With so much of our personal data stored online, cybersecurity is of the utmost importance.

So just where in the world are you cyber safe, if anywhere?

Last year, our study looked at 60 countries and found huge differences in a number of categories, from malware rates to cybersecurity-related legislation. In fact, not one country was “top of the class” across the board. All of the countries we analyzed needed some significant improvements.

So have things improved or are they getting worse?

We ranked these 60 countries from the least cyber safe to the most cyber safe based on seven criteria:

  • The percentage of mobile devices infected with malware
  • The percentage of computers infected with malware
  • The number of financial malware attacks
  • The percentage of all telnet attacks by originating country
  • The percentage of users attacked by cryptominers
  • The best-prepared countries for cyber attacks
  • The countries with the most up-to-date cybersecurity legislation

We found most countries’ scores improved since last year. But due to greater cybersecurity efforts from the majority of countries, this means some of the best-performers from last year have dropped down the rankings. This includes the US, which has dropped from the fifth most cyber-secure country to the 17th.

We added 16 new countries to the study thanks to more data becoming available. This means countries are now ranked from one to 76 with one being the least cyber-secure country and 76 being the most cyber-secure country.

Which is the least cyber-secure country in the world?

According to our study, Algeria is still the least cyber-secure country in the world despite its score improving slightly. With no new legislation (as was the same with all countries), it is still the country with the poorest legislation (only one piece of legislation — concerning privacy — is in place). It also scored poorly for computer malware infection rates (19.75%) and its preparation for cyberattacks (0.262). Nevertheless, only its score for lack of preparation that worsened over the last year (and its score for legislation which couldn’t get any worse). In all of the other categories, attacks declined, as was the common trend for most countries.

Other high-ranking countries were Tajikistan, Turkmenistan, Syria, and Iran, which took over from last year’s Indonesia, Vietnam, Tanzania, and Uzbekistan.

The highest-scoring countries per category were:

  • Highest percentage of mobile malware infections – Iran – 52.68% of users
  • Highest number of financial malware attacks – Belarus – 2.9% of users
  • Highest percent of computer malware infections – Tunisia – 23.26% of users
  • Highest percentage of telnet attacks (by originating country) – China – 13.78%
  • Highest percentage of attacks by cryptominers – Tajikistan – 7.9% of users
  • Least prepared for cyber attacks – Turkmenistan – 0.115
  • Worst up-to-date legislation for cybersecurity – Algeria – 1 key category covered

Apart from Algeria, China was the only country that stayed at the top of one of these lists – all of the other countries are new since last year.

Which is the most cyber-secure country in the world?

Our findings revealed Denmark to be the most cyber-secure country in the world, taking over from Japan, which dropped four places to the fifth most cyber-secure country. Last year’s fourth most cyber-secure country, Denmark, scored incredibly low across the majority of categories, only scoring a little higher in the legislation category due to it not having specific laws that cover content and cybercrime.

Other top-performing countries included Sweden, Germany, Ireland, and Japan. France, Canada, and the United States were all pushed out of the top five most cyber-secure countries and into ninth, sixth, and 17th place, respectively.

Sweden’s score improved across all categories except for telnet attacks, but this was only due to a very slight increase from 0.45% to 0.49% and its legislation (which remained the same). Sweden was also the best-scoring country for financial malware attacks with only 0.1% of users affected.

Germany’s score improved dramatically due to a huge decline in financial malware attacks, dropping from 3% of users to 0.5%. Ireland’s score came from improvements in all categories, bar telnet attacks (where there was a minimal increase from 0.06% to 0.07%), and a significant improvement in preparation for cyberattacks (up to 0.784 from 0.675).

Japan’s poorer score came from an increase in mobile ransomware (from 1.34% to 1.97%), an increase in computer ransomware (from 8.3% to 9.17%), and telnet attacks from the country (while these reduced from 1.23% to 1.06%, this was still a higher figure than quite a few other countries). Its score for preparation for cyberattacks and cryptominer attacks did improve, however.

France fell out of the top 5 best countries due to a high rate of computers being infected with malware (over 15%). While Canada’s overall score improved, its position declined due to better scores from other countries. Canada also scored quite high for computer malware infection rates (10.24%). And the United States’ score declined significantly due to high computer malware infection rates (9.07%) and a high number of telnet attacks coming from the country (4.71%).

The lowest-scoring countries per category were:

  • Lowest percentage of mobile malware infections – Finland – 0.87% of users
  • Lowest number of financial malware attacks – Denmark, Ireland, and Sweden – 0.1% of users
  • Lowest percent of computer malware infections – Denmark – 3.15% of users
  • Lowest percentage of telnet attacks (by originating country) – Turkmenistan – 0%
  • Lowest percentage of attacks by cryptominers – Japan – 0.17% of users
  • Best prepared for cyber attacks – United Kingdom – 0.931 score
  • Most up-to-date legislation for cybersecurity – France, China, Russia, and Germany – all seven categories covered
Rank 2019Rank 2020CountryScore 2019Score 2020% of Mobiles Infected with MalwareFinancial Malware Attacks (% of Users) % of Computers Infected with Malware% of Telnet Attacks by Originating Country (IoT)% of Attacks by CryptominersBest Prepared for CyberattacksMost Up-to-Date Legislation
11Algeria55.7548.9926.470.519.750.071.270.2621
-1Tajikistan-48.542.621.48.120.017.900.2632
-3Turkmenistan-48.394.891.15.8407.790.1152
-4Syria-44.5110.151.213.990.011.360.2371
95Iran43.2943.4852.680.87.213.311.430.6412
86Belarus45.0941.642.102.913.340.052.350.5783
67Bangladesh47.2140.3630.940.816.460.381.910.5253.5
78Pakistan47.1040.3328.130.89.960.372.410.4072.5
59Uzbekistan50.5039.414.142.110.50.024.990.6663
410Tanzania51.0038.7221.960.69.410.034.350.6421.5
1411Sri Lanka39.5938.3716.210.511.870.024.620.4663
2012Egypt38.0336.4019.440.811.3910.891.180.8424
3013Brazil33.5736.3110.530.411.408.561.070.5773
314Vietnam52.4435.835.700.511.973.443.720.6932
-15Bosnia & Herzegovina-35.435.680.710.630.080.720.2042
2716Tunisia35.5435.072.400.523.260.321.010.5363
1217Peru41.2534.3811.170.612.320.192.050.4013
1518India39.3033.8228.750.411.743.411.750.7193.5
1819Ecuador38.2933.5615.380.39.000.251.440.3672
1120Nigeria42.5431.9722.460.510.040.081.350.652
221Indonesia54.8931.3323.380.912.471.571.760.7764
2522Morocco36.4730.6013.700.613.350.130.820.4294
1323China40.8028.904.731.29.6513.780.990.8287
1624Greece39.0628.712.030.414.593.430.690.5274
-25Kyrgyzstan-28.371.950.610.010.031.050.2544
-26Kazakhstan-28.164.080.99.220.223.660.7783
1727Romania39.0227.505.040.311.780.770.250.5682
2228South Korea37.1627.113.301.97.892.060.830.8733
2429Philippines36.7926.8714.790.513.710.120.810.6434
1930Azerbaijan38.2026.573.800.812.740.031.980.6534
2831South Africa34.3925.838.280.48.500.50.790.6522
-32Oman-25.7418.070.311.820.040.590.8682
-33Jordan-25.5516.600.69.090.660.840.5564.5
4234Mexico27.1725.2214.910.610.140.930.410.6294
-35Chile-25.0211.990.39.340.370.680.474
3236Saudi Arabia32.9924.7820.050.313.300.120.570.8813
-37Serbia-24.754.110.414.360.271.20.6434
1038Ukraine42.5824.731.720.49.071.751.630.6613
3739Argentina28.1124.5913.110.510.341.730.560.4076
3940Colombia27.6923.6814.230.38.660.590.660.5654
2341United Arab Emirates36.8823.319.180.613.640.260.950.8074
2142Bulgaria37.8622.541.540.513.880.350.990.7214
3443Thailand32.4221.872.350.410.330.951.230.7963
3144Latvia33.0521.862.080.612.410.111.220.7484
2945Kenya34.1621.6916.220.411.240.161.280.7485
3646Italy28.3121.625.010.512.472.30.520.8374
2647Slovakia35.5721.483.000.311.110.120.730.7293
-48Moldova-20.741.900.313.110.421.50.6625
3549Malaysia31.7919.9418.840.511.980.540.540.8935
-50Switzerland-18.872.620.37.210.040.190.7882
4051Poland27.3618.653.160.411.390.720.560.8154
-52Lithuania-18.512.210.612.500.070.890.9084
4853Belgium21.0318.063.810.210.020.170.230.8143
3854Russia28.0217.842.1818.764.351.650.8367
4655Spain24.1217.094.150.311.090.910.620.8964
3356Portugal32.7916.914.360.212.790.110.540.7585
4557Austria25.7616.633.010.38.130.050.210.8263
-58Estonia-16.051.590.413.200.011.230.9055
4959Czech Republic20.3716.031.600.24.880.210.380.5694
5660United States12.2015.858.180.39.074.710.210.9265.5
5161Singapore15.1315.299.970.56.670.180.350.8984
5062Australia16.3413.954.860.311.080.50.280.8905
4763Turkey23.2013.262.060.47.173.470.820.8536
-64Norway-12.752.040.27.800.170.50.8924
4165Hungary27.3012.633.460.211.490.310.550.8126
4366Croatia27.0911.602.340.27.830.10.660.8405
5267Netherlands15.0010.822.890.23.780.40.680.8854
5968France10.5810.783.540.215.090.750.20.9187
5369United Kingdom14.1510.643.350.27.691.230.270.9315
-70Finland-10.340.870.27.530.030.50.8565
5871Canada11.1910.123.930.210.240.450.280.8926
6072Japan8.819.461.970.29.171.060.170.8806
5573Ireland13.419.404.340.14.510.070.210.7845
4474Germany26.489.394.010.59.290.610.20.8497
5475Sweden13.788.401.730.14.030.490.250.8105
5776Denmark12.046.722.570.13.150.050.20.8525

What’s changed over the last year?

Please note: the 16 new countries added this year (Bosnia & Herzegovina, Chile, Estonia, Finland, Jordan, Kazakhstan, Kyrgyzstan, Lithuania, Moldova, Norway, Oman, Serbia, Switzerland, Syria, Tajikistan, and Turkmenistan) aren’t included in the above chart due to their omission in 2019.

As we can see from the above chart, most countries’ scores have improved from last year – some more than others. Indonesia’s score improves dramatically, going from 54.89 last year to 31.33 this year, with quite a few European countries also noticing significant improvements, too (e.g. Ukraine, Germany, Portugal, Bulgaria, and Croatia).

Only the United States, Brazil, Japan, France, Iran, and Singapore who have worse scores than the previous year. While there is only a slight difference in all cases, as we have seen with the US, it is enough to contribute to quite a drop in rankings due to the improvements from many other countries.

What can we take away from these findings?

It is encouraging to see that most countries have improved overall. No country dominates every category, so every country still has room for improvement. Whether they need to strengthen cybersecurity legislation or users need better protection on their computers and smartphones, there’s still a long way to go.

Plus, as the landscape of cybersecurity constantly changes (cryptominers are growing in prevalence, for example), countries need to try and get one step ahead of cybercriminals.

Our methodology: how did we find the countries with the worst cybersecurity?

We considered seven criteria, each of which had equal weight in our overall score. These were:

  • The percentage of mobiles infected with malware – software designed to gain unauthorized access to, destroy, or disrupt a device’s system
  • The percentage of computers infected with malware – software designed to gain unauthorized access to, destroy, or disrupt a computer’s system
  • The number of financial malware attacks – malicious programs created to steal a user’s money from the bank account on their computer system
  • The percentage of all telnet attacks by originating country (based on the number of unique IP addresses of devices used in the attacks) – a technique used by cybercriminals to get people to download a variety of malware types
  • The percentage of users attacked by cryptominers – software that’s developed to take over a user’s computer and use its resources to mine currency (without the user’s permission)
  • The best-prepared countries for cyberattacks
  • The countries with the most up-to-date legislation

Apart from the latter two, all of the scores were based on the percentage of users attacked during Q3 of 2019. The best-prepared countries for cyberattacks were scored using the Global Cybersecurity Index (GCI) scores. The most up-to-date legislation was scored based on existing legislation (and drafts) that covered seven categories (national strategy, military, content, privacy, critical infrastructure, commerce, and crime). Countries received a point for having legislation in a category or half a point for a draft.

For each criterion, the country was given a point based on where it ranked between the highest-ranking and lowest-ranking countries. Countries with the least cyber-secure scores were given 100 points, while countries with the most cyber-secure scores were allocated zero points. All of the countries in between these two scores received a score on a percentile basis, depending on where they ranked.

The total score was achieved by averaging each country’s score across the seven categories.

All of the data used to create this ranking system is the latest available, and we have only included countries where we could cover all of the data points.

Sources:

https://securelist.com/it-threat-evolution-q3-2019-statistics/95269/

https://www.itu.int/dms_pub/itu-d/opb/str/D-STR-GCI.01-2018-PDF-E.pdf

https://www.csis.org/programs/technology-policy-program/cybersecurity-and-governance/global-cyber-strategies-index