Determinants of Cyber Readiness

Abstract

Why are some countries better prepared against cyber attacks than others? Whilst previous studies have revealed discrepancies in countries’ cyber readiness, there has not been any rigorous analysis which attempts to explain this variation. Based upon a new dataset (the Country Cyber Capability Dataset), this article seeks to explain why some countries have a higher cyber security readiness compared to others. We develop three theoretical frameworks to explain variation in countries’ cyber readiness: i) ‘institutional threat’, ii) ‘institutional returns’, and iii) ‘institutional capacity’. We find that countries facing a more threatening security environment are more likely to have a high level of cyber readiness. The analysis also indicates that countries which are highly dependent on cyberspace are more likely to have a high level of cyber readiness. Yet, surprisingly, we do not find a statistically significant association between our measures of institutional capacity (including real GDP) and cyber readiness. In other words, states which have more resources available to allocate towards developing a reliable and frontier technology infrastructure are not at a systematic advantage in their cyber security investments.