Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Executive summary

The edition on a few pages: the abstract, the key messages, the headline finding and what each steward reads in it.

5 min read1 figure0 tables12 notesNR-STRATEGIC-DPI-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
    1. S.1 Abstract
    2. S.2 Key messages
    3. S.3 Headline finding
    4. S.4 At a glance
    5. S.5 What each steward reads in it
    6. S.6 What this edition is, and is not
  3. 1Digital systems fail together
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Shared provider failure that overlaps a power or network loss
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

S.1Abstract

Digital public infrastructure is the shared layer that identity, payments and data exchange run on, and that cloud and network providers carry. The 2024 to 2025 evidence shows the same mechanisms at work in very different events. A single software update on 18 July 2024 affected an estimated 8.5 million Windows devices3. A fault in the DNS records for one regional endpoint disrupted many cloud services on 19 and 20 October 20254. A configuration file that grew past a built-in limit disrupted a global edge network on 18 November 20255. Government agencies reported long-lived access to the networks of communications, energy, transport and water operators6 and a global campaign against telecommunications and transport networks7. The UK handled 204 nationally significant incidents in one year, up from 898. The rails carry large flows: UPI processed 20.7 billion transactions in October 202513 and Pix 313.3 million in one day in December 202514. Access is not yet universal: about 2.2 billion people were offline in 202510. This baseline reads these events as mechanisms, not as a list. It ranks no country or provider, attributes no attack and recommends no policy.

S.2Key messages

Six readings that frame the digital public infrastructure baseline, and the eight questions this edition answers, each with its status and source.

  1. Yes: software faults, configuration changes, hazards and hostile access recur across providers.3456

    Do digital failures have common causes?Reported

  2. Through shared dependence on a few software, cloud and edge layers.345

    How do failures spread?Reported

  3. No: agencies describe long-lived access as well as disruption.67

    Is the threat only about outages?Reported

  4. The UK handled 204 nationally significant incidents in one year; ENISA analysed 4,875.81

    How large is the incident load?Reported

  5. UPI reached 20.7 billion transactions in a month; Pix 313.3 million in a day.1314

    How large are the payment rails?Reported

  6. About 2.2 billion people were offline in 2025, mostly in lower-income countries.10

    Who is still outside?Reported

  7. One national data-exchange layer signs and encrypts all outgoing data.15

    Does design help?Reported

  8. A shared provider failure that overlaps a power or network loss. SCN-SR10-DPI-01

    What will 2027 test first?Expert input

S.3Headline finding

ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-006

The UK handled 204 nationally significant incidents from September 2024 to August 2025, up from 89 the year before, and 18 highly significant incidents, up from 12.

Figure S.1UK nationally significant incidents, by reporting year
ItemBar, scaled to the largest valueValue
Sep 2023 to Aug 202489
Sep 2024 to Aug 2025204

Source: NCSC8. Both values as published. The 204 includes the 18 highly significant incidents.

Nationally significant incidents made up 48% of the 429 incidents handled. The count measures what one agency handled and classed, so it is a sign of load on that agency and of reporting practice as much as of threat8.

S.4At a glance

8.5million

devices, July 20243

204incidents

nationally significant, UK8

4,875incidents

ENISA, to June 20251

20.7billion

UPI transactions, October 202513

2.2billion

people offline, 202510

79%

adults with an account, 202512

S.5What each steward reads in it

GCRI · KEY T

Technical Truth

The evidence supports reading digital public infrastructure as one dependent stack.

GRF · KEY M

Public Meaning

For most people digital failure arrives as a card that will not work, an app that will not load or an office that has stopped.

GRA · KEY F

Capital Meaning

Readiness implications only. A single event can carry large losses, as the 2025 manufacturer case shows, and large payment flows run on shared rails.

NEXUS

Synthesis

Digital risk is well described event by event and thinly measured as a system.

S.6What this edition is, and is not

What this edition is

A baseline: the 2026 state of the world’s digital public infrastructure and systemic cyber risk and the couplings through which it carries risk into other systems. It synthesises published evidence and ranks no country, company or asset.

What it is not

Not a cyber-security ranking, a threat attribution, a vulnerability disclosure or an assessment of any provider, operator, regulator or government. Operation, protection and recovery of digital systems rest with owners, operators and competent authorities.

What comes next

National, regional and sector evidence feeds the 2027 digital public infrastructure edition through the federation. Each edition reports what changed against this baseline: observations, source revisions, method changes, scenario updates and corrections.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  4. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  5. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
  6. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
  7. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  8. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  9. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
  10. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  11. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
  12. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back

Cite this summary

Valadbaygi, S. (Ed.). (2026). Executive summary: Executive summary. In Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk (Baseline Edition 2026, Report No. NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Digital Public Infrastructure and Systemic Cyber Risk.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices