Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Systems in depth

One section per system: its state at evidence close, its exposures and what the operational series will watch.

8 min read0 figures5 tables18 notesNR-STRATEGIC-DPI-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Digital systems fail together
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Shared provider failure that overlaps a power or network loss
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
    1. 8.1 Common causes
    2. 8.2 Domino effects
    3. 8.3 Inter-systemic feedbacks
    4. 8.4 Shared vulnerabilities
    5. 8.5 Thresholds and tipping
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

8.1Common causes

One cause can strike many services at once: a faulty update, a configuration change, a hostile campaign or a hazard. The shared cause matters more than the sector.

4,875incidents

analysed by ENISA, Jul 2024 to Jun 20251

≥5years

longest reported intrusion persistence6

204incidents

nationally significant, UK, to Aug 20258

Table 8.1Evidence at baseline
InstanceMechanism in actionEvidenceStatus
Software faultsone update reached millions of devices3Reported
Configuration changesa file grew past a built-in limit and an edge network failed5Reported
Cyber operationslong-lived access reported in operator networks67Reported
Ransomware in governmenta 2022 attack led to a national emergency declaration25Reported

Pathways in this mechanism

  • DAT → INF software and configuration
  • CYB → INF hostile access
  • CYB → DAT ransomware

Evidence to bind in 2027

  • common cause tagging of incidents
  • frequency of concurrent causes

Related editions

  • GLB Global Systems
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-03 Global Supply Chains, Trade and Chokepoints
  • SR-13 Strategic Technology Infrastructure and Sovereign Readiness
  • GS-05 Finance and Economy
  • GS-13 Cyber and Digital Systems

8.2Domino effects

A failure in one layer removes an input from the next. A provider fault reaches the services that rely on it, and then the people who rely on those services.

8.5million

Windows devices affected, 18 July 20243

≈14.5hours

AWS event, first impact to end, Oct 20254

≈5.8hours

Cloudflare event, to full resolution, Nov 20255

Table 8.2Evidence at baseline
InstanceMechanism in actionEvidenceStatus
Software to servicesone vendor update disabled many organisations’ machines3Reported
DNS to cloud servicesone empty record at a regional endpoint spread to dependent services4Reported
Edge to sitesa failed proxy returned errors to sites that rely on the network5Reported
Manufacturer to suppliersone cyber event reached over 5,000 UK organisations9Reported

Pathways in this mechanism

  • DAT → INF → FIN
  • INF → DAT
  • CYB → FIN

Evidence to bind in 2027

  • sequence timing of service loss
  • dependence of public services on named layers

Related editions

  • GLB Global Systems
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-03 Global Supply Chains, Trade and Chokepoints
  • SR-13 Strategic Technology Infrastructure and Sovereign Readiness
  • GS-05 Finance and Economy
  • GS-13 Cyber and Digital Systems

8.3Inter-systemic feedbacks

Digital services depend on what they power and what powers them. Payments need networks, networks need power, and recovery needs the same services that failed.

20.7billion

UPI transactions in October 202513

≈313.3million

Pix transactions in one day, 5 Dec 202514

2.2billion

X-Road transactions a year15

Table 8.3Evidence at baseline
InstanceMechanism in actionEvidenceStatus
Payments to commercelarge flows run on shared national rails1314Reported
Data exchange to servicesone layer carries billions of transactions between agencies15Reported
Power to digitalexchanges and data centres need continuous power§ matrixInferred
Financial feedbackevent losses feed budgets and delay upgrades9Inferred

Pathways in this mechanism

  • DAT → FIN
  • ENE → DAT
  • DAT ↔ INF

Evidence to bind in 2027

  • outage data for payment rails
  • control-network dependence data

Related editions

  • GLB Global Systems
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-03 Global Supply Chains, Trade and Chokepoints
  • SR-13 Strategic Technology Infrastructure and Sovereign Readiness
  • GS-05 Finance and Economy
  • GS-13 Cyber and Digital Systems

8.4Shared vulnerabilities

Different services share the same weak points: widely deployed software, single cloud regions, shared edge networks and long-lived access to operator networks.

<1%

of Windows machines hit by the July 2024 update3

≥5years

longest reported intrusion persistence6

2.2billion

people offline, 202510

Table 8.4Evidence at baseline
InstanceMechanism in actionEvidenceStatus
Common softwarea shared platform spreads one fault widely3Reported
Single-region dependenceservices that rely on one regional endpoint fail together4Reported
Operator networksaccess reported in communications, energy, transport and water6Reported
Offline usersdigital-only services leave people without a connection outside1026Reported

Pathways in this mechanism

  • DAT → INF software
  • INF → DAT region and edge
  • DAT → DEV exclusion

Evidence to bind in 2027

  • provider concentration by region
  • share of services with an offline path

Related editions

  • GLB Global Systems
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-03 Global Supply Chains, Trade and Chokepoints
  • SR-13 Strategic Technology Infrastructure and Sovereign Readiness
  • GS-05 Finance and Economy
  • GS-13 Cyber and Digital Systems

8.5Thresholds and tipping

A system can absorb stress until a threshold is crossed. Fallback paths, restoration practice and legal cooperation are such thresholds for digital infrastructure.

40ratifications

needed for the UN Convention against Cybercrime to enter into force17

17Jan 2025

date financial-sector ICT rules began to apply19

79%

adults with an account, 202512

Table 8.5Evidence at baseline
InstanceMechanism in actionEvidenceStatus
Restoration capacityservice returned after the 2024 and 2025 events; times not consolidated345Reported
Legal cooperationthe treaty enters into force on the ninetieth day after the fortieth ratification17Reported
Oversight of providersan EU framework addresses concentration among ICT providers to finance19Reported
Tipping in networkscascades can become abrupt in interdependent networks35Inferred

Pathways in this mechanism

  • INF → INF cascade thresholds
  • DAT → FIN fallback
  • CYB → INF repeated disruption

Evidence to bind in 2027

  • fallback coverage across services
  • cascade thresholds at operating scale

Related editions

  • GLB Global Systems
  • SR-02 Critical Infrastructure and Lifeline Systems
  • SR-03 Global Supply Chains, Trade and Chokepoints
  • SR-13 Strategic Technology Infrastructure and Sovereign Readiness
  • GS-05 Finance and Economy
  • GS-13 Cyber and Digital Systems

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  2. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  3. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
  4. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  5. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  6. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
  7. 25BleepingComputer, Costa Rica declares national emergency after Conti ransomware attacks (press report of 9 May 2022: declaration on 8 May 2022 under Decree No. 42542; Ministry of Finance and other bodies affected). Observation year 2022. Accessed 2026-11-03.back
  8. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  9. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
  10. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  11. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  12. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
  13. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
  14. 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03.back
  15. 17United Nations Office of Legal Affairs (ed.), United Nations Convention against Cybercrime (treaty page: signing ceremony in Hanoi on 25 and 26 October 2025; seventy-one States and the European Union; article 65, entry into force on the ninetieth day after the fortieth instrument of ratification). United Nations, New York. Observation year 2025. Accessed 2026-11-03.back
  16. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
  17. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
  18. 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 8: Systems in depth. In Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk (Baseline Edition 2026, Report No. NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Digital Public Infrastructure and Systemic Cyber Risk.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices