Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Risks and capability

Four global risk objects open the portfolio. Order carries no rank. Each is read across driver, exposure, vulnerability, capacity, cascade and consequence; loss metrics are added only where they can be modelled.

6 min read0 figures1 table22 notesNR-STRATEGIC-DPI-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Digital systems fail together
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
    1. 4.1 Risk objects
    2. 4.2 Capability ladder
  7. 5Shared provider failure that overlaps a power or network loss
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

  1. ReportedEQL 4RSK-SR10-DAT-001

    Common-vendor software failure

    Driver
    one faulty update on a widely deployed platform3
    Exposure
    airlines, hospitals, banks, broadcasters
    Vulnerability
    concentrated vendors; automatic update paths
    Capacity
    staged roll-out; manual fallback; recovery playbooks
    Cascade
    DAT → INF → FIN, HLT
    Horizon
    annual

  2. ReportedEQL 4RSK-SR10-INF-002

    Regional cloud or edge fault

    Driver
    a DNS fault or a configuration file limit at a shared provider45
    Exposure
    services that rely on one region or one edge network
    Vulnerability
    single-region dependence; hidden dependencies between provider services
    Capacity
    multi-region design; fallback paths; incident reporting
    Cascade
    INF → DAT → FIN
    Horizon
    1 to 3 years

  3. InferredEQL 3RSK-SR10-CYB-003

    Pre-positioned access in operator networks

    Driver
    state-sponsored access reported in several sectors67
    Exposure
    communications, energy, transport and water operators
    Vulnerability
    internet-facing devices; long dwell time
    Capacity
    logging; phishing-resistant authentication; segmentation24
    Cascade
    CYB → DAT → INF
    Horizon
    1 to 5 years

  4. InferredEQL 3RSK-SR10-DEV-004

    Exclusion as services go digital-only

    Driver
    services move online while 2.2 billion people are offline10
    Exposure
    low-income, rural and unidentified populations26
    Vulnerability
    no identity, device or connection
    Capacity
    inclusive design; assisted channels; safeguards32
    Cascade
    DAT → DEV
    Horizon
    1 to 10 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence at the global level, from a policy listing to performance in real events.

Table 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
FunctionRungLevelStrongest public evidence at baseline
Prevention and mitigationEXISTSsecurity standards and frameworks widespread; implementation uneven243142
Monitoring and observationADEQUATEthreat reporting by agencies; provider data uneven168
Early warningEXISTSadvisories from agencies; no common cross-sector warning
Preparedness and planningEXISTSnetwork security and financial resilience rules in force or being applied1819
Redundancy and reservesLISTEDmulti-region and fallback design not consolidated
ResponseDEMONSTRATEDproviders restored services after the 2024 and 2025 events345
Continuity of critical servicesEXISTSmanual fallbacks in many services; testing uneven
RecoveryDEMONSTRATEDcauses published after the 2025 cloud and edge events45
AdaptationEXISTSdigital public infrastructure safeguards published1632
Social protectionLISTEDsupport during long outages not consolidated
Finance and insuranceEXISTSevent classification and loss estimates now published9; protection gaps in sibling editions
Institutional coordinationEXISTSEU and national frameworks; a UN treaty open for signature171819
Technical infrastructureEXISTSsigned and encrypted data exchange in one national layer15
WorkforceLISTEDskills for security and operations not consolidated
Research capacityADEQUATEinterdependency science mature343537
A capability listed in policy is not a tested one; each rung is the strongest public evidence at baseline.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  4. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  5. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
  6. 24NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0 (programme page; two-year anniversary note of 24 February 2026; intended for industry, government and organisations). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  7. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
  8. 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03.back
  9. 32UNVERIFIED, not opened: United Nations Development Programme and partners, Universal Digital Public Infrastructure Safeguards Framework, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03.back
  10. 31UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
  11. 42UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals, cited from memory. Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2022. Accessed 2026-11-03.back
  12. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  13. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
  14. 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
  15. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
  16. 16United Nations (ed.), Global Digital Compact (programme page; negotiated by 193 Member States; opened for endorsement in September 2024; commitment to increase investment in digital public goods and digital public infrastructure). United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
  17. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
  18. 17United Nations Office of Legal Affairs (ed.), United Nations Convention against Cybercrime (treaty page: signing ceremony in Hanoi on 25 and 26 October 2025; seventy-one States and the European Union; article 65, entry into force on the ninetieth day after the fortieth instrument of ratification). United Nations, New York. Observation year 2025. Accessed 2026-11-03.back
  19. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
  20. 34UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
  21. 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back
  22. 37UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 4: Risks and capability. In Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk (Baseline Edition 2026, Report No. NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Digital Public Infrastructure and Systemic Cyber Risk.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices