Cyber readiness in Eurasia: what the indices score and miss

Most governments between the Caspian and the Carpathians now have the institutions of cyber defence on paper: a response team, a strategy, a cybercrime law. The best-known index of those institutions, the ITU’s Global Cybersecurity Index (GCI), places four of the ten countries covered here in its second-highest tier. Yet the region’s most instructive cyber events of the past year happened in a country the index puts in its middle tier, Moldova, and at scale in Ukraine, which also sits there, while the country with the highest score, Kazakhstan, suffered the largest personal-data exposure in its history. None of this makes the index wrong. It measures something narrower than resilience, and readers who use it as a readiness ranking will misjudge where the risk lies.

What the index actually scores

The GCI describes itself as a measure of the commitment of countries to cybersecurity. Its fifth edition, published on 12 September 2024, scores each country out of 100 across five equally weighted pillars: legal, technical, organisational, capacity development and cooperation. The evidence comes from a questionnaire answered by governments and checked by ITU against published documents. A country scores for having a data-protection law, a national computer incident response team, a strategy, sectoral response teams, training programmes, awareness campaigns and international agreements.

That design has consequences. The index can tell a reader whether a national response team exists; it cannot tell whether that team detected an intrusion in a regional power utility last winter. It rewards a strategy document whether or not the strategy is funded. And it is a snapshot of data gathered before September 2024, so it predates most of the events and laws discussed below. The 2024 edition groups countries into five tiers: role-modelling for scores of at least 95, advancing from 85, establishing from 55, evolving from 20, and building below that. Globally, ITU placed 46 countries in the top tier, 29 in the second, 49 in the third, 56 in the fourth and 14 in the fifth.

Ten countries across four tiers

The overall scores below come from the ITU dataset as published by the World Bank, with the tier implied by ITU’s thresholds and the score from the 2020 edition in brackets. No country in the region reached the top tier.

• Kazakhstan: 94.05, Tier 2 (93.15)
• Azerbaijan: 93.92, Tier 2 (89.31)
• Georgia: 92.08, Tier 2 (81.07)
• Uzbekistan: 89.20, Tier 2 (71.11)
• Ukraine: 83.94, Tier 3 (65.93)
• Kyrgyzstan: 65.60, Tier 3 (49.64)
• Moldova: 65.25, Tier 3 (75.78)
• Armenia: 53.96, Tier 4 (50.47)
• Turkmenistan: 25.86, Tier 4 (14.48)
• Tajikistan: 25.36, Tier 4 (17.10)

Three patterns stand out. First, the top four are separated by five points, and Kazakhstan, Azerbaijan and Georgia all score the full 20 on the legal and cooperation pillars. At this level the index is mostly confirming that the paperwork is complete. Second, the bottom of the table is empty in specific places: Tajikistan and Turkmenistan score zero on the technical pillar, which covers national and sectoral incident response capacity. Third, Moldova is the only country here whose score fell between editions, from 75.78 to 65.25. Its weakest pillar is technical, at 6.68 out of 20, and it scores zero on the technical pillar’s national-framework indicator. Armenia’s organisational score is 2.81 out of 20, with zero recorded for a national strategy. Edition-to-edition changes should be read with care: they can reflect what a government documented and submitted as much as what it changed.

Where the scores and the record diverge

Ukraine is the clearest case of the index understating practice. It falls short of Tier 2 by about one point, yet no government in the region handles more hostile activity. CERT-UA counted more than 3,000 incidents in the first half of 2025, around a fifth more than a year earlier, and reported that Russia’s Sandworm unit continued to coordinate cyber operations with missile and drone strikes. In its review of the second half of 2025, CERT-UA reported the first half-on-half fall in incidents since the full-scale invasion, alongside a shift by attackers from quick data theft towards quiet, persistent access and a habit of returning to networks breached earlier to see whether the original weakness had been fixed. A falling count is not proof of safety. But it is evidence of practised detection, which no questionnaire item captures.

Moldova is the second case. On the night before the parliamentary election of 28 September 2025, the government reported more than 14 million attack attempts against state websites. The Information Technology and Cyber Security Service said it detected and neutralised them in real time, and that the electoral process was not affected. Targets included the Central Electoral Commission’s site and polling stations abroad. The defence was not total: an attack on the host.md hosting platform left about 4,000 websites out of service. A country the GCI scored lower in 2024 than in 2020 nonetheless kept its election infrastructure running under a large, coordinated attack. That combination is exactly what an index of documents cannot see.

Kazakhstan shows the gap from the other side. In June 2025 a database with records on about 16 million citizens, including names, addresses, individual identification numbers and phone numbers, circulated online. The Information Security Committee said inspections found no breach of government information systems, that the data dated from 2022 and had been compiled from earlier leaks, and that it was partly supplemented by users with access to systems as part of their official duties. If that account is right, the failure was not in perimeter defence but in controlling legitimate access to state databases. The GCI’s legal pillar gives Kazakhstan full marks; the leak suggests the harder problem is enforcement inside the public sector. The government had already raised fines for data-protection breaches in January 2025, to between 30 and 2,000 monthly calculation indexes, and added mandatory breach notification to citizens.

Laws written after the scores were collected

Because the index is a 2024 snapshot, it misses the region’s most substantial institutional change since then. Armenia, the lowest-scoring South Caucasus state, adopted a package of three laws in December 2025. The Law on Cybersecurity entered into force on 4 January 2026. It covers operators in 14 sectors, including energy, water, transport, telecommunications, finance and health, and hands supervision to an autonomous regulator, the Information Systems Regulatory Commission. Operators must notify an incident with material impact within 24 hours, update within 72 hours and file a final report within a month. The secondary legislation that gives these duties force was due within twelve months, so for most of 2026 the framework has been partly written rather than working.

This is the typical pattern. A law and a new body move a country up the GCI quickly, because the index counts their existence. Whether they change outcomes depends on things the index does not weigh: whether operators actually report, whether the regulator has technical staff, and whether the response team has the trust of private owners of infrastructure.

How to read the scores

Our view is that the GCI is useful as a floor, not as a ranking of resilience. A Tier 4 score, such as Tajikistan’s or Turkmenistan’s, is informative: the absence of a national response team or technical framework is a real gap, and it matters for investors whose assets would depend on national incident support. Above roughly 85, the index stops discriminating. The difference between Kazakhstan and Georgia says little about which would better withstand a destructive attack on its grid.

Better evidence of readiness is behavioural: published incident statistics, post-incident reporting, and performance under a known test such as an election. On that evidence, Ukraine and Moldova, both in the middle tier, have shown more than their scores suggest, while Kazakhstan’s top score sits beside unresolved questions about insider access to state data.

Three things are worth watching. The first is whether Armenia’s regulator and its secondary rules are in place by the start of 2027. The second is whether Kazakhstan’s leaks produce prosecutions of those with official access, not only higher fines. The third is the next GCI edition: if Ukraine and Moldova move up, it will be because their documentation caught up with practice, and readers should remember that the ranking follows events rather than predicting them.

Sources

• ITU — Global Cybersecurity Index 2024 press release (12 September 2024)
• World Bank Data360 — ITU Global Cybersecurity Index dataset, overall and pillar scores
• Government of Mauritius, ICT Indicators — Global Cybersecurity Index (GCI) tier definitions
• The Record — Russian hackers turn to AI as old tactics fail, Ukrainian CERT says (8 October 2025)
• The Record — Ukraine warns Russian hackers are revisiting past breaches to prepare new attacks (3 April 2026)
• IPN — The authorities confirm attempts of cyber attacks on government websites (28 September 2025)
• The Astana Times — What we know about data leak affecting 16 million Kazakh citizens (29 July 2025)
• Chambers and Partners — Cybersecurity 2026: Armenia (updated 17 March 2026)