What drives reported cyber incidents?
Cross-country correlations plus pre-computed panel regressions across model types and specifications, 2014-2024.
Cross-country correlations
Each dot is one country, period-averaged 2014-2024. Use the dropdowns to compare any predictor against total or population-normalised incidents. This is a descriptive view; the panel regression below tries to control for what these correlations cannot.
Regression model selector
Pick a model class and specification. All combinations are pre-computed on the same country-year panel (2015-2024 after one-year lags). Standard errors are clustered by country throughout.
Model: 2WFE OLS. Two-way fixed-effects OLS on log(incidents + 1). Country FE absorb time-invariant traits (size, language, disclosure regime); year FE absorb global shocks. Coefficients are within-country elasticities for log-transformed predictors.
Specification: Full. All eight lagged predictors covering economic, digital, governance and human-capital dimensions.
What each predictor tells us
Estimated direction and significance under 2WFE OLS with the full specification. Switch models above to check robustness; coefficients that change sign across models should not be over-interpreted.
GDP per capita (log, t−1)
not significantGDP differences between countries are absorbed into country fixed effects. Year-on-year changes show no robust within-country association in fixed-effects models, but Pooled OLS recovers a positive between-country signal.
β = +0.0451·p = 0.717
Population (log, t−1)
↓ negativeThe negative within-country sign for population is a reporting concentration effect: incident data is dominated by a small set of high-income, English-language countries.
β = -1.3631·p = <0.001
Secure server density (log, t−1)
↑ positiveMore secure servers per million is associated with more reported incidents, consistent with a larger digital attack surface and stronger reporting infrastructure.
β = +0.0391·p = 0.055
Internet users % (t−1)
not significantOnce country and year fixed effects are removed, internet user share rarely shows additional explanatory power; it correlates heavily with other digital-infrastructure variables already in the spec.
β = -0.0008·p = 0.689
Cybersecurity index (t−1)
↑ positiveWithin-country improvements to cybersecurity readiness (when significant) tend to predict more reported incidents the following year, not fewer. The most plausible reading is a visibility paradox: better detection and disclosure infrastructure surfaces more events.
β = +0.0040·p = 0.018
Corruption control (t−1)
not significantGovernance quality changes slowly within countries; most of the variation is absorbed by country fixed effects. In Pooled OLS the coefficient flips sign: countries with stronger governance tend to disclose more, again pointing to the visibility paradox.
β = -0.1250·p = 0.250
Trade openness % (t−1)
not significantTrade exposure has no robust within-country association with reported incidents in fixed-effects models.
β = +0.0009·p = 0.428
Tertiary enrollment % (t−1)
not significantWithin-country changes in tertiary enrollment do not predict incident counts in OLS; the negative Poisson-FE result is more about model curvature than a real signal.
β = -0.0009·p = 0.810
Coefficients are not causal. Fixed effects reduce but do not eliminate omitted-variable bias, especially from time-varying within-country factors (geopolitical events, sector shocks, reporting regime changes). Predictor data is World Bank 2014-2024; ITU GCI values are forward-filled where missing in early years.