Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Systems in depth

One section per system: its state at evidence close, its exposures and what the operational series will watch.

7 min read0 figures5 tables13 notesNR-SECTOR-CYBER-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1The digital layer is where the systems meet
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Provider failure under a ransomware wave
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
    1. 8.1 Digital systems and water
    2. 8.2 Digital systems and energy
    3. 8.3 Digital systems and food
    4. 8.4 Digital systems and health
    5. 8.5 Digital systems, nature and extremes
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

8.1Digital systems and water

Treatment, pumping and distribution run on control systems and telemetry. Cyber risk reaches water services through operational technology, and the evidence on incidents is thin.

4sectors

named as primary compromise targets in a joint advisory, including water and wastewater26

2sectors

drinking water and waste water listed in the EU cyber directive19

0series

consolidated incident series found for water utilities

Table 8.1State at baseline
ComponentStateEvidenceStatus
Advisory evidenceUS and allied agencies confirm compromise of IT environments in communications, energy, transport and water sectors26Reported
Legal coveragedrinking water and waste water are sectors under the EU directive with reporting duties19Reported
Incident datano common-basis series for utility incidents3Expert input
Control system practicestandards exist; adoption not consolidated42Inferred

Couplings

  • ENE → WAT power for control systems
  • WAT → ENE shared control networks
  • WAT → HLT treatment and clinic supply

Evidence to bind in 2027

  • incident data at water utilities
  • time to recover control systems

Related editions

  • GLB Global Systems
  • GS-02 Energy
  • GS-04 Health and One Health
  • GS-05 Finance and Economy
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-10 Digital Public Infrastructure and Systemic Cyber Risk

8.2Digital systems and energy

Grids and fuel systems run on digital control. A joint advisory reports pre-positioning on networks of energy providers, and the EU treats energy as a sector under its cyber law.

1advisory

assesses pre-positioning for disruption in a crisis26

24hours

early warning deadline under the EU directive19

72hours

incident notification deadline under the EU directive19

Table 8.2State at baseline
ComponentStateEvidenceStatus
Pre-positioningagencies assess with high confidence that actors are positioned to move from IT to OT networks26Reported
Reporting dutyearly warning within 24 hours and notification within 72 hours of a significant incident19Reported
Operational datano consolidated series of operational incidents3Expert input
Product dutiesthe Cyber Resilience Act applies to products from 11 December 202720Reported

Couplings

  • INF → ENE control and billing systems
  • ENE → INF power for networks
  • ENE → HLT power for hospital systems

Evidence to bind in 2027

Related editions

  • GLB Global Systems
  • GS-02 Energy
  • GS-04 Health and One Health
  • GS-05 Finance and Economy
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-10 Digital Public Infrastructure and Systemic Cyber Risk

8.3Digital systems and food

Food systems depend on software for cold chains, traceability, payments and logistics. No consolidated series of digital incidents in food systems was found.

≈60%

of intrusions opened by phishing in EU data, all sectors3

21.3%

of intrusions opened by exploitation of vulnerabilities, all sectors3

0series

incident series found for food systems

Table 8.3State at baseline
ComponentStateEvidenceStatus
Cold chain and logisticsdepend on power and software; no series3Expert input
Traceabilitydepends on shared data systems; not consolidated3Expert input
Paymentsfraud and ransomware affect payments, as shown in finance data2Inferred
Logistics targetingmaritime and logistics are a high-value sector in EU data3Reported

Couplings

  • ENE → FOO cold chain and logistics
  • INF → FOO traceability systems
  • DAT → FIN → FOO payments

Evidence to bind in 2027

  • incident series for food sector software
  • cold-chain outage records

Related editions

  • GLB Global Systems
  • GS-02 Energy
  • GS-04 Health and One Health
  • GS-05 Finance and Economy
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-10 Digital Public Infrastructure and Systemic Cyber Risk

8.4Digital systems and health

Health services depend on records, devices and connectivity. Ransomware attacks on providers disrupt care and expose patient data, and the best evidence is from the United States.

374attacks

on US providers, 2016 to 202123

42million

patients exposed, nearly, 2016 to 202123

44.4%

of attacks disrupted care delivery23

Table 8.4State at baseline
ComponentStateEvidenceStatus
Frequencyannual ransomware attacks rose from 43 to 91, 2016 to 202123Reported
Care disruptionelectronic system downtime in 41.7% and cancelled care in 10.2%23Reported
Scale of breacha 2024 claims processor breach count was seen only in search summaries34Expert input
Legal coveragehealthcare providers are in the sectors covered by the EU directive19Reported

Couplings

  • ENE → HLT hospital power
  • INF → HLT records and devices
  • DAT → HLT patient data

Evidence to bind in 2027

  • health ransomware data after 2021
  • non-US evidence on care effects

Related editions

  • GLB Global Systems
  • GS-02 Energy
  • GS-04 Health and One Health
  • GS-05 Finance and Economy
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-10 Digital Public Infrastructure and Systemic Cyber Risk

8.5Digital systems, nature and extremes

Monitoring networks support nature and weather services, and concentration in providers and routes turns single faults into wide events. Evidence is strongest for the update failure and cable faults, and absent for nature.

21inputs

expected by the validator against 20 supplied to the interpreter in the 2024 update14

≈200faults

submarine cable faults a year12

313shutdowns

recorded in 52 countries, 202527

Table 8.5State at baseline
ComponentStateEvidenceStatus
Update failuremismatch of 21 and 20 inputs caused an out-of-bounds read and crashes14Reported
Cable faultsabout 200 a year; causes reported differently by two issuers1213Reported
Shutdownsrecord number of deliberate shutdowns in 202527Reported
Nature monitoringno consolidated cyber evidence for monitoring networks30Expert input

Couplings

  • INF → ALL provider failure
  • INF → TRD route disruption
  • DAT → BIO monitoring data

Evidence to bind in 2027

  • evidence on monitoring networks for nature
  • repair vessel availability

Related editions

  • GLB Global Systems
  • GS-02 Energy
  • GS-04 Health and One Health
  • GS-05 Finance and Economy
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-10 Digital Public Infrastructure and Systemic Cyber Risk

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 26CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, joint advisory AA24-038A (7 February 2024). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2024. Accessed 2026-11-03.back
  2. 19Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union L 333, 27 December 2022. Publications Office of the European Union, Luxembourg. Observation year 2022. Accessed 2026-11-03.back
  3. 3ENISA (ed.), ENISA Threat Landscape 2025 (October 2025; incidents from 1 July 2024 to 30 June 2025). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  4. 42UNVERIFIED, not opened: IEC (ed.), IEC 62443 series, Security for industrial automation and control systems, cited from memory. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
  5. 20Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 20 November 2024. Publications Office of the European Union, Luxembourg. Observation year 2024. Accessed 2026-11-03.back
  6. 2FBI Internet Crime Complaint Center (ed.), 2025 IC3 Annual Report. Federal Bureau of Investigation, Washington. Observation year 2025. Accessed 2026-11-03.back
  7. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
  8. 34UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, breach portal entry for the Change Healthcare breach (192.7 million individuals in search summaries); the portal opened without the record. HHS OCR, Washington. Observation year 2025. Accessed 2026-11-03.back
  9. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
  10. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
  11. 27Access Now and the #KeepItOn coalition (eds.), Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (annual report, March 2026). Access Now, New York. Observation year 2025. Accessed 2026-11-03.back
  12. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back
  13. 30World Bank (ed.), Digital Progress and Trends Report 2025: Strengthening AI Foundations. World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 8: Systems in depth. In Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems. (Baseline Edition 2026, Report No. NR-SECTOR-CYBER-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Global Cyber and Digital Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskGlobal Sector Risk and Resilience

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices