Data appendix
The indicator set with its sources, the source registers, the licences of every kind of material and the formats of the edition.
Contents
- ·Edition home
- ·Executive summary
- 1The digital layer is where the systems meet
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Provider failure under a ransomware wave
- 6Readings from the other desks
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
B.1The indicator set
| Indicator | Value | Unit | Year | State | Source |
|---|---|---|---|---|---|
| People using the Internet | 74 | % | 2025 | Reported | 48 |
| People using the Internet | 6 | billion | 2025 | Reported | 48 |
| Internet use, high-income countries | 94 | % | 2025 | Reported | 48 |
| Internet use, low-income countries | 23 | % | 2025 | Reported | 48 |
| Population covered by 5G | 55 | % | 2025 | Reported | 48 |
| Complaints to the FBI | 1,008,597 | complaints | 2025 | Reported | 2 |
| Losses reported to the FBI | 20.877 | USD billion | 2025 | Reported | 2 |
| Cryptocurrency investment fraud losses, US | 7.2 | USD billion | 2025 | Reported | 2 |
| Ransomware complaints to the FBI | 3,611 | complaints | 2025 | Reported | 2 |
| On-chain ransomware payments | 820 | USD million | 2025 | Reported | 29 |
| Incidents analysed by ENISA | 4,875 | incidents | 2025 | Reported | 3 |
| Phishing share of observed intrusions, EU | ≈60 | % | 2025 | Reported | 3 |
| Known exploited vulnerabilities in the catalogue | 1,767 | entries | 2026 | Reported | 7 |
| Catalogue entries added | 283 | entries | 2026 | Reported | 7 |
| NVD records published, excluding rejected | 48,150 | records | 2025 | Reported | 8 |
| NVD records published, excluding rejected | 39,953 | records | 2024 | Reported | 8 |
| Countries with a national incident response team | 139 | of 194 | 2024 | Reported | 4 |
| UN Convention against Cybercrime signatories | 96 | signatories | 2026 | Reported | 9 |
| Submarine cable faults | ≈200 | a year | 2026 | Reported | 12 |
| Internet shutdowns recorded | 313 | shutdowns | 2025 | Reported | 27 |
| UK businesses reporting a breach or attack | 43 | % | 2026 | Reported | 28 |
| Survey respondents naming AI vulnerabilities fastest-growing | 87 | % | 2026 | Reported | 5 |
B.2Global source register
The governed source set behind this edition. Each source keeps its authority, coverage, cadence and role; categories describe origin, not truth.
Domains bound by the register
- INF
- DAT
- FIN
- GOV
- HLT
- AIC
- TRD
- WAT
- ENE
- FOO
| Source | Category | Coverage | Period | Cadence | Role |
|---|---|---|---|---|---|
| ITU Facts and Figures 202548 | intergovernmental agency | global | 2025 | annual | connectivity |
| FBI IC3 Annual Report 20252 | law enforcement | United States | 2025 | annual | crime reports |
| ENISA Threat Landscape 20253 | EU agency | EU | 2025 | annual | threat landscape |
| ITU Global Cybersecurity Index 20244 | intergovernmental agency | global | 2024 | periodic | national capacity |
| CISA known exploited vulnerabilities7 | national agency | global entries | 2026 | continuous | exploited flaws |
| UNODC Convention page9 | UN agency | global | 2026 | continuous | treaty status |
| ITU article on cable resilience12 | intergovernmental agency | global | 2026 | one-off | cable faults |
| Access Now KeepItOn report27 | civil society coalition | global | 2025 | annual | shutdowns |
| UK Cyber Security Breaches Survey28 | national government | United Kingdom | 2026 | annual | business prevalence |
| Chainalysis ransomware analysis29 | commercial analytics | global on-chain | 2025 | annual | payments |
B.3Regional reading: the digital layer across ten clusters
Map plates follow with the regional Baseline Editions, when boundary sources and public-safe resolutions are bound. This page gives the regional reading in table form and ranks no region.
| Region | Principal hazards | Systems most exposed | Baseline evidence |
|---|---|---|---|
| North America | victim-reported fraud and ransomware; concentrated cloud providers | finance, health, services | FBI report2 |
| South America | connectivity gaps between and within countries | households, services | ITU Americas range 88 to 93% with CIS and Europe48 |
| Europe | phishing, exploitation, hacktivist denial of service and state-aligned espionage | public administration, transport, finance | ENISA3; EU legal acts192021 |
| Eurasia | connectivity and shutdown records | services, media | ITU48; Access Now27 |
| Middle East and North Africa | Arab States Internet use at 70%; cable routes through shared seas | households, trade | ITU48; cable faults12 |
| Africa | Internet use at 36%; regional cable outages noted by the Internet Society | households, health, services | ITU48; ISOC13 |
| South Asia | shutdown records and fast-growing use | services, households | Access Now27 |
| East Asia | state-sponsored activity named in joint advisories; high connectivity | telecommunications, government | advisories25 |
| ASEAN | scam compounds and cyber-enabled fraud operations | households, finance | UNODC11 |
| Oceania-Pacific | small island dependence on few cables | households, services | ITU48; cable faults12 |
B.4Route card: international submarine cable systems
- cable
- landing point
- repair
- shared route
- Systems in view
- connectivity, finance, health, public services
- Defining facts
- about 200 faults a year; over 99% of international data traffic by the ITU’s estimate, 97 to 98% by the Internet Society’s1213
- Couplings
- INF → FIN payments; INF → HLT records; INF → TRD logistics
- Capability evidence
- ITU and cable industry advisory body formed in 2024; regional repair arrangements under discussion1213
- Gaps
- repair vessel availability; landing point diversity by country
- Agenda items
- C-04 · C-05
The ITU reports that over 80% of cable faults come from fishing and anchoring; the Internet Society states that most disruption is natural or human error [12] [13].
ROUTE
Fishing and anchoring
A region served by few routes shares its connectivity risk, so a local fault can degrade many services.
SECURITY
Concentration
The ITU article and the Internet Society brief are policy analyses, not an attribution of fault to any actor [12] [13].
LEARNING
Public advisories
B.5How countries appear in the cyber and digital systems edition
Countries enter the cyber and digital edition through the digital chapters of their own national editions, on one card grammar. They are read against peer distributions and thresholds, never ranked.
| Card field | What it shows | Source |
|---|---|---|
| WEFH+B state | each core system against peer distribution bands | national edition |
| Couplings | the national dependency matrix | national edition |
| Risk objects | the national risk portfolio | national edition |
| Capability rungs | the national capability ladder | national edition |
| Evidence age | oldest and newest source dates | national source register |
Editions in the 2026 Baseline programme
26national
countries and unions
10regional
clusters
16global
flagship and sector
20frontier
technology reports
How to read a country card
- Each system is shown against the distribution of its peers, with thresholds where they exist
- Couplings and risk objects come from the country’s own national edition
- Capability rungs record evidence, not a judgement of institutions
- Evidence age is printed, so older national data are visible as such
| Wave | Countries and unions | State |
|---|---|---|
| W0 | Canada | ISSUED |
| W1 | United States, United Kingdom, France, Germany, Italy, Japan, European Union, Switzerland | PLANNED |
| W2 | Mexico, Brazil, Argentina, Türkiye, Russian Federation, Saudi Arabia, United Arab Emirates, South Africa, Senegal, Kenya, African Union, India, China, Republic of Korea, Indonesia, Singapore, Australia | PLANNED |
B.6Licences
| Material | Licence |
|---|---|
| Text | CC BY 4.0 |
| Data | on the licence of each source; Nexus tables CC BY 4.0 |
| Figures | Nexus figures CC BY 4.0; third-party as credited |
| Maps | boundary source and licence printed on each plate |
| Metadata | CC0 1.0, as Zenodo publishes it |
| Third-party data, figures and text | The source’s own licence, credited where it is used; never relicensed |
| Nexus-authored text, tables and figures: CC BY 4.0 (SPDX CC-BY-4.0). Map plates print their boundary source and licence. | |
B.7Formats and provenance
| Format | Kind | State | What it is | Identifier |
|---|---|---|---|---|
| Web edition | HTML | On this site | Draft in stewardship review; every value resolves to its source. | NR-SECTOR-CYBER-GLOBAL-2026-BASELINE-v1.0.0 |
| Print edition | At release | A4 portrait · screen, print and archival PDF, signed with the web edition at release. | NR-SECTOR-CYBER-GLOBAL-2026-BASELINE-v1.0.0 | |
| Indicator data | CSV · JSON | On this site | 22 indicators with unit, year, status and source; the machine-readable copy ships with the evidence bundle at release. | NR-SECTOR-CYBER-GLOBAL-2026-BASELINE data release v1 |
| Figures | SVG · PNG | On this site | 4 on the web edition: headline figure, figure 1.3, coupling instrument, capability ladder. | FIG-SECTOR-CYBER-GLOBAL-2026-BASELINE-* |
| Slides | Not recorded | No slide deck is recorded for this edition. | ||
| Evidence brief | HTML · PDF | Not recorded | No evidence brief is recorded for this edition. | |
| Dataset with DOI | DataCite | At release | Concept and version DOI are minted at deposit; none is recorded yet. |
Provenance
- Edition pack
- The edition’s content pack (JSON), from which the print and web editions are built
- Evidence cut
- DC-SECTOR-CYBER-GLOBAL-2026-B0, closed 30 September 2026
- Reproducibility
- sourced values cited; analytical values reproducible from stated parameters
- Self-check
- 14 of 23 at evidence close; a fail on any item blocks release
- Review
- five passes scheduled before release (in Annex C)
- Publisher of record
- The Global Centre for Risk and Innovation (GCRI) for the Nexus Consortium
- Corrections
- Registry correction pathway; upheld corrections are published as notices with a new version
Notes
Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references
- 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
- 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
- 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
- 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
- 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
- 8NIST (ed.), National Vulnerability Database, CVE API version 2.0 (records published in 2024 and in 2025, excluding rejected records, counted by the editors from four quarterly queries per year; 39,953 and 48,150). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
- 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
- 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
- 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
- 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03.back
- 28UK Department for Science, Innovation and Technology and partners (eds.), Cyber Security Breaches Survey 2025/2026 (30 April 2026; survey of businesses and charities). UK Government, London. Observation year 2026 (survey covering the preceding 12 months). Accessed 2026-11-03.back
- 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
- 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
- 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
- 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
- 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
- 25CISA, FBI, NSA and partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, joint cybersecurity advisory (27 August 2025). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
- 11UNODC (ed.), Inflection Point: Global Implications of Scam Centres, Underground Banking and Illicit Online Marketplaces in Southeast Asia (April 2025). United Nations Office on Drugs and Crime, Bangkok. Observation year 2025. Accessed 2026-11-03.back