Digital economies are being built at extraordinary speed on foundations nobody is securing, and the people who will pay are not the ones building them

Across the world, economic life has moved online faster than anyone planned. Wages arrive by transfer, small traders take payment by app, farmers check prices by phone, hospitals hold records digitally, students learn on platforms, and governments deliver welfare, identity and land registration through systems that did not exist a decade ago.

This has produced real gains, and the gains have reached people who were previously excluded. A market woman with a phone-based payment account has financial infrastructure her mother could not access. That is not a small thing.

But something has been built into these systems almost everywhere: they were designed for adoption, not for defence. Speed of rollout was the measure of success. Security was a later phase, and later has a way of not arriving.

The result is that a growing share of the world’s economic activity now depends on infrastructure that has never been seriously tested against people who want to break it.

Cybersecurity Is a Justice Question

It is tempting to file this under technical risk, a matter for specialists and insurance. That framing misses what is actually at stake, because the harm from a security failure is not distributed evenly.

When a bank is breached, the institution absorbs a loss and recovers. The customer whose savings vanished may not. When a hospital system is encrypted by ransomware, the organisation eventually pays or rebuilds. The patient whose treatment was delayed carries the consequence in their body. When a national identity database leaks, the state issues a statement. The citizen whose data is now permanently in circulation cannot recall it.

The pattern is consistent: institutions experience security failures as cost, and individuals experience them as harm. And the individuals least able to absorb the harm are the ones with the fewest reserves, the least legal recourse, and the smallest chance of being compensated.

This makes cybersecurity a question of solidarity rather than merely of engineering. An organisation that under-invests in security is making a decision about who will bear the risk, and it is generally deciding that someone else will.

The Asymmetry Nobody Fixed

There is a structural problem underneath the individual failures.

Attackers need to find one weakness. Defenders must cover everything. Attack tools are cheap, increasingly automated, and now widely available to people with no technical training. Defence requires sustained expenditure, scarce expertise, and organisational discipline that produces nothing visible when it works.

This asymmetry has always existed. It has widened sharply, because automation has industrialised the attacker’s side. Phishing that once required a person to write a convincing message can now be generated at scale, personalised, and translated into any language. Reconnaissance that took weeks takes hours. The barrier to entry for serious crime has collapsed.

Meanwhile the defender’s side has not automated at the same rate, and the gap falls hardest on organisations that were already stretched: small businesses, hospitals in under-resourced systems, municipal governments, schools, and the fintech startups serving people who have no alternative provider.

Where Exposure Concentrates

Some regions carry more of this risk than others, and it is worth naming why.

Rapid digitisation without rapid capacity-building. Countries that leapfrogged directly to mobile money and digital identity acquired the exposure of a mature digital economy without decades to develop the security institutions that older systems built incrementally.

Skills concentrated elsewhere. Cybersecurity expertise is globally scarce and highly mobile. Professionals trained in one country are recruited by employers in another, and the countries that most need domestic capability are the ones losing it fastest.

Regulatory frameworks without enforcement capacity. Data protection laws have been adopted widely. Supervisory authorities with the technical staff, funding, and legal authority to actually investigate a breach are considerably rarer.

Critical services with no redundancy. Where a single payment platform or identity system serves a large share of the population, its failure is not an inconvenience. It is a national event.

None of this is an argument against digital development. It is an argument that security capacity is part of digital development rather than an optional accompaniment to it, and that treating it otherwise builds fragility into economies that can least afford to fail.

Trust Is the Actual Infrastructure

The deepest cost of insecurity is not the money stolen. It is trust withdrawn.

People who have been defrauded once go back to cash. Businesses that lost data to a breach revert to paper. Communities where a mobile money scam swept through will not adopt the next service, however good it is. The economic damage of that withdrawal exceeds the direct losses by a wide margin, and it is much harder to reverse, because trust is rebuilt far more slowly than it is lost.

This means security is not a constraint on digital economic growth. It is the condition of it. An economy where people believe their money, records and identity are safe can build on that foundation. An economy where they do not will see adoption stall regardless of how sophisticated the technology becomes.

What Would Change Things

Security as a design requirement, not a later phase. Retrofitting protection onto a deployed system is expensive, partial, and usually incomplete. Building it in is cheaper and works better, and every serious engineer knows this.

Domestic capability, deliberately built. Universities training security professionals, national response teams with real authority, and career paths that give people reasons to stay. This is slow work and it is the only durable answer.

Regulators that can actually regulate. A data protection law without an authority capable of technical investigation is a statement of aspiration. Funding supervisory bodies properly is unglamorous and decisive.

Duties proportionate to what is held. An organisation holding the biometric records of millions has obligations that a small retailer does not. Frameworks that treat these identically protect neither.

Cross-border cooperation. Attacks route through multiple jurisdictions by design. Investigation and prosecution require cooperation that most countries have not established with most other countries.

Honest disclosure. Organisations that conceal breaches protect their reputation at the direct expense of the people whose data was taken, and who could have acted had they known. Mandatory, timely notification is a matter of basic honesty toward the affected person.

The Person Behind the Breach

Catholic social teaching has insisted for over a century that economic arrangements must be judged by their effect on the vulnerable rather than by aggregate performance. The principle applies cleanly here.

A digital economy that grows quickly while leaving ordinary participants exposed to loss they cannot absorb has not succeeded. It has transferred risk downward and called the result efficiency.

Behind every breach statistic is a person: a trader whose working capital disappeared overnight, a patient whose diagnosis is now circulating, a family whose identity documents are being used by someone else, a pensioner who lost savings to a message that looked exactly like their bank.

They are the reason this matters, and they are almost never in the room when the decision to defer security spending is made.

Building digital economies is worth doing. Building them on foundations that will not hold is not a technical oversight. It is a decision about whose losses are acceptable, and it deserves to be recognised as one.