Security
Conflict between major powers now runs continuously below the threshold of war: inside networks, inside information spaces and inside elections. This page tracks the three fronts together, because in practice the same actors work across all of them.
Average breach cost
~$4.9m
Global mean cost of a data breach — IBM Cost of a Data Breach
Ransomware payments
~$0.8–1.1bn
Annual tracked crypto payments — Chainalysis estimates
Elections held in 2024–26
70+ countries
The densest election cycle in modern history
Median dwell time
~10 days
Time from intrusion to detection — Mandiant M-Trends
Critical-infrastructure sectors
16
US designation; EU NIS2 covers 18 sector categories
Known state actor clusters
150+
Tracked advanced persistent threat groups across vendors
State-linked intruders increasingly enter power, water, port and telecom networks without stealing data — holding access for disruption during a future crisis rather than for espionage now.
Watch for: Living-off-the-land activity in operational technology networks; utility and port incident disclosures.
Affiliate models, initial-access brokers and leak sites have industrialised extortion. Hospitals, municipalities and logistics firms remain the highest-impact targets because downtime is intolerable.
Watch for: Double extortion against healthcare; attacks on managed service providers that cascade to hundreds of clients.
Compromising one vendor, update channel or open-source package reaches every downstream customer at once — the highest leverage available to an attacker.
Watch for: Signed-update abuse, malicious package publishing, and build-system compromise.
Generative tools cut the cost of persuasive text, voice and video to near zero. The change is scale and localisation rather than novelty: the same narratives, now in dozens of languages with synthetic personas.
Watch for: Cloned voices of officials in the final days before a vote; coordinated inauthentic networks on messaging apps.
Anchor drags, jamming and spoofing sit in a legal grey zone between accident and attack, making attribution slow and retaliation politically difficult.
Watch for: Repeated cable faults in the Baltic and Red Sea; GNSS jamming reports along conflict borders.
Stolen material released selectively at the moment of maximum political damage remains the most reliable interference technique, because the documents themselves are usually genuine.
Watch for: Campaign and ministry mailbox compromises surfacing weeks later on forums or through proxies.
Interference rarely means changing vote totals — that is hard, detectable and unnecessary. The cheaper objective is to make the result look illegitimate. Defences that work are therefore mostly about verifiability and speed of correction.
Cyber, ransomware, state hacking, disinformation and election-interference coverage, refreshed every 5 minutes
Cyber and information operations are one instrument among several. The kinetic side — flashpoints, alliances and live military movements — is tracked on the Geopolitics page.
Open the geopolitics tracker