Methodology

What this data measures, what it cannot, and how the analysis was conducted.

This dashboard visualises confirmed, publicly reported cyber incidents. It does not measure cyber risk, attack volume, or national vulnerability. It measures what was seen, reported, and recorded: a meaningful but partial picture.

All counts reflect the Cyber Events Database (CEDB), which aggregates open-web, English-language incident reports. Countries with stronger disclosure ecosystems and more English-language security press appear more frequently, by design of the data collection method and not by actual threat exposure.

Data sources
University of Maryland

Cyber Events Database (CEDB)

University of Maryland GoTech

16,860 events130+ countries2014–202644 fields

Compiled by Harry, Gallagher, Lucyshyn & Entrikin, March 2026 edition. The CEDB catalogues confirmed-impact, publicly reported cyber incidents from 2014 to the present. Each record contains event date, target country, actor type, motive, event type, and industry sector (NAICS 2-digit).

World Bank

World Development Indicators

World Bank Open Data

2014–202410 indicators217 countries

Country-year panel covering GDP per capita, population, secure internet servers per million, internet users, mobile subscriptions, broadband, tertiary and secondary enrolment, trade openness, and GDP growth. Fetched at build time via the wbgapi Python library.

ITU

Global Cybersecurity Index & World Governance Indicators

ITU (GCI) · World Bank (WGI)

GCI 0–100 scoreWGI corruption index

ITU GCI scores measure national cybersecurity capacity. WGI Control of Corruption is a World Bank product. Both sourced from a pre-compiled panel CSV. GCI values are forward-filled within countries where early-year observations are missing.

Known limitations

Read these before drawing conclusions from any chart in this dashboard.

Foundational

Visibility bias

The CEDB draws from English-language and open-web sources. Countries with weaker media ecosystems or fewer mandatory disclosure obligations are systematically under-represented, regardless of actual cyber exposure. The data shows who is most visible, not who is most targeted.

Affects trends

GDELT methodology shift (Jan 2025)

From January 2025, CEDB supplements its original web-scraping method with GDELT, a 60+ language news aggregator. This inflates 2025–2026 event volumes and changes attribution rates (4x more Undetermined actor type in GDELT-sourced events). 2025–2026 data is flagged throughout this dashboard and excluded from trend comparisons.

Attribution

Nation-state attribution is media-sourced

Per the CEDB codebook, attributions are taken from source material without independent validation. These figures reflect what journalists and security researchers publicly reported, not forensically confirmed state attribution. Attribution asymmetry is real: Western offensive cyber programmes generate far less English-language coverage when targeting non-Western systems.

Scope

Confirmed-impact events only

CEDB records events where a discernible effect was achieved and publicly reported. Attempted or thwarted attacks are excluded. Absence from the database does not imply absence of targeting.

Classification

Ransomware classification

Per the codebook, ransomware maps to the Mixed event type, combining disruption and data exfiltration. Exploitive = data theft only. The ransomware proxy used in this dashboard is: Criminal actor + Financial motive + Mixed event type.

Codebook definitions

CEDB March 2026 edition.

Event type

Exploitive
Data theft or breach, no operational disruption
Disruptive
Operational disruption only, no data exfiltration
Mixed
Both disruptive and exploitative effects (e.g. ransomware)

Motive

Financial
Monetary gain: ransomware, data brokerage, fraud
Political-Espionage
Intelligence collection with explicit geopolitical motivation
Espionage
Intelligence collection: state and corporate
Sabotage
Destruction or degradation of systems or data
Protest
Political or ideological statement, often hacktivist

Actor type

Nation-State
Attributed to a government or state-sponsored group (media attribution only)
Criminal
Financially motivated non-state actor
Hacktivist
Ideologically motivated non-state actor
Regression models

All models use the same country-year panel: 2015–2024 (after one-year lags), 2,170 observations across 217 countries. Standard errors clustered by country throughout. Predictors are lagged one year to reduce reverse-causality concerns.

  • country fixed effects: absorbs all time-invariant country characteristics
  • year fixed effects: absorbs global shocks common to all countries in a given year
  • one-year lagged predictors (see data sources above)

Primary specification

2WFE OLSTwo-way fixed-effects OLS

The primary specification. Country and year fixed effects absorb time-invariant country characteristics and global annual shocks. Standard errors are clustered by country. Estimates the within-country, year-on-year association between lagged predictors and log(incidents + 1).

Robustness checks & contrast

PPML-FE

Poisson Pseudo-Maximum Likelihood

Handles the count nature of the dependent variable and is robust to overdispersion and excess zeros. Country and year fixed effects absorbed via dummy variables. Preferred for log-linearised count models (Santos Silva & Tenreyro 2006).

NB-FE

Negative Binomial FE

Explicitly models overdispersion via a separate dispersion parameter. Country and year dummies included. Caveat: incidental parameters may bias estimates in short panels (Allison & Waterman 2002).

Pooled OLS

Pooled OLS (no fixed effects)

Included for contrast only. Estimates the between-country cross-sectional association, conflating country heterogeneity with predictor signal. Shows how much coefficients shift when fixed effects are removed.

Within-R² ≈ 0.03 across all fixed-effects models. Observable socioeconomic factors explain a small fraction of within-country year-on-year variation, as expected given that reporting is shaped by disclosure culture, media salience, and geopolitical context. Coefficients are associations, not causal estimates.

Built with Next.js · Apache ECharts · react-simple-maps · pandas · statsmodels · linearmodels