. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
8. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
9. 6ISC2 (ed.), 2025 ISC2 Cybersecurity Workforce Study (December 2025; 16,029 respondents; states that it includes no estimate of the workforce gap). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
10. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
11. 35UNVERIFIED, not opened: International Monetary Fund (ed.), Global Financial Stability Report, April 2024, chapter 3 on cyber risk and financial stability; the page returned an access error and no figure is used. IMF, Washington. Observation year 2024. Accessed 2026-11-03.back
12. 43UNVERIFIED, not opened: United Nations General Assembly (ed.), Final report of the open-ended working group on security of and in the use of information and communications technologies 2021 to 2025, A/80/257; read only through resolution 80/16 [10]. United Nations, New York. Observation year 2025. Accessed 2026-11-03.back
13. 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03.back
14. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
15. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
16. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
17. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
18. 22Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), Official Journal of the European Union, 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
19. 38UNVERIFIED, not opened: IBM (ed.), Cost of a Data Breach Report 2025; gated and no figure is used. IBM, Armonk. Observation year 2025. Accessed 2026-11-03.back
20. 1POST-CLOSE, context only: Post-close, context only: ITU (ed.), Measuring digital development: Facts and Figures 2026 (released 3 November 2026, after the 30 September 2026 evidence close; supports no baseline claim). International Telecommunication Union, Geneva. Observation year 2026 (estimates, with 2025 comparison). Accessed 2026-11-03.back
21. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back

B.1The indicator set

B.2Global source register

The governed source set behind this edition. Each source keeps its authority, coverage, cadence and role; categories describe origin, not truth.

Domains bound by the register

• INF
• DAT
• FIN
• GOV
• HLT
• AIC
• TRD
• WAT
• ENE
• FOO

B.3Regional reading: the digital layer across ten clusters

Map plates follow with the regional Baseline Editions, when boundary sources and public-safe resolutions are bound. This page gives the regional reading in table form and ranks no region.

B.4Route card: international submarine cable systems

• cable
• landing point
• repair
• shared route

Systems in view

connectivity, finance, health, public services

Defining facts

about 200 faults a year; over 99% of international data traffic by the ITU’s estimate, 97 to 98% by the Internet Society’s¹²¹³

Couplings

INF → FIN payments; INF → HLT records; INF → TRD logistics

Capability evidence

ITU and cable industry advisory body formed in 2024; regional repair arrangements under discussion¹²¹³

Gaps

repair vessel availability; landing point diversity by country

Agenda items

C-04 · C-05

B.5How countries appear in the cyber and digital systems edition

Countries enter the cyber and digital edition through the digital chapters of their own national editions, on one card grammar. They are read against peer distributions and thresholds, never ranked.

Editions in the 2026 Baseline programme

How to read a country card

• Each system is shown against the distribution of its peers, with thresholds where they exist
• Couplings and risk objects come from the country’s own national edition
• Capability rungs record evidence, not a judgement of institutions
• Evidence age is printed, so older national data are visible as such

B.6Licences

B.7Formats and provenance

Provenance

Edition pack

The edition’s content pack (JSON), from which the print and web editions are built

Evidence cut

DC-SECTOR-CYBER-GLOBAL-2026-B0, closed 30 September 2026

Reproducibility

sourced values cited; analytical values reproducible from stated parameters

Self-check

14 of 23 at evidence close; a fail on any item blocks release

Review

five passes scheduled before release (in Annex C)

Publisher of record

GCRI for the Nexus Consortium

Corrections

Registry correction pathway; upheld corrections are published as notices with a new version

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
2. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
3. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
4. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
5. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
6. 8NIST (ed.), National Vulnerability Database, CVE API version 2.0 (records published in 2024 and in 2025, excluding rejected records, counted by the editors from four quarterly queries per year; 39,953 and 48,150). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
7. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
8. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
9. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
10. 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03.back
11. 28UK Department for Science, Innovation and Technology and partners (eds.), Cyber Security Breaches Survey 2025/2026 (30 April 2026; survey of businesses and charities). UK Government, London. Observation year 2026 (survey covering the preceding 12 months). Accessed 2026-11-03.back
12. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
13. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
14. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
15. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
16. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
17. 25CISA, FBI, NSA and partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, joint cybersecurity advisory (27 August 2025). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
18. 11UNODC (ed.), Inflection Point: Global Implications of Scam Centres, Underground Banking and Illicit Online Marketplaces in Southeast Asia (April 2025). United Nations Office on Drugs and Crime, Bangkok. Observation year 2025. Accessed 2026-11-03.back

C.148 sources

NR-CIT-1, editor first. A DOI is linked where the source has one; Nexus records carry a UNI once the catalogue allocates it (NS-1).

1. 1POST-CLOSE, context only: Post-close, context only: ITU (ed.), Measuring digital development: Facts and Figures 2026 (released 3 November 2026, after the 30 September 2026 evidence close; supports no baseline claim). International Telecommunication Union, Geneva. Observation year 2026 (estimates, with 2025 comparison). Accessed 2026-11-03. Cited in chapter 6
2. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
3. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
4. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6
5. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03. Cited in chapter 2, chapter 3, chapter 4, chapter 6
6. 6ISC2 (ed.), 2025 ISC2 Cybersecurity Workforce Study (December 2025; 16,029 respondents; states that it includes no estimate of the workforce gap). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6
7. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7
8. 8NIST (ed.), National Vulnerability Database, CVE API version 2.0 (records published in 2024 and in 2025, excluding rejected records, counted by the editors from four quarterly queries per year; 39,953 and 48,150). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 2, chapter 6
9. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6
10. 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03. Cited in chapter 2, chapter 4, chapter 6
11. 11UNODC (ed.), Inflection Point: Global Implications of Scam Centres, Underground Banking and Illicit Online Marketplaces in Southeast Asia (April 2025). United Nations Office on Drugs and Crime, Bangkok. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
12. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
13. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 4, chapter 6, chapter 7, chapter 8
14. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 8
15. 15NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
16. 16NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (13 August 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
17. 17NIST (ed.), Post-Quantum Cryptography standardisation project page (FIPS 203, 204 and 205 published 13 August 2024; HQC selected 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
18. 18Moody, D. et al., Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (November 2024; proposes deprecation after 2030 and disallowance after 2035 for quantum-vulnerable algorithms; a draft). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
19. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03. Cited in chapter 1, chapter 3, chapter 4, chapter 6, chapter 8
20. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 6, chapter 8
21. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 3, chapter 4, chapter 6
22. 22Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), Official Journal of the European Union, 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
23. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 8
24. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 3, chapter 4, chapter 6
25. 25CISA, FBI, NSA and partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, joint cybersecurity advisory (27 August 2025). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6
26. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
27. 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 3, chapter 8
28. 28UK Department for Science, Innovation and Technology and partners (eds.), Cyber Security Breaches Survey 2025/2026 (30 April 2026; survey of businesses and charities). UK Government, London. Observation year 2026 (survey covering the preceding 12 months). Accessed 2026-11-03. Cited in chapter 6
29. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7
30. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
31. 31United Nations General Assembly (ed.), Global Digital Compact, A/79/L.2 (September 2024). United Nations, New York. Observation year 2024. Accessed 2026-11-03. Cited in chapter 2, chapter 6
32. 32UNVERIFIED, not opened: Verizon (ed.), 2026 Data Breach Investigations Report (third-party involvement in 48% of breaches and exploitation as 31% of initial access in search summaries; the page opened held no figures). Verizon, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
33. 33UNVERIFIED, not opened: Chainalysis (ed.), 2026 Crypto Crime Report (illicit receipts of about USD 154 billion in 2025 in search summaries); the page returned an error. Chainalysis, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
34. 34UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, breach portal entry for the Change Healthcare breach (192.7 million individuals in search summaries); the portal opened without the record. HHS OCR, Washington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 8
35. 35UNVERIFIED, not opened: International Monetary Fund (ed.), Global Financial Stability Report, April 2024, chapter 3 on cyber risk and financial stability; the page returned an access error and no figure is used. IMF, Washington. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
36. 36UNVERIFIED, not opened: UK National Cyber Security Centre (ed.), Annual Review 2025; the page address returned not found and no figure is used. NCSC, London. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
37. 37UNVERIFIED, not opened: Europol (ed.), Internet Organised Crime Threat Assessment 2025: Steal, deal and repeat; the file returned not found and no figure is used. Europol, The Hague. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
38. 38UNVERIFIED, not opened: IBM (ed.), Cost of a Data Breach Report 2025; gated and no figure is used. IBM, Armonk. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6
39. 39UNVERIFIED, not opened: Microsoft (ed.), Microsoft Digital Defense Report 2025; access denied and no figure is used. Microsoft, Redmond. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
40. 40UNVERIFIED, not opened: Council of Europe, Convention on Cybercrime (Budapest Convention), CETS No. 185, 2001, cited from memory; the site blocked access and no figure is used. Council of Europe, Strasbourg. Observation year 2001. Accessed 2026-11-03. Cited in chapter 6
41. 41UNVERIFIED, not opened: ISO and IEC (eds.), ISO/IEC 27001:2022, Information security management systems: requirements, cited from memory. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
42. 42UNVERIFIED, not opened: IEC (ed.), IEC 62443 series, Security for industrial automation and control systems, cited from memory. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6, chapter 8
43. 43UNVERIFIED, not opened: United Nations General Assembly (ed.), Final report of the open-ended working group on security of and in the use of information and communications technologies 2021 to 2025, A/80/257; read only through resolution 80/16 [10]. United Nations, New York. Observation year 2025. Accessed 2026-11-03.
44. 44ITU (ed.), Measuring digital development: Facts and Figures 2025 (released 17 November 2025; pages on Internet use, mobile network coverage, Internet use in urban and rural areas and ICT skills opened, with the press release; 2025 aggregates are ITU estimates). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
45. 45UNVERIFIED, not opened: TeleGeography (ed.), Submarine Cable Map (570 cables in 2025 with 81 planned, as quoted in the Internet Society brief [13]); the source was not opened. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
46. 46UNVERIFIED, not opened: Dameff, C. et al., Ransomware Attacks, ED Visits and Inpatient Admissions in Targeted and Nearby Hospitals, JAMA, 2024, pages 2129 to 2131; listed in a literature index and the text was not read. American Medical Association, Chicago. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
47. 47UNVERIFIED, not opened: US Securities and Exchange Commission (ed.), Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, final rule, 2023, cited from memory and no figure is used. SEC, Washington. Observation year 2023. Accessed 2026-11-03. Cited in chapter 6
48. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6

C.2Publication record

Colophon

Format

A4 portrait · screen, print and archival PDF

Typefaces

Space Grotesk (display) · Geist (text) · IBM Plex Sans Italic (standfirsts) · IBM Plex Mono (data)

Design standard

Reports Foundational Edition, Volume I, Part VII

Accessibility

tagged PDF and HTML targets; text alternatives for every figure

Production

Reports editorial team, GCRI

Release path for this version