Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Digital systems fail together

Part I describes systems and their couplings. It ranks no country or operator and assesses no authority.

5 min read2 figures1 table10 notesNR-STRATEGIC-DPI-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Digital systems fail together
    1. 1.1 The questions this part answers
    2. 1.2 The argument
    3. 1.3 Twenty couplings between five systems
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Shared provider failure that overlaps a power or network loss
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

1.1The questions this part answers

Key questions

  • Where is digital public infrastructure risk concentrated?
  • Which couplings carry digital public infrastructure shocks into other systems?
  • Which digital public infrastructure capabilities hold under compound stress?
  • What must 2027 evidence measure first?

In this part

  • Narrative
  • Headline finding
  • Lead figure
  • Five mechanism chapters
  • Twelve-domain reading
  • Sector screens
  • Dependency matrix
  • Risk objects
  • Capability ladder
  • Scenario
  • Three lenses
  • Portfolio

1.2The argument

Digital public infrastructure is usually discussed by layer: identity, payments, data exchange, cloud, networks. The 2024 and 2025 evidence reads them as one dependent stack. Payments need identity, identity needs data exchange, and all of them run on a few cloud, software and edge providers345.

The causes repeat. A software update in 2024 reached millions of machines in hours3. A DNS fault at one regional endpoint in 2025 disrupted many services4. A configuration file passed a built-in limit in 20255. State-sponsored actors were reported inside operator networks for years6 and across telecommunications networks since at least 20217.

The load is large and growing. The UK handled 204 nationally significant incidents in one year8. UPI reached 20.7 billion transactions in a month and Pix 313.3 million in a day1314. Yet 2.2 billion people remained offline in 202510, so the rails are not yet shared by all.

The edition therefore asks the same four questions of every event: what was the common cause, how did it spread, what was shared, and what threshold was crossed. It makes no attribution and ranks no provider.

Figure 1.1How many people are online and offline? billion people, 2025

About three quarters of people were online in 2025 and 2.2 billion were not, most of them in low and middle income countries. Services that move to digital-only leave the offline group outside10.

ItemBar, scaled to the largest valueValue
People online6
People offline2.2

Source: as cited in the note to this figure. Year 2025.

Figure ID FIG-STRATEGIC-DPI-GLOBAL-2026-BASELINE-01-003

6.0billion

people online, 202510

2.2billion

people offline, 202510

94%

Internet use in high-income countries10

23%

Internet use in low-income countries10

1.3Twenty couplings between five systems

The digital public infrastructure-centred matrix types the twenty couplings between the five core systems, read for their digital public infrastructure content. Strengths are Nexus estimates (ESTIMATED) from the cited evidence and analogue events; they set the graph that 2027 evidence will test.

Figure 1.2Couplings between the five systems

Each line is one coupling from one system to another, drawn by the strength the edition assigns. Strengths are Nexus estimates from the cited evidence and analogue events.

  • Strong
  • Moderate
  • Weak

Source: this edition’s coupling matrix (Table 1.1); status Estimated.

Table 1.1Coupling matrix: from the row system to the column system
From, toWATENEFOOHLTBIO
WAT Water·MODERATE
cooling for data centres		WEAK
irrigation		WEAK
safe supply		WEAK
flows
ENE EnergyMODERATE
pumping · control networks		·MODERATE
payments · logistics · cold chain		STRONG
digital records · hospitals · telecoms		WEAK
land use
FOO FoodWEAK
withdrawals		WEAK
bioenergy		·WEAK
nutrition		WEAK
land conversion
HLT HealthWEAK
workforce		WEAK
workforce		WEAK
labour		·WEAK
residues
BIO BiodiversityWEAK
natural infrastructure		WEAK
hydrology		WEAK
pollination		WEAK
zoonoses		·
Strength: strong, moderate or weak; a Nexus estimate (status Estimated) from cited evidence and analogue events. The scale is defined in Annex A.

Transmission paths

  1. 01

    DAT → INF → FIN

    A software fault spreads through a shared vendor to many operators and their payments.

    Reported 2024 outage3

  2. 02

    INF → DAT

    A DNS fault at one regional endpoint spreads to services that rely on it.

    Reported 2025 cloud event4

  3. 03

    INF → DAT

    A configuration file passes a built-in limit at an edge network and many sites fail.

    Reported 2025 edge event5

  4. 04

    CYB → ENE, WAT

    Long-lived access in operator networks sits beside the control of energy and water systems.

    Reported agency advisory6

  5. 05

    CYB → FIN

    A cyber event at one manufacturer spreads to its supplier network.

    Reported JLR 20259

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  4. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  5. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
  6. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
  7. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  8. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  9. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
  10. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 1: Digital systems fail together. In Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk (Baseline Edition 2026, Report No. NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Digital Public Infrastructure and Systemic Cyber Risk.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices