A single compromised software update can reach thousands of organizations across dozens of countries within hours. In such an interconnected world, cyber threats do not stop at national borders, and no State can address them alone. Cybersecurity is therefore not only a technical or individual concern, but a matter of international peace and security.
As Cybersecurity Awareness Month comes to an end, it is an opportunity to reflect on how UNIDIR works to address these challenges. Through its Security and Technology Programme, UNIDIR addresses cybersecurity not merely as a technical challenge, but as a policy, legal and diplomatic issue. Our research and cyber capacity-building activities bridge technical, legal and diplomatic communities, offering practical tools and conceptual frameworks for navigating an increasingly complex digital domain.
The evolving threat landscape
Understanding why cybersecurity requires international cooperation begins with the nature of the threats themselves. Malicious cyber activity has become a constant feature of the digital environment.
UNIDIR estimates that ransomware attacks increased approximately threefold between 2023 and 2024.
Supply-chain compromises illustrate how interconnected networks create systemic vulnerabilities that no single organization can address alone, as malicious actors penetrate trusted software updates to reach thousands of downstream victims.
The human cost is increasingly visible: hospitals forced to cancel surgeries, water systems disrupted, and humanitarian organizations targeted. The 2022 ICRC breach alone exposed sensitive data on over half a million people. Other risks may take years to materialize. In “Harvest now, decrypt later” operations, adversaries steal encrypted data today, anticipating that future quantum computing could render current encryption obsolete.
Artificial intelligence is compounding these risks, lowering the barriers to sophisticated cyber operations and expanding their surface.
These interconnected and evolving threats highlight the need not only to understand cyber incidents, but also to develop shared approaches to preventing, mitigating and responding to them.
Making cyber incidents legible
To help policymakers understand the nature of cyber incidents, UNIDIR has developed accessible analytical tools. Our Taxonomy of Malicious ICT Incidents offers a structured way to categorize incidents and their effects, from disruption of service and data attacks to physical and reputational harm.
Building on this, the Intrusion Path framework divides the ICT environment into three layers: outside, on, and inside the perimeter, visualizing where malicious activities occur. During UNIDIR’s Cyber Stability Conference 2025, the framework showed participants at which point technical, legal and diplomatic responses come into play. A scenario-based exercise set in the fictional region of “Dystopia” illustrated how an ICT incident could escalate into cross-border disruptions.
But understanding incidents is only one part of the challenge. Addressing them also requires a shared international framework to guide State behaviour and support cooperation.
Strengthening policy and diplomacy
The UN Framework for responsible State behaviour in cyberspace, comprising the 11 voluntary norms, international law, confidence-building measures and capacity-building, remains the cornerstone of multilateral efforts to ensure security in the use of ICTs.
UNIDIR’s analysis of the 2021-2025 Open-Ended Working Group on ICT security provides a comprehensive account of how States advanced this framework, informing discussions as they transitioned to the permanent Global Mechanism on ICT security in 2026.
Translating this framework into practice requires efforts tailored to national and regional contexts. In Southeast Asia, UNIDIR worked with ASEAN Member States and the ASEAN-Singapore Cybersecurity Centre of Excellence to develop the ASEAN Norms Implementation Checklist, providing step-by-step guidance for embedding the 11 voluntary norms into national policy, legal, technical, and diplomatic practice.
Confidence-building is another essential dimension of international cooperation. UNIDIR’s Cyber Policy Portal serves as a practical transparency tool, profiling the cyber policies of 193 UN Member States and enabling governments, policymakers and other stakeholders to compare national approaches, track implementation of the UN Framework, and identify areas for cooperation.
However, shared commitments and transparency alone are not enough. States also need the capabilities to implement these commitments and participate effectively in international efforts.
From norms to practice
International consensus on frameworks for responsible behaviour means little if States lack the capacity to implement them. UNIDIR’s Foundational Cyber Capabilities framework outlines essential components for national cyber preparedness: strategic planning, legal and institutional development, operational capabilities, and trusted partnerships.
In Thailand, UNIDIR partnered with national authorities to develop a roadmap addressing priority issues and supporting implementation of specific elements of the UN Framework. This was followed by a targeted workshop that brought together Thailand’s technical, legal and diplomatic communities to translate select norms into national processes and practices suited to their institutional context.
Beyond demand-driven workshops, UNIDIR also delivers a dedicated Training Course on Norms, International Law and Cyberspace, designed to help government legal advisers and diplomats engage effectively in multilateral discussions on ICT security. Across five editions, 116 diplomats from 82 States have benefited from the programme.
Building capacity also means ensuring that a wider range of voices can participate in multilateral discussions. To support women’s participation in multilateral ICT security discussions, UNIDIR runs the Women in International Security and Cyberspace Fellowship, equipping women diplomats with knowledge and skills for engagement in the Global Mechanism. Its impact is measurable: in the Global Mechanism’s first substantive plenary, women delivered 51% of statements, and fellows alone delivered more than half of all of women’s interventions.
Alongside implementation and participation, another key challenge is clarifying how international law applies to State conduct in cyberspace.
International law and State conduct in cyberspace
In 2013, the UN Group of Governmental Experts agreed that international law applies to the State use of ICT. Since then, States have focused on how it applies in practice. UNIDIR’s research maps where States’ interpretations converge and where they diverge, including the positions of regional organizations on the application of international law in cyberspace.
Due diligence is a case in point. The UN Group of Governmental Experts in 2015 articulated a voluntary norm that “States should not knowingly allow their territory to be used for internationally wrongful acts using ICTs”. Still, due diligence as a legal concept applicable in cyberspace remains subject to divergent State interpretations. As observed by UNIDIR, key outstanding questions include the legal status of due diligence, the scope of expected conduct, the required level of knowledge, and the harm threshold.
Multilateral engagement and the path forward
Clarifying legal questions, building national capabilities and advancing shared norms all depend on sustained dialogue among States and other stakeholders. Multilateral engagement provides a space to bring these efforts together and address the challenges posed by technological change.
UNIDIR’s flagship Cyber Stability Conference, celebrating its milestone 15th edition in 2027, serves as a key platform for multistakeholder dialogue, bringing together policy, legal, technical, and diplomatic perspectives on cybersecurity. The 2026 conference focused on the current rapid technological change. Its central takeaway:
Emerging technologies such as artificial intelligence and quantum computing reshape both offensive and defensive capabilities, and whether governance frameworks can keep pace with technological change remains an open question.
The same interdependence that makes cyberspace vulnerable also makes cooperation indispensable. As States take forward the new Global Mechanism on ICT security, UNIDIR stands ready to support them: through research, policy tools, and a range of capacity-building initiatives.
Awareness, translated into participation, is how resilience is built.
Awareness tells us the risks are shared. But awareness without capacity, and capacity without international cooperation, leaves cyberspace vulnerable. Stability depends on whether the capacity to manage those risks is shared too, and UNIDIR’s Security and Technology Programme works to help close that gap.
