ISIF Asia Fellowship · APNIC Foundation
The APAC NREN Cybersecurity Readiness Benchmark measures each National Research and Education Network across 7 operational security domains. A survey, public technical checks, document review and interviews feed one Readiness Index, and NRENs update it every year to track their progress.
Free and open Validated at APAN62 No NREN system is scanned
2026 regional average
51
/ 100Readiness Index
Level 2 · Developing
2026 baseline: survey (July–October 2026) with technical verification and interviews. Preliminary until the Phase 4 analysis is final.
Most targeted sector
Education and research face more attacks than any other sector.
Why it matters
An NREN connects a country's universities, research institutes and often schools. One breach or outage can cut thousands of students and researchers off at once, expose sensitive research data, and spread to every connected institution.
Many NRENs in the region run with small teams and tight budgets. That is exactly why knowing where you stand, and what to fix first, matters.
4,356
attacks a week on each education organisation
Education was the most targeted sector worldwide in January to July 2025, up 41% on 2024. In Asia-Pacific the figure was 7,869 a week.
Check Point Research, 2025US$16.6 billion
in cybercrime losses reported to the FBI in 2024
Up 33% on 2023, from 859,532 complaints. Phishing and spoofing were the most reported crimes.
FBI Internet Crime Report 202444%
of data breaches involved ransomware
Third parties were involved in 30% of breaches, double the year before, across 12,195 confirmed breaches.
Verizon Data Breach Investigations Report 2025US$4.44 million
average cost of a data breach worldwide
Breaches took an average of 241 days to identify and contain.
IBM Cost of a Data Breach Report 2025
Recent incidents
Well-documented incidents from the past three years, and the benchmark domain each lesson belongs to.
October 2023Rhysida ransomware stole about 600 GB of data, encrypted and destroyed servers, and took the national research library's systems offline for months.
Lesson · Incident Response
Have a tested recovery plan, keep backups the attacker cannot reach, and retire legacy systems.
February 2024Attackers entered through a remote-access portal that had no multi-factor authentication, then deployed ransomware. Data on 192.7 million people was exposed.
Lesson · Trusted Access
Require multi-factor authentication on every remote and privileged login.
April to June 2024Passwords stolen by infostealer malware, some dating back to 2020, opened cloud accounts without multi-factor authentication. About 165 organisations were notified.
Lesson · Trusted Access
Rotate old credentials, enforce MFA and limit access to trusted networks.
July 2024Not an attack: a faulty security-software update crashed about 8.5 million Windows devices, grounding flights and halting hospitals and banks.
Lesson · Continuity
Plan for failures as well as attacks: stage updates and practise recovery.
Figures from the linked reports, checked October 2026.
How it works
Assess
NRENs answer 19 questions across 7 domains, with evidence for each improvement.
Verify
Public registries (RPKI, DNSSEC, FIRST, eduGAIN…) independently check self-reported answers.
Score
Domain levels from 1 to 5 combine into a Readiness Index from 0 to 100.
Improve
Each NREN gets a yearly benchmark, a badge and a phased roadmap of next steps.
The framework
Governance & Policy
Who owns security decisions, whether there is a budget, and whether risk is tracked or assumed.
Monitoring & Observability
Day-to-day visibility into what is happening on the network: logging, alerting and NOC coverage.
Incident Response & CSIRT Capability
How prepared the team is to detect, contain, and learn from a security incident.
Routing & DNS Security
Two specific technical safeguards: RPKI (routing security) and DNSSEC (DNS security).
Trusted Access Services
How people log in, whether MFA holds up, and how access is controlled and reviewed.
Continuity Planning & Operational Resilience
Whether critical services keep running, or recover quickly, when something goes wrong.
Institutional Coordination
How connected the NREN is to the wider regional cybersecurity community.
See where your NREN stands in each domain
Free self-assessmentFor NRENs
Sign in to the NREN portal to update your answers each year and see your score improve after review.
Example badge. Each NREN's real badge appears on its scorecard.
News
By Project team1 min read
The project team has completed passive technical checks for 27 APAC NRENs using public registries: RPKI and Route Origin Validation, DNSSEC, FIRST, APCERT, Trusted Introducer and eduGAIN. The checks independently verify self-reported survey answers. No NREN system was scanned.
Read more
By Prof. Roshan Ragel1 min read
Prof. Roshan Ragel presented the early benchmark results at APAN62 in Auckland, in the session "Emerging NRENs Session 2: Cross-border Collaboration in Enhancing eNREN Security – From SOC to CIRT".
Read more
By Project team1 min read
The APAC NREN Cybersecurity Readiness Benchmark survey is now open to around 30 NRENs across 23 economies. The 30-minute survey covers 7 everyday parts of running an NREN and can be answered by up to three people per organisation: the Director/CEO, a Technical Lead and a NOC/CSIRT Lead.
Read more