“The main reason [for US superiority] is the relative standing of the two nations’ digital economies, where the US remains far advanced despite China’s digital progress,” said Austin, a senior fellow with IISS.

Austin noted the US has been building its dominance in cyberspace since the mid-1990s, and its power was amplified by its highly sophisticated intelligence-sharing networks, including with its partners in the Five Eyes alliance.

The report was compiled based on data from government documents, other open-source material and interviews with experts. The US was the only country in the top tier of the report’s ranking, denoting it had “world-leading strengths” in all the metrics.

Seven countries – Australia, Canada, China, France, Israel, Russia and Britain – were in the second tier, indicating they had strengths in some of the assessed categories.

The third tier included countries in earlier stages of development, such as India, Indonesia, Iran, Japan, Malaysia, North Korea and Vietnam.

North Korea’s hackers a more immediate threat than its missiles: experts

Despite these changes, the US has remained the world’s pre-eminent power in cyberspace by investing heavily in civilian and military capabilities as well as the world’s strongest digital industrial base, the report said. Its companies are capable of detecting and attributing state cyberattacks and the country has its own sophisticated offensive capabilities.

The report stressed though that the US is more politically and legally constrained than adversaries such as China, Russia, Iran and North Korea.

The report said China’s defences remain relatively weak and its resilience policies for critical infrastructure are still in the early stages of development.

The report noted how the Chinese Communist Party was “shocked” by the information leaked in 2013 by whistle-blower Edward Snowden as the revelations about the US government highlighted the extent of its advantages over China.

President Xi Jinping instigated a wave of organisational reforms and regulations, including reconfiguring and assuming personal leadership of the main body in charge of cyber policy and establishing a new government body, the Cyberspace Administration of China.

He also launched the “Made in China 2025” industrial policy that sought to make China dominant in global hi-tech manufacturing while reducing its reliance on foreign vendors for core internet technology.

China’s cyber intelligence capabilities are formidable domestically, the report said, noting it has the world’s most powerful domestic surveillance and censorship system. It has also developed and extensively used its capabilities for overseas espionage but its analysis and dissemination of intelligence is “less mature” than the US and its allies.

UK cyber spy chief warns China is poised to ‘control the global operating system’

“China’s influence in the global ICT [information and communication technologies] economy has risen commensurately, including through its development of online platforms,” the report said, referring to the growth of companies such as Tencent and Alibaba, which owns the South China Morning Post.

“China is a second-tier cyber power but, given its growing industrial base in digital technology, it is the state best placed to join the US in the first tier.”

Even so, the report said China’s dependence on foreign vendors for core internet technology remains a “large obstacle”. It still relies on US companies including Google, Microsoft, IBM, Oracle and Qualcomm.

But China, the report said, has distinct advantages, including its 1 billion internet users and the lower cost of Chinese technology, which make it attractive to developing countries.

China needs to create a cyber-industrial complex on the same scale as the US, the report said. That would mean a more productive relationship between university research, industry and government. China would also need to “radically improve” educational outcomes in cyber-relevant fields, including basic cybersecurity.

“Once these domestic foundations of cyber power equivalence were in place, China would then face a diplomatic challenge,” the report said. “To be able to wield its cyber power for global effect, it would have to begin to demonstrate an ability to work in alliance with other cyber-capable states.”

China actively amplifies QAnon conspiracy theories in the US, report says

Among other countries, Britain and Israel were rated highly on cybersecurity and core intelligence capabilities, as well as their use of offensive capabilities. France also scored well for cybersecurity and intelligence reach.

Other Asian nations lagged behind. For example, even though India has a large digital economy, the report said it has a “complex bureaucracy” that has slowed its advance in cyberspace. Its intelligence and offensive abilities were also focused regionally.

Iran, despite having displayed its offensive capabilities, lacks digital resilience and contingency preparedness due to technological, organisational and economic deficiencies.

Elsewhere, Indonesia has grappled with major threats from cybercrime and cyberterrorism, while Malaysia has yet to develop core intelligence or offensive capabilities, the report said.

Although Japan has a world-class hi-tech industry and is home to many tech firms, its cybersecurity capabilities remain limited. It is also unable to develop offensive capabilities for constitutional reasons. Japan was nevertheless well-placed to move from the third tier to the second tier, the report said.