Abstract

Cyber risk has emerged as a systemic threat to economic stability, financial markets, and sustainable development. Beyond its technological
dimension, cyber risk is increasingly recognised as an Environmental, Social and Governance (ESG) concern, particularly within the governance
pillar, where digital resilience, institutional quality, and risk transparency play a central role. However, reliable cross-country assessment remains
challenging due to severe data sparsity and heterogeneity in reporting standards.

We propose a network-based distributional framework for modelling country-level cyber risk. Building on recent advances in optimal transport
theory, we employ Wasserstein propagation over economic similarity networks to infer cyber attack severity distributions for countries with
incomplete or missing data. For each country with available observations, we construct the empirical probability distribution of cyber attack
severity, measured on an ordinal scale. These distributions are then propagated through a governance-based similarity network constructed
using Worldwide Governance Indicators, enabling the estimation of risk profiles while preserving the intrinsic geometry of the distributions.
Our approach operates directly on probability measures and leverages entropy-regularised Wasserstein distances together with barycentric
smoothing to ensure numerical stability and interpretability. We compare alternative network topologies and show that salience-based structures
provide an effective balance between predictive accuracy and network sparsity.

From an ESG perspective, the framework enables (i) identification of governance-related cyber vulnerabilities, (ii) assessment of systemic
propagation channels across interconnected economies, and (iii) evaluation of cascade dynamics through centrality-based shock simulations.
Results indicate that highly central countries act as amplification hubs, with significant implications for global financial resilience and sustainable
investment risk assessment.

The proposed methodology provides a scalable statistical tool for integrating cyber risk into ESG analytics, supporting policymakers, regulators,
and sustainable finance stakeholders in designing resilience-oriented strategies within an increasingly digitalised global economy.