ASSESSING RISKS AND CYBERCRIME HARMS

Mission

To build the first comprehensive and validated framework that identifies, measures and communicates the full spectrum of cybercrime harms.

ARCH is a research project focused on cybercrime, online harm and the digital environments in which technology-enabled threats emerge. Launched in 2026, it is a three and a half year project that brings together an international team with interdisciplinary expertise to support a deeper understanding of contemporary cybercrime and its prevention.

project arch

Cybercrime’s hidden toll extends far beyond headline-grabbing data breaches. Financial losses are only the beginning: each attack ripples outward into untold harms including psychological distress, reputational damage, supply-chain interruptions and eroded public trust.
The Assessing Risks and Cybercrime Harms (ARCH) Project answers this challenge by delivering a truly multidimensional “costs-of-harms” framework that integrates direct, indirect and cascading impacts across individuals, organizations and public institutions to support more effective prevention, investigation and policy responses.
The project seeks to build the first comprehensive and validated framework that identifies, measures and communicates the full spectrum of cybercrime harms across individual, organizational and societal domains, using rigorous multi-source data collection, innovative analytic methods and open knowledge tools that support effective prevention, response and resilience measures.
The project brings together expertise in criminology, psychology, economics, social science, cybersecurity, data analysis, legal and regulatory issues. Its work focuses on producing practical, evidence-based knowledge that can support public institutions, researchers and other stakeholders working to understand and respond to emerging digital threats.

research areas

ARCH will develop methods enabling the connection of various forms of data in order to create a combined cybercrime harm scale. It will leverage existing data as well as collect novel data in order to produce a measurement of harm that is both inclusive and representative of the range of negative outcomes flowing from cybercrime.