Global Cybercrime Attack Map Simulator

Global Threat Map

Attack rate 3.0/s

Ransomware & state-actor share 55%

Defense / patch level 45%

Attacks launched

Breaches

Blocked

Est. global loss

How it works

Every attack is a packet fired from an attacker node at the ring's edge toward a random target server. Each packet is randomly typed — ransomware, state-sponsored, phishing or zero-day exploit — weighted by the "ransomware & state-actor share" slider, and carries a rough cost drawn from that type's real-world order of magnitude. On arrival the target's defenses roll against the packet: a higher "defense / patch level" blocks a larger share of attempts outright (green flash), while everything that gets through counts as a breach (red flash) and its cost is added to the running total.

P(blocked) = defenseLevel × (1 − typeStrength)
lossAdded = breach ? costBase(type) × rand(0.6, 1.4) : 0
totalLoss += lossAdded

Attack rate — how many packets launch per second across the whole map; real-world ransomware alone runs at roughly 4,000 attacks/day worldwide.
Ransomware & state-actor share — the mix between high-cost, well-resourced attacks (ransomware gangs, state APTs) and lower-cost, higher-volume ones (phishing, opportunistic zero-days).
Defense / patch level — how well-hardened the targets are; this is the lever real organizations actually control, unlike the attackers' own budget or motivation.
Est. global loss — a stylized running total, not a forecast; it illustrates why global cybercrime is estimated at roughly $10.5 trillion/year, more than the GDP of every country except the US and China.

Real-world relevance: the same defense-vs-breach race plays out on every real network, from hospitals hit by ransomware to the SolarWinds supply-chain compromise — raising the effective "defense level" is the only lever that consistently bends the loss curve down.

Ransomware State-sponsored Phishing Zero-day Blocked

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.