Geography of Cyber Incidents

Where attacks land, where they originate, and how concentrated the threat landscape is

16,280incidents · Jan 2014 – May 2026

Geographic concentration: top 5 countries 63%, top 10 countries 74%

Box area is proportional to incident count. US dominance partly reflects reporting maturity, not unique vulnerability.

Target & origin countries

Top 15 by incident count or population-normalised rate. Attack origins are media-attributed.

Geopolitical bloc exposure

Share of all-time incidents involving member states of each bloc. Western alliances score higher partly because of stronger disclosure regimes.

Who attacks whom?

Origin country→Target country

Top 40 flows by incident count

What does each bloc face?

Percentage of incidents within each geopolitical bloc by industry, actor type, motive, and attack type. Darker cells = higher share of that bloc's incidents.