Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Risks and capability

Four cyber and digital systems risk objects open the portfolio. Order carries no rank. Each is read across driver, exposure, vulnerability, capacity, cascade and consequence.

6 min read0 figures1 table25 notesNR-SECTOR-CYBER-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1The digital layer is where the systems meet
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
    1. 4.1 Risk objects
    2. 4.2 Capability ladder
  7. 5Provider failure under a ransomware wave
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

  1. ReportedEQL 4RSK-GS13-INF-001

    Concentrated provider or software update failure

    Driver
    a faulty update or outage at a provider used across sectors14
    Exposure
    endpoints, cloud services and managed platforms in many sectors
    Vulnerability
    market concentration and dependence on single vendors30
    Capacity
    staged roll-outs; test environments; vendor root cause reporting14
    Cascade
    INF → HLT, FIN, TRD
    Horizon
    1 to 3 years

  2. ReportedEQL 4RSK-GS13-DAT-002

    Ransomware and extortion against essential services

    Driver
    ransomware-as-a-service, access brokers and extortion329
    Exposure
    health care, public administration, manufacturing and logistics2323
    Vulnerability
    unpatched known flaws; weak backups; thin staffing37
    Capacity
    incident reporting duties; response teams; payment tracing1921
    Cascade
    DAT → HLT, FIN, INF
    Horizon
    1 to 5 years

  3. ReportedEQL 3RSK-GS13-INF-003

    Submarine cable and connectivity disruption

    Driver
    fishing, anchoring, natural hazards and hostile acts1213
    Exposure
    regions served by few routes and landing points
    Vulnerability
    limited repair vessels and long repair times13
    Capacity
    route diversity; regional repair arrangements; the ITU advisory body12
    Cascade
    INF → FIN, HLT, TRD
    Horizon
    1 to 5 years

  4. InferredEQL 3RSK-GS13-AIC-004

    Faster exploitation and AI-supported intrusion

    Driver
    AI-supported phishing and automated exploitation of known flaws324
    Exposure
    organisations with slow patching and large attack surfaces
    Vulnerability
    days between disclosure and exploitation3
    Capacity
    basic hygiene; patch discipline; AI security assessment, now done by 64% of surveyed organisations5
    Cascade
    AIC → DAT → FIN, HLT
    Horizon
    1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence for cyber and digital systems at the global level.

Table 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
FunctionRungLevelStrongest public evidence at baseline
Prevention and mitigationEXISTSframeworks and hygiene guidance widespread; implementation uneven153
Monitoring and observationADEQUATEcatalogues of exploited flaws and shared threat data; coverage thin outside the US and Europe73
Early warningEXISTSjoint advisories and vulnerability catalogues; no common global warning standard2526
Preparedness and planningEXISTSnational strategies and response teams in 139 of 194 countries4
Redundancy and reservesLISTEDroute diversity and spare capacity documented; repair capacity short13
ResponseDEMONSTRATEDsensor recovery to about 99% within weeks after the 2024 update failure; asset freezes by the FBI142
Continuity of critical servicesLISTEDsector duties in law; testing under real conditions not consolidated1921
RecoveryDEMONSTRATEDendpoints restored after the 2024 failure; ransomware recovery uneven1423
AdaptationEXISTStransition to post-quantum cryptography standards under way161718
Social protectionLISTEDvictim support and fraud recovery documented but not consolidated
Finance and insuranceLISTEDfinancial-sector resilience law applies from 2025; insurance evidence not opened2138
Institutional coordinationEXISTSEU reporting channels; UN Global Mechanism from 2026; treaty not yet in force10199
Technical infrastructureEXISTS5G covers 55% of people and 3G or better 96%; low-income coverage far lower48
WorkforceLISTEDskills shortages reported; no workforce gap estimate published in 20256
Research capacityADEQUATEstrong applied research and published standards; open incident data thin1624
A capability listed in policy is not a tested one; each rung is the strongest public evidence at baseline.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
  2. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
  3. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  4. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
  5. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
  6. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
  7. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
  8. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
  9. 21Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
  10. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
  11. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
  12. 24Fang, R., Bindu, R., Gupta, A. and Kang, D., LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv preprint 2404.08144, April 2024 (not peer reviewed; 15 vulnerabilities). Cornell University, Ithaca. Observation year 2024. Accessed 2026-11-03.back
  13. 5World Economic Forum (ed.), Global Cybersecurity Outlook 2026 (January 2026; executive survey, perceptions rather than measured rates). World Economic Forum, Geneva. Observation year 2026. Accessed 2026-11-03.back
  14. 15NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  15. 25CISA, FBI, NSA and partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, joint cybersecurity advisory (27 August 2025). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
  16. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
  17. 4ITU (ed.), Global Cybersecurity Index 2024 (fifth edition, collection years 2023 to 2024). International Telecommunication Union, Geneva. Observation year 2024. Accessed 2026-11-03.back
  18. 16NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (13 August 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  19. 17NIST (ed.), Post-Quantum Cryptography standardisation project page (FIPS 203, 204 and 205 published 13 August 2024; HQC selected 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
  20. 18Moody, D. et al., Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (November 2024; proposes deprecation after 2030 and disallowance after 2035 for quantum-vulnerable algorithms; a draft). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  21. 38UNVERIFIED, not opened: IBM (ed.), Cost of a Data Breach Report 2025; gated and no figure is used. IBM, Armonk. Observation year 2025. Accessed 2026-11-03.back
  22. 10United Nations General Assembly (ed.), Resolution 80/16 on the final report of the open-ended working group on security of and in the use of information and communications technologies (endorses A/80/257; Global Mechanism from 2026). United Nations, New York, December 2025. Observation year 2025. Accessed 2026-11-03.back
  23. 9UNODC (ed.), United Nations Convention against Cybercrime, convention page (status: 96 signatories and 3 States Parties at the access date; opened for signature in Hanoi on 25 October 2025). United Nations Office on Drugs and Crime, Vienna. Observation year 2026. Accessed 2026-11-03.back
  24. 48UNVERIFIED, not opened: Cloudflare (ed.), DDoS threat report; the page address returned not found and no figure is used. Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  25. 6ISC2 (ed.), 2025 ISC2 Cybersecurity Workforce Study (December 2025; 16,029 respondents; states that it includes no estimate of the workforce gap). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 4: Risks and capability. In Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems. (Baseline Edition 2026, Report No. NR-SECTOR-CYBER-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Global Cyber and Digital Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskGlobal Sector Risk and Resilience

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices