Cybersecurity spending: How much are countries investing in their digital defenses?

• Belgium leads in cybersecurity readiness with a top score of 94.81, while the U.S. is at the top for cybersecurity spending, earmarking 71.79 billion USD for 2023—nearly half of Canada’s total military budget.
  .
• Countries with the weakest cybersecurity, like South Sudan and Palau, underscore the challenges faced by nations with limited resources.
  .
• Cybercrime’s staggering global impact is estimated to have been 8 trillion USD in damages for 2023, with countries like Germany suffering most significant financial losses, reaching 225 billion USD in 2023 alone.
  .
• In the cybersecurity market, the U.S. maintains its dominance with a market value of 79.37 billion USD in 2023, expected to surge to 117.10 billion USD by 2028, showcasing its global leadership in digital defense.
  .
• To stay secure online, adopting cybersecurity measures such as using a VPN on public Wi-Fi has never been more important, with other top tips including regular audits of app permissions and the use of hardware security keys. 

Cybersecurity is more than technology; it’s the ability to foresee and combat threats that could destabilize economies and national security. And, as cyber attacks become a regular challenge, a country’s defense against these threats is a crucial line of protection.

ExpressVPN dives into the cybersecurity readiness of nations. We explore who ranks the best, with countries like the U.S., Belgium, and Malaysia leading their regions, and also what separates the front-runners from the rest. We look into the challenges faced by countries like Turkmenistan and South Sudan, considering what can be learned from their experiences.

With an estimated 8 trillion USD in damages from cybercrime expected in 2023, understanding how much countries are spending on cybersecurity spending is also critical. We compare these investments to other key areas of national budgets, asking: does more spending translate to better security?

Jump to…
What makes a country cyber secure?
The countries with the best and worst cybersecurity
Countries that lose the most money to cybercrime
The most common cybercrimes
Cybersecurity powerhouses
Top 20 countries that invest the most in cybersecurity
12 cybersecurity tips to stay safe online
Methodology

What makes a country cyber secure?

A country’s cyber resilience hinges on a multifaceted framework that integrates stringent laws, government commitment, strategic partnerships, and state-of-the-art infrastructure.

Legal framework

Effective cyber defense starts with a solid legal foundation. Laws establish the rules for data protection, dictate the response to breaches, and outline penalties for cybercrime, creating a secure environment for digital activities.

Government support

A proactive government strategy is the cornerstone of national cyber resilience. By leading the charge and providing resources, the government sets the tone for a unified national response against cyber threats.

Strategic partnerships

Cooperation is key. When governments, private companies, and educational institutions share intelligence and strategies, they create a stronger, more adaptable defense system against cyber threats.

Infrastructure investment

A modern and secure digital infrastructure acts as the first line of defense. Regular updates and maintenance of network security are essential to protect against evolving threats.

Awareness and education

Informed citizens and well-trained employees are vital in preventing cyber incidents. Educational initiatives reduce the risk of breaches caused by human error.

Monitoring and intelligence

Vigilant monitoring and smart analysis of cyber activities enable nations to detect and react swiftly to potential threats, minimizing the impact of attacks.

Cybersecurity research and development (R&D)

Investing in research is investing in the future. As cyber threats evolve, so must our defenses. R&D is crucial for developing innovative solutions to outpace potential attackers.

International cooperation

Cyber threats know no borders, making international collaboration essential. Sharing information and strategies with allies enriches a country’s understanding and response to cyber incidents.

The countries with the best and worst cybersecurity 

Cybersecurity isn’t just a part of national security; it’s become a backbone of economic stability in our digital era. The National Cyber Security Index (NCSI) offers a snapshot of how well a country can fend off cyber threats and handle them if they occur. The index takes into account a nation’s laws, technology, organizational readiness, skill development, and international cyber relations.

How are NCSI scores calculated?

The NCSI database is constantly updated as cyber challenges and strategies progress. Nations with high NCSI scores are those with comprehensive cyber laws, cutting-edge tech defenses, and robust strategies for managing cyber risks. They invest heavily in training their cyber workforce and engage in global cyber defense collaborations.

On the flip side, a low NCSI score often points to gaps in these critical areas, which can leave a country more open to cyber threats.

It’s important to note, however, that these scores don’t tell the whole story. They focus on a country’s preparedness to prevent and manage cyber incidents, not the entire breadth of its cyber activities. Understanding these scores helps us grasp a country’s cyber readiness but is just one lens through which to view its overall cyber health.

Top cybersecurity performers

European nations dominate the top spots

Claiming 14 out of the 15 top spots, European nations lead the pack in cybersecurity—and this isn’t by chance. Their long-standing commitment to digital infrastructure and the economic means to support advanced cyber defenses play a crucial role. Furthermore, the European Union fosters a culture of cooperation, allowing member states to exchange best practices and resources effectively.

Malaysia leads in APAC

Asian countries aren’t far behind. Malaysia’s notable ranking at 22nd with a score of 79.22, followed by Singapore at 31st with 71.43, signals a clear strategic emphasis on digital defense within the APAC region. These countries showcase a commitment to investing in technology and infrastructure crucial for thwarting cyber threats.

Where does the U.S. rank?

The U.S. sits at 46th with a score of 64.94. Despite not being at the very top, the U.S. has a substantial cybersecurity regime. Compared with that of smaller European nations, the vast and intricate nature of American digital systems makes it more difficult to apply comprehensive cybersecurity coverage, which is why the U.S. ranks further down the list, alongside Thailand and Georgia. 

The struggle at the bottom 

At the lower end of the index, we often find countries with fewer economic resources, which likely affects their cybersecurity investments. Financial constraints can force a government to allocate limited funds to more immediate issues, sidelining cyber defense.

Interestingly, the Vatican City ranks fourth on the list of countries with the most vulnerable cybersecurity. This is likely due to the holy city’s small size, limited resources, and reliance on outdated technology.

How much money is lost to cybercrime in each country 

A robust cybersecurity score isn’t a silver bullet against cyber threats. For example, the UK, despite being a leader in preparedness, finds itself suffering financial hits in the billions from cybercrime. This tells us that a high defense score doesn’t necessarily translate to a lower risk. 

According to the International Data Corporation (IDC), in 2023 alone, cybercrime’s global economic impact was projected to hit a staggering 8 trillion USD. To put that into perspective, that’s more than the GDP of most countries—surpassed only by giants like the U.S. and China.

Below, we delve into the losses incurred by these costly crimes in certain countries:

The digital age has leveled the playing field in many ways, but when it comes to cybercrime, some countries bear a heavier financial burden. Advanced technology hubs like Germany and France, the UK, Australia, and even the U.S. experience some of the highest monetary losses each year. 

Germany loses a staggering $225 billion to cybercrime each year

According to recent statistics, Germany is the country that’s most affected by cybercrime in terms of financial loss, with German digital association Bitkom reporting a loss of a staggering 225 billion USD in 2023. This figure is notably higher compared to other technologically advanced countries, like France, which reported losses estimated at 67 billion USD. This vast difference in cybercrime losses may initially seem puzzling. However, these figures are calculated differently in each country, making direct comparisons difficult. Also influencing the numbers are the varying systems in place to collect the data for comprehensive reporting.

In contrast to Germany’s detailed reporting, statistics from other large economies like China and India are less readily available. For instance, in 2017, these nations were reported to suffer significant financial losses due to cybercrime. However, up-to-date statistics for recent years are not available, which makes direct comparisons challenging. 

The high figure reported by Germany could be attributed to their greater transparency in disclosing cybercrime incidents. Bitkom estimated that cybercriminal activities, such as fraud, cyber espionage, theft of intellectual property, sabotage, and extortion, contribute to this figure. The country’s robust reporting mechanisms allow companies to actively report cases of cyber theft and other related crimes, making this information accessible for studies. 

Additionally, Germany invests heavily in resources to combat these types of attacks (more on this below). A considerable portion of this expenditure goes into preventive measures, reflecting a prioritization of defense over cure. Germany’s methodical approach to cybersecurity, mirrored in its NCSI score, encompasses a well-rounded strategy. Yet, the significant financial impact underscores the relentless and evolving nature of cyber threats.

Other European nations report significant losses 

The UK reported losses of 34 billion USD, while France reported 67 billion USD. As with Germany, this trend among European countries could be attributed to their more stringent and transparent reporting practices. These nations have well-established digital infrastructures and regulatory frameworks, which might contribute to more accurate and higher reporting of cybercrime incidents.

Australia follows a similar trend, reporting significant losses amounting to 22 billion USD. This figure suggests a high level of transparency in reporting cybercrime incidents, reflecting Australia’s commitment to addressing and acknowledging the extent of digital threats.

In contrast, the U.S. reported a loss of 10.3 billion USD, a figure representing cybercrime complaints to the FBI. However, this likely only represents a fraction of the actual cost. America has a vast digital landscape with numerous businesses and a noted increase in cybercrime incidents. Despite its high NCSI ranking, the U.S. acknowledges the need for international collaboration and public awareness to strengthen its digital defenses. 

Cybercrime losses in South America, Asia, and Africa

In Asia, Indonesia reported the greatest financial losses due to cybercrime, at 34 billion USD. According to reports, the COVID-19 pandemic exacerbated the situation, leading to a 25% increase in cybercrime incidents as more people engaged in online activities. Singapore also reports notable losses, with an annual loss of 475 million USD, highlighting the impact of cybercrime in Asian economies.

Brazil leads South America in cybercrime losses with a reported 22.5 billion lost to cybercrime in a year, followed by Mexico, which reports a loss of 3 billion USD. This indicates the growing concern of digital threats in the region.

In Africa, Nigeria is at the forefront, with reported losses of 210 million USD over a year. This figure sheds light on the cybercrime landscape in Africa, where digital infrastructures and reporting mechanisms might still be evolving.

The most common cybercrimes

Cybercrime is a global menace, with certain threats transcending borders and affecting individuals and organizations worldwide. Among these, phishing attacks and data breaches are notorious for their reach and impact. 

Top 5 cybercrimes in the U.S. 

Here’s an overview of the top five most prevalent cybercrime trends in the U.S.:

Phishing and pharming

These deceptive techniques lure individuals into giving away personal information. In phishing, attackers send emails or texts posing as legitimate entities, tricking recipients into entering details on fraudulent sites. Pharming is more insidious, redirecting users to fake websites without their knowledge. Over 350,000 people fell prey to phishing in the U.S. in 2023, indicating that the threat is real and growing.

Non-payment/non-delivery scams

In the e-commerce sphere, these scams are rampant. Buyers may not pay after receiving goods, or sellers might take payment without delivering. This year, over 55,000 instances were reported in the U.S., although the real number of victims is estimated to be much higher.  

Extortion

Cyber extortion, often via ransomware or phishing, forces victims to pay up to prevent harm or data leaks. While the number of extortion attacks has decreased by more than half since its peak in 2020, up to 33,000 Americans reported being victims in 2023.

Personal data breach

Sensitive data is a prime target, with breaches affecting over 60,000 U.S. individuals in 2023 alone. The stolen data can lead to identity theft and financial fraud, often ending up for sale in the digital underworld.

Tech support fraud

This scam tricks victims into believing their computer has issues, offering “help” for a fee. On a steady incline, roughly 11,000 U.S. individuals are affected annually, with scammers gaining remote access to install malware or steal information.

Regional cybercrime trends

While the U.S. grapples with its own cybercrime challenges, these threats don’t stop at its borders. Globally, the nature of cyber threats varies, reflecting the unique digital landscapes of each region. Insights from Comparitech allow us to map out these variations, highlighting prevalent cybercrimes in different parts of the world:

• Mobile malware infection rates: Countries like Iran, Algeria, and Bangladesh report the highest instances of mobile malware infections, underscoring the need for robust mobile security measures.
• Banking and ransomware attacks on mobile: Japan stands out with a significant number of mobile banking trojan attacks, while Kazakhstan sees the most substantial impact from mobile ransomware trojans.
• Banking malware and ransomware trojans: Tajikistan and Uzbekistan are particularly affected by banking malware, indicating a heightened threat to their financial cyberinfrastructure.
• Web-based and local malware attacks: Vietnam and Tajikistan experience a considerable volume of web-based malware attacks, highlighting the importance of secure web practices.
• IoT threats: India and China emerge as notable sources of telnet attacks targeting Internet of Things (IoT) devices. 
• Spam and phishing: When it comes to the origins of spam emails and phishing attacks, Russia, Brazil, and Portugal are frequently impacted.
• Data theft: China is one of the countries most affected by data theft, followed by India and then Brazil. These three countries account for over 37% of all data theft cases worldwide.

Business impacts of cybercrime

Businesses are increasingly targeted by cybercriminals, too, with ransomware and data leaks posing severe threats. The financial repercussions are substantial, with annual losses estimated at around 189 billion in the U.S. alone.

Despite the high risk of fraud, particularly in e-commerce, a Pymnts study revealed that only 34% of companies invest in fraud prevention and mitigation. This indicates a gap in cyber defense that could benefit from enhanced security measures.

Cybersecurity powerhouses 

After uncovering the landscape of global cybercrime, we now shift focus to the other side of the coin: the world’s cybersecurity powerhouses. We look at the countries not just enduring the brunt of cyber threats but also leading the charge in building formidable digital defenses.

What is market value?

In the cybersecurity sector, market value refers to the total economic worth of the cybersecurity industry within a nation. It’s measured by the revenues generated by companies engaged in providing cybersecurity solutions, which can range from software and hardware products to professional cybersecurity services.

The market value figures below serve as an important indicator of the size and economic significance of the cybersecurity industry in each country. These figures aren’t just snapshots of the current state but also provide a forecast of expected growth. 

Top cybersecurity countries based on market value 

Source: Mordor Intelligence

In the race against cybercrime, market value in cybersecurity reveals much about a nation’s commitment and capability. The U.S. maintains its position at the top, with a market value expected to surge from 79.37 USD billion in 2023 to 117.10 billion USD by 2028. Despite its impressive growth rate, other countries are quickly catching up, indicating a shift towards a more diverse and competitive global cybersecurity arena.

China’s market growth, accelerating at 21.31%, is unparalleled among the top contenders. Projected to expand from 15.58 billion USD to 40.94 billion USD in 2028, at an expected 21.31% growth rate YOY, it reflects China’s push to further enhance its digital defenses.

Australia also stands out with a growth rate of 18.44%, hinting at its rising significance in the cybersecurity domain. The expected doubling of its market value points to a strategic focus on becoming a cybersecurity hub.

In Asia, South Korea and Singapore show robust growth rates of 15.01% and 16.14%, respectively, underlining their recognition of cybersecurity as a critical component of their technological advancement.

Japan, rounding out the top 10, still shows a notable investment in cyber defense with a growth rate of 11.89%, demonstrating its resolve to keep pace with evolving digital threats. 

The 20 countries that invest the most in cybersecurity

While market value offers a glimpse into the current state of cybersecurity powerhouses, it doesn’t tell the whole story. Investment in cybersecurity paints a different picture, one that’s not solely about preparedness as indicated by NCSI scores or reflected in market dominance.

Investing in cybersecurity is about future-proofing a nation against the ever-evolving landscape of digital threats. It’s an insight into a country’s long-term strategy, and its commitment to building a resilient digital infrastructure that goes beyond immediate readiness. This aspect of investment showcases a nation’s foresight, and understanding that safeguarding against cyber threats is a continuous process requiring sustained financial commitment.

Moreover, a country’s investment in cybersecurity doesn’t always align with its market value (i.e. how much its cybersecurity sector is worth). A nation may not dominate in terms of market value, yet it could be channeling substantial funds into developing cutting-edge cyber defenses, research, and education. 

When it comes to the top 20 nations spending big on their digital defenses, here’s what we found: 

Source: Statista; Numbers displayed in USD; The data covers businesses that deal with consumers, other businesses, and government entities. The figures focus on security spending without including tax.

When it comes to cybersecurity investments, the landscape is as diverse as it is revealing. India’s trajectory is particularly noteworthy. Set to overtake economies like the Netherlands, Brazil, Italy, and Spain by 2028 in terms of cybersecurity spending, India is making a significant statement. This upsurge likely mirrors India’s ambition to fortify its digital realm, keeping pace with its rapidly evolving tech sector.

In contrast, smaller nations like Seychelles face an uphill battle. With an average cybersecurity budget of 1.3 million USD (set to increase to 2.6 million USD by 2028), the challenges of resource allocation in smaller economies become apparent. Similar scenarios unfold in countries like Sierra Leone, Tajikistan, and Cambodia, each grappling with limited budgets in the face of growing cyber threats. This pattern is particularly prominent in African and South American regions, where economic and other national priorities weigh heavily against the need for digital defense.

A closer look at 5 top countries 

Having highlighted the countries at the forefront of cybersecurity investments, let’s zoom in on five. What sets these nations apart is not just the amount they spend but how they allocate their resources. 

U.S. cybersecurity spending is half of Canada’s military budget

The U.S. plans to invest a significant 72 billion USD in cybersecurity in 2023, with this amount including spending from businesses, individuals, and the government. This shows America’s strategic approach to its position as the second-most targeted country for cyber attacks. The federal government aims to spend 15.6 billion USD in cybersecurity in 2023, which is almost half of Canada’s total military budget. 

The UK balances defense with traditional security 

The UK’s deliberate investment of 9.44 billion USD annually in cybersecurity, including a government allocation of 1.1 billion USD in 2023, speaks to its comprehensive approach to addressing digital threats. This isn’t just about shielding infrastructure; it’s about cultivating a robust cybersecurity ecosystem. From advancing new technologies to building a skilled workforce and enhancing public awareness, the UK’s strategy is a fine balance of defending today while preparing for tomorrow’s cyber challenges.

Japan boosts cybersecurity spending 

Japan’s cybersecurity investment, about 665 million USD for 2022, isn’t merely a fiscal decision—it’s a strategic move influenced by the dynamic regional security landscape. The surge in funding, including a specialized $6.7 million cyber defense project, highlights Japan’s proactive approach in a neighborhood where digital skirmishes are increasingly common. By investing in advanced cybersecurity technologies, Japan is not just defending its digital frontiers; it’s positioning itself as a key player in regional cyber stability.

Germany is a key player in European digital defense

Germany’s investment in cybersecurity, around $412 million USD, is a strategic choice reflecting its pivotal role in European security architecture. This investment, significant in the EU context, is a testament to Germany’s understanding of cybersecurity’s role in modern diplomacy and defense, particularly in its contributions to NATO’s collective digital security. Germany’s approach is about strengthening internal defenses while fostering a safer digital environment for its allies.

Canada pledges millions amid global digital threats 

Canada’s decision to invest over 500 million USD in cybersecurity over the next five years marks a strategic pivot towards fortifying its digital defense capabilities. This shift, a response to a traditionally smaller military budget, indicates an acknowledgment of the evolving nature of national security threats. Recent investments include 1.9 million USD in federal funding for cybersecurity projects at the Université de Sherbrooke, under the National Cyber Security Strategy. 

12 cybersecurity tips to stay safe online 

Cyber threats are a global concern, which means that individuals, regardless of their location, play a crucial role in this expansive digital defense network. You already know how to choose a strong password and secure your home network, so here are some additional cybersecurity tips that you can adopt to protect yourself—no matter where in the world you are. 

1. Utilize a secure email provider

Consider using email providers that offer enhanced security features like end-to-end encryption. Providers like ProtonMail or Tutanota add an extra layer of security to your email communications.

2. Regularly audit app permissions

Periodically review the permissions you’ve granted to apps on your devices. Revoke any unnecessary permissions that could potentially expose sensitive data.

3. Use a hardware security key

For highly sensitive accounts, consider using a hardware security key like YubiKey. These devices offer robust two-factor authentication, significantly improving account security.

4. Explore privacy-focused browsers

Switch to browsers that prioritize privacy and security, such as Brave or Tor. These browsers offer features like tracker blocking and enhanced encryption.

5. Disable ad tracking

Minimize your digital footprint by disabling ad tracking on your browsers and devices. This reduces the amount of data advertisers can collect about you.

6. Secure Internet of Things (IoT) devices

Change default passwords and regularly update the firmware of your IoT devices, such as smart thermostats, cameras, and routers, to prevent them from becoming entry points for hackers.

7. Use a dedicated device for sensitive activities

For tasks like online banking or handling sensitive work documents, consider using a separate, dedicated device that isn’t used for everyday web browsing.

8. Stay informed about recent cyber threats

Subscribe to cybersecurity newsletters or follow trusted cybersecurity experts on social media to stay updated on the latest threats and protection strategies.

9. Practice safe online shopping

Use dedicated credit cards with lower limits for online shopping, or services like virtual credit cards, to reduce the impact in case of financial fraud.

10. Use a VPN on public Wi-Fi

When accessing the internet on public networks, use a high-quality VPN like ExpressVPN to encrypt your online activity and protect your data from potential interceptors.

Methodology

Our analysis combines data from multiple authoritative sources, each offering key insights into the cybersecurity landscape:

• The National Cyber Security Index was vital in assessing cybersecurity preparedness and capabilities across countries. 
• We used Statista Market Insights for a broad overview of the cybersecurity market across B2C, B2B, and B2G sectors, focusing on security spending (excluding VAT) and cyber attack numbers.
• We also reviewed financial statements from major cybersecurity players to understand market dynamics and trends. 
• National Cyber Security Organizations provided specific data on cybersecurity strategies and national investments.
• Further depth was added with insights from Seon, Mordor Intelligence, and IDC’s Worldwide Semi-annual Security Spending Guide.

This diverse range of sources ensured our analysis was comprehensive, covering multiple aspects of the global cybersecurity field.