Countries With the Best Cybersecurity Capabilities, Ranked

Harvard's Belfer Center ranks the United States first in cyber power, followed by China, Russia, the United Kingdom, and Australia, in the most recent edition of its National Cyber Power Index that we could find (2022). That is the closest thing to an official league table, and it comes with a caveat that matters: governments hide their best tools, so any ranking is built from what the public can see. This article explains how the index works, profiles the countries behind the headlines, and shows where the evidence is firm and where it is thin.

Key Takeaways

• The 2022 National Cyber Power Index ranked 30 countries: the United States, China, Russia, the United Kingdom, Australia, the Netherlands, South Korea, Vietnam, France, and Iran made up the top 10.
• The index measures capability and intent across eight objectives, from surveillance and defense to destructive operations and financial gain, using public sources only.
• China and Russia are documented in government advisories as preparing or conducting disruptive operations: Volt Typhoon in U.S. infrastructure, and the 2015 Ukraine grid attack, NotPetya, and the Viasat hack on the Russian side.
• North Korea ranked 14th overall but first in the financial category, and Chainalysis estimates it stole at least $2.02 billion in crypto in 2025.
• Being ranked first does not prevent being hit. The 2020 SolarWinds software compromise was attributed by the White House to Russia's SVR, which led to U.S. sanctions.

How cyber power is measured

Counting tanks is easy. Counting exploits is not. A country can field a world-class hacking unit and never reveal it, and a country with a loud, sloppy operation looks more capable than it is. Any cyber ranking therefore has to answer a hard question first: what can an outsider actually measure?

The Belfer Center's National Cyber Power Index (NCPI), published by the Cyber Project in 2020 and updated in 2022, takes a structured approach. It defines cyber power as "the effective deployment of cyber capabilities by a state to achieve its national objectives." It uses 29 indicators, draws on more than 1,000 existing data sources, and scores countries on whether they have demonstrated both the capability and the intent to use it. The 2022 edition ranked 30 countries.

Those indicators roll up into eight objectives:

• Financial (gaining money through cyber means)
• Surveillance (monitoring domestic and foreign targets)
• Intelligence (foreign intelligence collection)
• Commerce (building a competitive cyber industry)
• Defense (protecting national networks)
• Information control (shaping the information environment)
• Destructive capability (disrupting or damaging systems)
• Norms (shaping international rules)

The index does not judge how states use their power, and it says so. A low rank does not mean a country has become weaker in absolute terms, only that it scored lower relative to others on public evidence. Think of it as ranking restaurants by reviews and menus, not by what is happening in the kitchen. The public record is real data, but it is a sample.

The 2022 ranking at a glance

The table lists the NCPI 2022 top 10 in order, plus North Korea, with a note on where this article provides sourced detail. Where the article has no verified operational detail to offer, the table says so instead of inventing a profile.

NCPI 2022 rank	Country	What the public record shows (see sections below)
1	United States	Formal "defend forward" doctrine since 2018; CISA and NSA lead advisories; also the target of SolarWinds
2	China	Volt Typhoon pre-positioning in infrastructure (2024 advisory); Salt Typhoon telecom intrusions (2025 advisory)
3	Russia	Ukraine grid attack (2015), NotPetya (2017), Viasat (2022); moved into the top three in 2022
4	United Kingdom	Partner agency on the Volt Typhoon advisory; attributed NotPetya to the Russian military in 2018
5	Australia	Partner agency on the Volt Typhoon advisory; named as a possible victim of similar activity
6	Netherlands	Ranked by the index; not profiled here
7	South Korea	Ranked by the index; not profiled here
8	Vietnam	Ranked by the index; not profiled here
9	France	Ranked by the index; not profiled here
10	Iran	Blamed by U.S. officials for the 2012 Shamoon attack on Saudi Aramco, though without public evidence
14	North Korea	First in the index's financial category; Chainalysis tallies billions in stolen crypto

Sources: MeriTalk's report on the Belfer Center NCPI 2022 (October 6, 2022) for the order and for North Korea's rank; sections below for the notes.

Israel and Germany do not appear in the published top 10. Israel's reputation in cyber rests on a different kind of evidence, covered later in this article, which is one reason rankings and reputations do not always match.

What the United States has and what it has not prevented

The United States tops the index for reasons that are mostly institutional. The National Security Agency (NSA) is a signals intelligence agency, and U.S. Cyber Command is the military's cyber arm. In 2018 the Department of Defense issued a cyber strategy that directed forces to "defend forward," meaning to disrupt or halt malicious cyber activity at or near its source, including activity that falls below the level of armed conflict. Before that, policy had largely limited military cyber forces to defending Defense Department networks outside declared hostilities. Cyber Command's operating concept for this, called persistent engagement, aims to shift the posture from reactive to proactive. Public detail on how often operations are conducted is thin, and Cyber Command has acknowledged operations to defend the 2018 and 2020 U.S. elections.

On the civilian side, the Cybersecurity and Infrastructure Security Agency (CISA) coordinates advisories with the NSA and the FBI, as it did for Volt Typhoon. That coordination is visible in the paperwork. The February 2024 Volt Typhoon advisory carried the logos of CISA, NSA, and FBI, with partner agencies from the Department of Energy, the Environmental Protection Agency, and the Transportation Security Administration, plus allied cyber agencies from Australia, Canada, the United Kingdom, and New Zealand.

Stuxnet and the limits of attribution

The most famous offensive operation linked to the United States is Stuxnet, the malware that targeted Iran's Natanz enrichment plant. The Institute for Science and International Security estimated that Iran replaced about 1,000 IR-1 centrifuges in late 2009 or early 2010, out of a peak of 8,692 installed, and called Stuxnet a reasonable explanation for the damage while noting that questions remain. Stuxnet was reported to be a joint U.S. and Israeli project, but neither government has formally acknowledged building it, so treat the attribution as widely reported rather than confirmed.

The best-known cyber weapon in history has an official author nobody will name. That is the normal condition of this field.

The top-ranked country was also a victim

Rank is not immunity. In late 2020, attackers compromised the SolarWinds Orion software platform, a product used across many organizations. On April 15, 2021, the White House formally named Russia's Foreign Intelligence Service (SVR) as the perpetrator, saying the intelligence community had high confidence in the attribution, and announced sanctions on technology companies that support Russian intelligence along with the expulsion of 10 Russian intelligence officers working in Washington. A country can be strong at offense, strong at intelligence, and still be exposed because its software supply chain is huge and shared with everyone.

China: patience at scale

China is second in the NCPI, and the public record explains why. Two recent advisories, both co-sealed by U.S. and allied agencies, describe activity that goes well beyond traditional spying.

Volt Typhoon. The February 7, 2024 advisory (AA24-038A) describes a state-sponsored group that targeted communications, energy, transportation systems, and water and wastewater systems. The agencies assessed that the actors were seeking to position themselves on IT networks so that they could carry out disruptive or destructive attacks on U.S. critical infrastructure during a major crisis or conflict, and assessed with high confidence that they were positioning to move from IT networks into operational technology (the control systems that run physical equipment). The group relied on "living off the land" techniques, which means using legitimate built-in administration tools instead of custom malware, so its activity blends into normal traffic. In some victim environments, the agencies observed access maintained for at least five years.

An analogy helps here. Espionage is photocopying documents in someone's office. Pre-positioning is quietly installing a master key to the building and the circuit-breaker room, then leaving, in case you need them later. Nothing is stolen, nothing breaks, and the danger is entirely in the option.

Salt Typhoon. A joint advisory (AA25-239A), first published on August 27, 2025, described Chinese state-sponsored actors who compromised backbone and edge routers across telecommunications, government, transportation, lodging, and military networks, and who modified router configurations for persistent access. The advisory says activity dates to at least 2021, names three China-based companies that provide cyber services to Chinese intelligence services, and was co-sealed by 23 agencies from 13 countries. It does not give a count of victims, and it states that the scope and scale remain an information gap.

For the reader, the practical takeaway is that China's index position reflects espionage and persistence more than spectacle. Where Russia stages loud events, the Chinese record is mostly about access that is hard to see.

Russia: disruption you can see

Russia ranks third in the index; coverage of the 2022 edition noted that it had moved into the top three. The evidence is the most visible of any country because Russian operations often cause outages that the public notices.

The Ukraine grid, December 2015. CISA reported that remote intrusions at three regional power distribution companies in Ukraine caused outages affecting approximately 225,000 customers. CISA dates the attack to December 23, 2015. Wikipedia's account of the group Sandworm, which is run by Unit 74455 of the GRU (Russia's military intelligence), links the unit to a second attack that left about a fifth of Kyiv without power in December 2016, using malware known as Industroyer. In October 2020, a U.S. grand jury indicted six Unit 74455 officers, and the United Kingdom's National Cyber Security Centre publicly linked the unit to the 2018 Pyeongchang Winter Olympics attack.

NotPetya, June 2017. On February 15, 2018, the White House said the Russian military launched "the most destructive and costly cyber-attack in history," which "quickly spread worldwide, causing billions of dollars in damage across Europe, Asia, and the Americas." The United Kingdom made a matching attribution to the Russian military the same day. Russia rejected the accusations as unsubstantiated. The attack targeted Ukraine but spread through commercial networks, which is why collateral damage reached companies with no connection to the conflict.

Viasat, February 24, 2022. On the day of the invasion of Ukraine, a wiper malware called AcidRain disrupted the KA-SAT satellite broadband network, taking thousands of modems offline. The attack also disrupted remote control of about 5,800 Enercon wind turbines in Germany. On May 10, 2022, the European Union, the United States, and the United Kingdom condemned the attack as a Russian operation. The case is a clean example of how a regional war can spill into civilian infrastructure in a third country.

Taken together, the Russian record shows a state that treats cyber operations as an instrument of coercion and has been willing to cause visible harm. Its other signature, the SolarWinds espionage campaign, shows the opposite approach: quiet, patient, and difficult to detect for months.

The United Kingdom, Australia, and the other top 10

The United Kingdom ranks fourth. Among the evidence available to us, the clearest sign of its capability is its role as a co-author of the Volt Typhoon advisory through the National Cyber Security Centre and its 2018 attribution of NotPetya to the Russian military, which was made the same day as the U.S. statement. Australia, ranked fifth, appears as a partner on the same advisory, through the Australian Signals Directorate's cyber center, and the advisory notes that Australian, Canadian, and New Zealand infrastructure could be vulnerable to similar activity.

For the Netherlands, South Korea, Vietnam, and France we do not have enough verified operational detail to profile them responsibly. Their presence in the index shows what the NCPI is built to capture: breadth across the eight objectives, not only offensive firepower. A country can rank highly because of a strong defense, a competitive cyber industry, or a role in shaping international norms.

North Korea: a cyber power built around money

North Korea ranks 14th overall in the NCPI, yet first in the financial category. That gap is the story. The country has a small and isolated economy but, according to Bitcoin.">blockchain-analysis firms, a very productive hacking operation aimed at stealing cryptocurrency.

The numbers come from Chainalysis, a blockchain analytics firm. In its December 2025 report, Chainalysis estimated that North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025, a 51 percent increase over 2024 and a $681 million rise, bringing its lower-bound cumulative estimate to $6.75 billion. The February 2025 compromise of the Bybit exchange alone accounted for $1.5 billion of the 2025 total, and North Korea achieved its record with 74 percent fewer known attacks than the year before. Chainalysis describes methods that include embedding IT workers inside crypto services, impersonating recruiters at web3 and AI firms, and laundering funds in tranches under $500,000 across a roughly 45-day cycle.

An earlier landmark was the Ronin Network theft. About $625 million, including roughly 173,600 ether and $25.5 million in USDC, was taken from the sidechain tied to the Axie Infinity game. On April 14, 2022, the Treasury Department's Office of Foreign Assets Control sanctioned an Ethereum wallet that the FBI had linked to Lazarus, a hacking group backed by North Korea.

These are estimates by a private analytics firm, with attribution built on blockchain tracing and government statements. They are well supported, but they are not audited accounts. For a country-by-country look at digital crime, including how crypto theft fits in, see our ranking of countries with the most cybercrime activity, and for the other side of that market see countries with the most cryptocurrency users.

Israel and the diffusion of cyber tools

Israel does not appear in the published NCPI top 10, but its reputation in cyber is built on a different kind of evidence: people. Unit 8200, the signals intelligence unit of the Israel Defense Forces, has produced founders for a large number of technology companies. A Teiss report notes that Assaf Rappaport, a former 8200 officer, co-founded the cloud security company Wiz in 2020 with three former army colleagues, and that investor Gili Raanan says 90 to 95 percent of the teams he sees are made up of 8200 graduates. It also says that Check Point, Palo Alto Networks, CyberArk, and others have founders with military roots, though it does not tie all of them to 8200 specifically.

That ecosystem is one reason the NCPI includes a "commerce" objective. A military cyber unit that feeds a private industry is an asset that does not show up in a count of attacks.

The darker side of that diffusion is commercial spyware. NSO Group, an Israeli company, makes Pegasus, a phone-hacking tool. In 2021 the Pegasus Project, a consortium of media organizations coordinated by Forbidden Stories with technical help from Amnesty International's Security Lab, reported that NSO's customers had used it to target journalists, politicians, and human rights workers. NSO denied the findings. On November 3, 2021, the U.S. Commerce Department added NSO to its Entity List, citing evidence that foreign governments used its tools to "maliciously target" officials, activists, journalists, academics, and embassy workers. Israel's Ministry of Defense regulates NSO's exports like weapons sales.

The lesson is that high-end offensive capability is no longer limited to a handful of governments. Any state with a budget can buy tools that once required a national lab.

Iran: the Shamoon precedent

Iran, ranked tenth, is linked to one of the earliest large destructive attacks. On August 15, 2012, the Shamoon malware struck Saudi Aramco. According to a legal-analysis wiki maintained by NATO's cyber defense center, it rendered more than 30,000 Aramco computers unusable and erased data on about three-quarters of the company's corporate PCs. A group calling itself the "Cutting Sword of Justice" claimed responsibility. U.S. intelligence officials believed Iran was behind the attack but offered no specific evidence publicly, which makes it a useful example of how thin attribution can be even for an operation that is widely accepted as Iranian.

Notable attributed operations at a glance

Year	Operation	Attributed to	Basis for attribution	Documented effect
2009-2010	Stuxnet	Widely reported as U.S. and Israel	Not officially acknowledged	About 1,000 IR-1 centrifuges likely damaged at Natanz
2012	Shamoon	Iran (per U.S. officials)	Officials, without public evidence	More than 30,000 Aramco computers unusable
2015	Ukraine power grid	Russia (Sandworm, GRU Unit 74455)	U.S. indictment, 2020	About 225,000 customers lost power
2017	NotPetya	Russian military	U.S. and U.K. statements, 2018	"Billions of dollars" in damage (White House)
2020	SolarWinds	Russia (SVR)	White House, April 15, 2021, high confidence	Software supply-chain compromise; U.S. sanctions and expulsions followed
2022	Viasat KA-SAT	Russia	EU, U.S., U.K., May 10, 2022	Thousands of modems offline; 5,800 German wind turbines disrupted
2022	Ronin Network	North Korea (Lazarus)	FBI and OFAC, April 14, 2022	About $625 million stolen
2024	Volt Typhoon	China	CISA, NSA, FBI advisory, February 7, 2024	Access in infrastructure for at least five years in some cases
2025	Salt Typhoon	China	Joint advisory, 23 agencies, 13 countries	Telecommunications and other networks compromised
2025	Bybit	North Korea	Chainalysis and U.S. officials	About $1.5 billion stolen

What a ranking like this misses

Cyber rankings are useful, but they leave out several things that shape real outcomes.

Secrecy. The best offensive capabilities are, by design, the ones the public never sees. A country that rarely gets caught looks less capable than one that makes mistakes. The NCPI acknowledges this by relying on public sources and "demonstrated" capability.

Offense and defense are different skills. A country can excel at breaking into networks and still protect its own poorly. SolarWinds showed that even the top-ranked state is exposed through shared software. For the defender's side of the problem, see our explainer on machine learning in cybersecurity and intrusion detection.

Intent. The index scores both capability and intent. Intent can change fast. A state that has little interest in destructive operations today may decide otherwise in a crisis, and the Volt Typhoon advisory is built around exactly that uncertainty.

Money and talent. Cyber power tracks national wealth, education, and the size of the technology sector only loosely. North Korea shows that a small economy can reach the top of one objective. For the money side, our rankings of the biggest defense budgets and of military R&D spending show how much states put into conventional capabilities, though cyber spending is far less transparent.

Private companies. Much of the world's digital infrastructure is owned by corporations. Cloud and data-center capacity matters, and our ranking of countries with the most data centers shows where it is concentrated.

How attribution actually works

Every row in the table above depends on attribution, the process of deciding who is behind an operation. It is not a single method. Investigators use malware code similarities, infrastructure reuse, operational habits such as working hours, and intelligence that is rarely published. Governments also announce attributions for political reasons, such as timing sanctions or building coalitions.

Confidence varies. The Volt Typhoon advisory states high confidence for some assessments. The 2012 Shamoon attribution rests on unnamed officials. The U.S. indictment of six GRU officers in 2020 is on the stronger end because it names individuals. Private security firms use their own naming systems, so the same group may have several names. The Volt Typhoon advisory lists aliases including Vanguard Panda, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite, and Insidious Taurus, which is a reminder that tracking threat groups is as much naming as detecting.

When you read that "country X hacked Y," ask who made the claim, what the evidence was, and with what confidence. A claim from a court indictment is not the same as a claim from a company blog.

Frequently Asked Questions

Q: Which country has the best cybersecurity capabilities? A: By the Belfer Center's 2022 National Cyber Power Index, the United States ranks first, followed by China, Russia, the United Kingdom, and Australia. The index scores 30 countries on capability and intent across eight objectives using public sources. Its authors note that rank is relative and that classified capabilities are not visible.

Q: Is North Korea really a major cyber power? A: In one specific area, yes. North Korea ranked 14th overall in the 2022 index but first in the financial category. Chainalysis estimates that North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025 and about $6.75 billion cumulatively, as a lower bound. The estimates rely on blockchain tracing and government attribution.

Q: What is the difference between offensive and defensive cyber capability? A: Offensive capability is the ability to penetrate, disrupt, or damage other networks. Defensive capability is the ability to protect your own networks and recover from attacks. The two are separate skills: SolarWinds showed that a country with strong offensive and intelligence capabilities can still be exposed through its software supply chain.

Q: What is Volt Typhoon? A: Volt Typhoon is the name used for a Chinese state-sponsored group described in a February 7, 2024 advisory from CISA, the NSA, and the FBI. The agencies assessed that it was positioning itself in networks of communications, energy, transportation, and water systems to disrupt operations during a major crisis. Access had been maintained for at least five years in some environments.

Q: Who was behind NotPetya? A: The U.S. and U.K. governments attributed NotPetya to the Russian military in statements on February 15, 2018. The White House called it the most destructive and costly cyber-attack in history and said it caused billions of dollars in damage. Russia rejected the accusation as unsubstantiated.

Q: Why do rankings and reputations sometimes disagree? A: Because rankings use measurable public evidence, while reputations also reflect talent, secrecy, and private-sector strength. Israel is well known for cyber expertise, yet it does not appear in the NCPI 2022 top 10. The index scores demonstrated capability and intent across eight objectives, which rewards breadth and visibility.

The takeaway

The cleanest way to read a cyber power ranking is as a map of what is visible, not a count of what exists. The United States leads the best-known index because it combines large intelligence agencies, a formal doctrine for acting outside its own networks, and an industry that shapes global software, yet it was still reached by SolarWinds. China's record is about patience, with advisories describing access kept for years. Russia's record is about visible disruption, and North Korea's is about money. The pattern across all of them is that attribution is slow, partial, and political, and the strongest evidence for any ranking is the same as for any claim: a named source, a date, and a stated level of confidence.

Sources

• MeriTalk, "US ranks number 1 in new cyber power report" (October 6, 2022), on the Belfer Center National Cyber Power Index 2022
• Belfer Center, National Cyber Power Index 2022
• CISA, NSA, FBI advisory AA24-038A on Volt Typhoon (February 7, 2024)
• CISA advisory AA25-239A on Chinese state-sponsored actors (August 27, 2025)
• CISA, Cyber-Attack Against Ukrainian Critical Infrastructure
• CBS News, U.S. and U.K. blame Russia for NotPetya (February 15, 2018)
• Wikipedia, Viasat hack
• Wikipedia, Sandworm (hacker group)
• Defense One, Russia sanctioned over SolarWinds (April 2021)
• Chainalysis, 2025 Crypto Theft Reaches $3.4 Billion
• TechCrunch, Lazarus and the Ronin theft (April 15, 2022)
• Institute for Science and International Security, "Did Stuxnet take out 1,000 centrifuges at the Natanz enrichment plant?"
• NATO CCDCOE Cyber Law Toolkit, Shamoon (2012)
• Stars and Stripes, NSO Group added to the Entity List (November 3, 2021)
• Teiss, on Wiz and Israel's military intelligence alumni (Reuters reporting)

Related Reading

• Cybersecurity Threats in 2026: What the Data Actually Shows
• Countries With the Most Stealth Aircraft
• Countries With the Most Submarines in the World
• Countries With the Most Advanced Drone Programs
• Countries With the Most Satellites in Orbit