Determinants of cyber readiness

Why are some countries better prepared against cyberattacks than others? Whilst previous studies have revealed discrepancies in countries’ cyber readiness, there has not been any rigorous analysis which attempts to explain this variation. Based upon a new data set (Country Capability Data Set), this article therefore seeks to explain why some countries have a higher cybersecurity readiness compared to others. We develop three theoretical frameworks to explain variation in countries’ cyber readiness: (i) ‘institutional threat’; (ii) ‘institutional returns’; and (iii) ‘institutional capacity’. We find that countries facing a more threatening security environment are more likely to have a high level of cyber readiness. Also, the analysis indicates that countries which are highly dependent on cyberspace are more likely to have a high level of cyber readiness. Yet, surprisingly, we do not find a statistically significant association between our measures of institutional capacity (including real GDP) and cyber readiness. In other words, states which have more resources available to allocate to developing a reliable and frontier technology infrastructure are not at a systematic advantage in their cybersecurity investments.