• $0.00 0
    Cart review

    No products in the cart.

Foundry
The Global Risks Index
NXS-GRX · GRX-IDX-CYB · MSF Macro-financial and structural fragility

Cyber risk index

Index of cyber incident pressure, digital dependence and the lack of cyber capability on a 0-10 scale, higher meaning riskier.

ConstructionSimulatorIndicators
Page GRX-IDX-CYBEdition Baseline Edition 2026Evidence close 2026-09-30Indicator Standard IDX.CYB.capability.cyber_riskValues not yet publishedSnapshot 31a753f76
FIG 1 · Method card
Aggregation

geometric

equal weights · floor 0.1 where geometric

Uncertainty

1,000 draws

normalisation, weights, aggregation, imputation

Structure

3 components

12 leaf indicators

Coverage

67% minimum

modelled share ≤ 40%

From the Indicator Standard definition of this index.
12
leaf indicators
3
components
1,000
Monte Carlo draws
15
series read it
01Construction

From indicators to the composite

Combines hazard, exposure and capability in the INFORM pattern so that a highly digital, well-defended economy and a lightly digital, undefended one are not confused.

computation
How Cyber risk is computed
Graph18 nodes
Graph
01Indicators
02Sub-indices
03Domain index
04Pillar
05Composite
100%
List
  1. Significant cyber incidents per million population
    Indicator · IND · /10*6/a
    Number of cyber incidents in the year that a national CERT or regulator classifies as significant (material service disruption, data compromise or financial loss), per million population.
  2. Cyber incidents disrupting critical services
    Indicator · IND · 1
    Number of cyber incidents in the year that disrupted an essential service (energy, water, health, transport, finance, digital infrastructure), counted from mandatory incident reports and verified public disclosure.
  3. Individuals using the Internet
    Indicator · IND · %
    Share of individuals who used the Internet from any location and device in the last three months.
  4. ICT services value added, share of GDP
    Indicator · IND · %
    Gross value added of telecommunications, computer programming and information services (ISIC Rev.4 divisions 61-63) as a percentage of GDP.
  5. E-government development
    Indicator · IND · {score}
    UN E-Government Development Index (0-1), combining online-service provision, telecommunication infrastructure and human capital, carried as an external source series.
  6. ITU GCI legal measures pillar
    Indicator · IND · {score}
    ITU GCI 2024 pillar score (0-20) for laws and regulations on cybercrime, cybersecurity, data protection and critical-infrastructure protection.
  7. ITU GCI technical measures pillar
    Indicator · IND · {score}
    ITU GCI 2024 pillar score (0-20) for national and sectoral incident response teams, technical frameworks and protection of critical systems.
  8. ITU GCI organizational measures pillar
    Indicator · IND · {score}
    ITU GCI 2024 pillar score (0-20) for national strategy, a responsible agency, and metrics for cybersecurity governance.
  9. ITU GCI capacity development measures pillar
    Indicator · IND · {score}
    ITU GCI 2024 pillar score (0-20) for awareness campaigns, curricula, professional training and research and industry development.
  10. ITU GCI cooperation measures pillar
    Indicator · IND · {score}
    ITU GCI 2024 pillar score (0-20) for bilateral, multilateral and public-private cooperation agreements and information-sharing arrangements.
  11. National computer incident response team in operation
    Indicator · IND · {bool}
    Whether the economy has a government-mandated national computer emergency or security incident response team that is operational and reachable by constituents (1 yes, 0 no).
  12. Data protection and privacy legislation in force
    Indicator · IND · {bool}
    Whether a general data protection and privacy law is in force in the economy (1 yes, 0 no; draft legislation counts as 0).
  13. Cyber incident pressure sub-index
    Sub-index · SUB · w 1 · 33.3%
    Composite of the significant-incident rate and critical-service incidents.
  14. Digital dependence sub-index
    Sub-index · SUB · w 1 · 33.3%
    Composite of internet use, ICT services share of GDP and e-government development, read as exposure.
  15. Cyber capability sub-index
    Sub-index · SUB · w 1 · 33.3%
    Composite of the five ITU GCI pillar scores, the existence of a national CERT and data-protection law in force.
  16. Cyber risk index
    Domain index · IDX · geometric
    Index of cyber incident pressure, digital dependence and the lack of cyber capability on a 0-10 scale, higher meaning riskier.
  17. Macro-financial and structural fragility
    Pillar · PILLAR · 5 indices
    How much fiscal, financial, external, digital and technological room does the system have before stress turns into crisis?
  18. NXS-GRX Composite Risk
    Composite · COMPOSITE · four pillars
    Composite = (HTE × VUL × MSF × LCC)^(1/4), each pillar on 0–10 floored at 0.1; pillar = expert-weighted geometric mean of its domain indices
Not runIn progressDone
FIG 2. 12 indicators, 3 components, real Indicator Standard weights (the bar under each node is its share). Select a node to trace what it feeds and what feeds it; Simulate run plays the computation in order.
02Simulator

Run this index's own aggregation

Set each component, change the aggregation or the weight uncertainty, and watch the interval, the class probability and each component's contribution respond.

FIG 3 · Simulator: aggregate cyber risk on your numbers
Components (0 to 10)
3.0
5.0
7.0
25
1
–
runs in your browser
Contribution of each component (leave one out)
Simulator: the index's published aggregation run on numbers you set, with 1,000 draws over weights and aggregation. The slider positions are starting points for the explainer, not NXS-GRX (canonical data, provenance and risk) values.
03Method

Treatment, normalisation, weighting, aggregation, uncertainty

Treatment
WINSORISE
Outlier rule
|skew| > 2, kurtosis > 3.5
Normalisation
INFORM_0_10
Imputation
NONE
Coverage minimum
67% of components
Modelled share cap
40% of weight
Weighting
equal
Aggregation
geometric
Scale
0 to 10
Uncertainty
1,000 Monte Carlo runs over normalisation, weights, aggregation, imputation
Framework basis
INFORM risk algebra (hazard, exposure, lack of coping capacity); OECD/JRC Handbook (2008); ITU GCI 2024 (capability input)
Very low0.0 to < 2.0
Low2.0 to < 3.5
Medium3.5 to < 5.0
High5.0 to < 6.5
Very high6.5 to 10.0
04Components

3 components, 12 indicators

Cyber incident pressure sub-index w 1

Composite of the significant-incident rate and critical-service incidents.

IndicatorUnitEvidenceSourcesShare
Significant cyber incidents per million populationIND.CYB.incidents.significant_incident_rate/10*6/aClass Dnational-cert-annual-reports, enisa-threat-landscape, eu-nis2-incident-reporting, commercial-threat-telemetry-licensed50.0%
Cyber incidents disrupting critical servicesIND.CYB.incidents.critical_sector_incidents1Class Eeu-nis2-incident-reporting, national-cert-annual-reports, verified-public-disclosures50.0%

Digital dependence sub-index w 1

Composite of internet use, ICT services share of GDP and e-government development, read as exposure.

IndicatorUnitEvidenceSourcesShare
Individuals using the InternetIND.INF.digital.internet_users%Class Bitu-datahub, wb-wdi, national-ict-household-surveys33.3%
ICT services value added, share of GDPIND.CYB.dependence.ict_services_share.gdp%Class Bun-national-accounts-main-aggregates, oecd-stan, unctad-digital-economy33.3%
E-government developmentIND.CYB.dependence.egovernment_development{score}Class Cun-desa-egovernment-survey33.3%

Cyber capability sub-index w 1

Composite of the five ITU GCI pillar scores, the existence of a national CERT and data-protection law in force.

IndicatorUnitEvidenceSourcesShare
ITU GCI legal measures pillarIND.CYB.capability.gci_legal{score}Class Citu-gci-202416.7%
ITU GCI technical measures pillarIND.CYB.capability.gci_technical{score}Class Citu-gci-202416.7%
ITU GCI organizational measures pillarIND.CYB.capability.gci_organizational{score}Class Citu-gci-202416.7%
ITU GCI capacity development measures pillarIND.CYB.capability.gci_capacity_development{score}Class Citu-gci-202416.7%
ITU GCI cooperation measures pillarIND.CYB.capability.gci_cooperation{score}Class Citu-gci-202416.7%
National computer incident response team in operationIND.CYB.capability.national_cert{bool}Class Bitu-national-cirt-list, first-member-directory, itu-gci-20248.3%
Data protection and privacy legislation in forceIND.CYB.capability.data_protection_law{bool}Class Bunctad-global-cyberlaw-tracker, national-legal-gazettes8.3%
05Domain

Cyber and digital

Cyber-security commitment and capability, digital dependence and incident exposure.

Sub-domainIndicators
Cyber capability9
Incidents2
Digital dependence2

Anchor frameworks (pillar structure and definitions only): ITU GCI 2024; Basel operational-risk event types.

06Indicators

All 13 cyber and digital indicators

FIG 4 · Indicators in scope, by domain and sub-domain
CYB · 13
Area is the number of indicator definitions; colour is the pillar the domain feeds (Macroeconomy and Space feed through their indices). Select a block to filter the table.
IndicatorDomainSub-domainComponentUnitLevelsCrosswalks
ITU Global Cybersecurity Index scoreIND.CYB.capability.gci_scoreCYBCyber capabilitycoping capacity{score}COUNTRYITU_GCI Overall score
ITU Global Cybersecurity Index tierIND.CYB.capability.gci_tierCYBCyber capabilityvulnerability{class}COUNTRYITU_GCI Tier
ITU GCI legal measures pillarIND.CYB.capability.gci_legalCYBCyber capabilitycoping capacity{score}COUNTRYITU_GCI Legal Measures
ITU GCI technical measures pillarIND.CYB.capability.gci_technicalCYBCyber capabilitycoping capacity{score}COUNTRYITU_GCI Technical Measures
ITU GCI organizational measures pillarIND.CYB.capability.gci_organizationalCYBCyber capabilitycoping capacity{score}COUNTRYITU_GCI Organizational Measures
ITU GCI capacity development measures pillarIND.CYB.capability.gci_capacity_developmentCYBCyber capabilityadaptive capacity{score}COUNTRYITU_GCI Capacity Development Measures
ITU GCI cooperation measures pillarIND.CYB.capability.gci_cooperationCYBCyber capabilitycoping capacity{score}COUNTRYITU_GCI Cooperation Measures
National computer incident response team in operationIND.CYB.capability.national_certCYBCyber capabilitycoping capacity{bool}COUNTRYITU_GCI Technical Measures
Data protection and privacy legislation in forceIND.CYB.capability.data_protection_lawCYBCyber capabilitycoping capacity{bool}COUNTRYITU_GCI Legal Measures
Significant cyber incidents per million populationIND.CYB.incidents.significant_incident_rateCYBIncidentshazard/10*6/aCOUNTRY
Cyber incidents disrupting critical servicesIND.CYB.incidents.critical_sector_incidentsCYBIncidentsimpact1COUNTRY
ICT services value added, share of GDPIND.CYB.dependence.ict_services_share.gdpCYBDigital dependenceexposure%COUNTRYWB_WDI BX.GSR.CCIS.ZS
E-government developmentIND.CYB.dependence.egovernment_developmentCYBDigital dependenceexposure{score}COUNTRY
07Quote

Cyber risk index, world

The world reading of this index, every country as a tile and the largest movements since the previous edition.

NXS-GRX · CYB · 195 profiles · 0–10 scale
Cyber risk index, world
—
Values publish with the edition; the interval, class and change appear here.
Previous edition
—
Range since 2016
—
Coupled composite
—
Coupling score S
—
Pulse, latest week
—
Outlook, 12 months
—
Method
Indicator Standard 1.0 · NXS-GRX 2026
Draws
1,000
Cyber risk index, world, by edition

No released values yet. The first edition draws the history here with its interval band and class bounds.

The line is the point value by edition; the band is the 90% interval; dashed lines are the class bounds at 2, 3.5, 5 and 6.5.
Africa54
DZAAGOBENBWABFABDICPVCMRCAFTCDCOMCOGCIVCODDJIEGYGNQERISWZETHGABGMBGHAGINGNBKENLSOLBRLBYMDGMWIMLIMRTMUSMARMOZNAMNERNGARWASTPSENSYCSLESOMZAFSSDSDNTGOTUNUGATZAZMBZWE
Americas35
ATGARGBHSBRBBLZBOLBRACANCHLCOLCRICUBDMADOMECUSLVGRDGTMGUYHTIHNDJAMMEXNICPANPRYPERKNALCAVCTSURTTOUSAURYVEN
Asia48
AFGARMAZEBHRBGDBTNBRNKHMCHNCYPPRKGEOINDIDNIRNIRQISRJPNJORKAZKWTKGZLAOLBNMYSMDVMNGMMRNPLOMNPAKPHLQATKORSAUSGPLKAPSESYRTJKTHATLSTURTKMAREUZBVNMYEM
Europe44
ALBANDAUTBLRBELBIHBGRHRVCZEDNKESTFINFRADEUGRCVATHUNISLIRLITALVALIELTULUXMLTMCOMNENLDMKDNORPOLPRTMDAROURUSSMRSRBSVKSVNESPSWECHEUKRGBR
Oceania14
AUSFJIKIRMHLFSMNRUNZLPLWPNGWSMSLBTONTUVVUT
No movements yet. Changes since the previous edition are listed here from the second edition on, with the indicators that drove them.
08Values

Country values

FIG 5 · Cyber risk index: countries (values when released)
Loading the map
AndorraAntigua and BarbudaBahrainBarbadosComorosCabo VerdeDominicaMicronesia (Federated States of)GrenadaKiribatiSaint Kitts and NevisSaint LuciaLiechtensteinMonacoMaldivesMarshall IslandsMaltaMauritiusNauruPalauSingaporeSan MarinoSao Tome and PrincipeSeychellesTongaTuvaluHoly SeeSaint Vincent and the GrenadinesSamoa
Equal Earth · Natural Earth 1:110mValues when released
Until the first edition is released the map shows UN M49 regions or the Nexus Reports edition; it then shows this index's classes with each country's interval on hover. Countries are listed by name, never ordered by value.
Tiles
/api/v1/public/grix/risk-products/tiles/cyb/{z}/{x}/{y}.mvt
Observation key
nis:IDX.CYB.capability.cyber_risk:{ISO3}:{YEAR}:A
09Series

Series that read this index

GLBGlobal SystemsThe state of interdependent global risk: the twenty domain indices aggregated to the world, the five core systems (water, energy, food, health, biodiversity) and their couplings, the global tail register and the gap between perceived and measured risk.GS-13Global Cyber and digitalCyber capability and threat exposure, digital dependency, connectivity resilience and the cyber-physical channels into essential services.SR-10Digital public infrastructureIdentity, payments and data-exchange infrastructure as public goods, and their concentration, cyber and continuity risk.SR-11Information integrity and social cohesionInformation disorder, polarisation, trust and cohesion as amplifiers of every other risk.XT-01Artificial Intelligence and Agentic SystemsAI and agentic systems as physical infrastructure (compute, energy, water, materials and supply chains) and as a hazard source: failure, misuse, concentration and oversight gaps.XT-02Cyber and cyber-physical systemsThreats to operational technology, industrial control and cyber-physical systems across energy, water, health, ports and logistics.XT-03Telecommunications, open radio networks and edgeTelecom resilience, open and AI-native radio access networks, private wireless, edge compute and spectrum constraints.XT-05Quantum-relevant securityCryptographic resilience and the migration to post-quantum cryptography across public and financial systems.XT-09Sensors, IoT and industrial IoTConnected sensing and control across cities, utilities and industry: attack surface, data integrity and dependency.XT-11Digital identity and trustIdentity, authentication and trust infrastructure: exclusion, fraud, breach and concentration risk.XT-12Positioning, navigation and timingDependency of power, telecom, finance and transport on positioning and timing signals; jamming, spoofing and space weather.XT-14Software and supply-chain integrityOpen-source and commercial software dependencies, build integrity and provenance across critical systems.XT-16Advanced manufacturingAdvanced and additive manufacturing, industrial automation and their supply, cyber and labour risks.XT-17Distributed ledgers and decentralised infrastructureDistributed ledgers and decentralised physical infrastructure networks: operational, financial-stability and governance risk.XT-20Converging technologiesRisks that emerge where frontier technologies combine (AI with biotechnology, autonomy with cyber, compute with energy) and outrun single-technology governance.
10Validity

Crosswalks and validity checks

Crosswalks map leaf indicators to source code lists; established indices are used for validity checks, never re-weighted as inputs.

Code systemLeaf indicators mapped
ITU_GCI7
WB_WDI2
SDG1
11Across the Nexus

Platforms, standards and ways to take part

Field and service platforms of GCRI, GRF and GRA, the Nexus Risk Standards for this domain, learning, working groups and open calls. Every link is a live page.

12Cite

Cite and reuse

GCRI Canada (2026). The Global Risks Index (NXS-GRX): Cyber risk index (GRX-IDX-CYB), Baseline Edition 2026. Preparatory working draft. https://risksindex.com/indices/cyber-risk/ UNI NXS-GRX-AR-000116.

See this index in every country profile

Each profile shows this index with its interval and class once released.

Country profilesAll indices

Status

The methodology, structure and definitions of The Global Risks Index are a preparatory working draft (2026), circulated for review and comment and not for implementation. No value appears until an edition is released from a governed evidence cut; values then carry intervals, classes, sources and their correction pathway. Simulators run the published methods on numbers you choose and never show a NXS-GRX value.

What NXS-GRX is not

NXS-GRX is research and risk-analytics information. It is not a credit or ESG rating and uses no rating scale, not a benchmark for financial instruments, not official statistics, not an emergency warning or official classification, and not advice. It must not be used to evaluate natural persons. Risk classes are bands on a published scale, never rankings of countries or people.

Institutions and sources

The Nexus Consortium is stewarded by three independent not-for-profit institutions: GCRI Canada as Lead Institution, Consortium Secretariat and lead contracting organization, The Global Risks Forum (GRF) and The Global Risks Alliance (GRA). Technology, infrastructure and service providers work with the Consortium at arm's length under written agreements, like every other external party in the public-private-planet model, and hold no role in its stewardship.

Every value carries the attribution of its sources, which keep their own licences. External names are cited for interoperability only. Nexus-authored text is intended for CC BY 4.0 on release.

Avis en français

La méthodologie et les définitions du NXS-GRX sont un projet de travail préparatoire (2026). Le NXS-GRX est une information de recherche et d'analyse des risques : ni notation, ni indice de référence financier, ni statistique officielle, ni alerte, ni conseil. Les classes de risque sont des bandes sur une échelle publiée, non des classements.