Most Vulnerabilities that are frequently identified and reported locally, often has global connections, especially when using cloud services, hosts and other international services. The vulnerabilities have given CERT Vanuatu a better understanding of what types of cyber-threats Vanuatu could be facing or expecting in the years to come. Thus, necessary security measures are continuously introduced, developed and taken to address these vulnerabilities from escalating into severe cyber-attacks. Furthermore, there are other forms of vulnerabilities and threats seen in Vanuatu that involves online abuse and harmful digital communications (HDC) over the Internet and online platforms. The known online social threats are often caused by Internet users and are targeted towards both the government of Vanuatu and private sector organizations which automatically targeting Internet users who are caught up in between social issues in Vanuatu. This is a rising cyber safety issue and concern for the government and communities which must be addressed through policies, strategies and security best practices and mechanisms such as through the establishment of an ‘eSafety commission.’ 3.3 Reported and Recorded Cyber-threats in Vanuatu Given there are vulnerabilities identified in the networks and the cyberspace in Vanuatu, there has been a number of cyber-threats reported and recorded by CERT Vanuatu and its joint partners. The cyber-threats in Vanuatu are observed or detected across all domains and constituents of CERT Vanuatu, i.e. in both the government systems and networks, the private sector organization systems and civil society. Figure 1: Reported Cyber-threats in Q1, Q2, and Q3 of 2020 Figure 1 provides an account of the reported and recorded cases by the CERT Vanuatu office this year - 2020. This analysis is based on Quarter 1 (Q1), Quarter 2 (Q2) and Quarter 3 (Q3) of 2020. As observed in Figure 1, Phishing attacks (it accounts for 32% of the reported threats.) and Business Email Compromises (BEC) (32%) are the current common threats to Vanuatu’s Internet and cyberspace. However, compared to 2018 and 2019, the reported incidents cyber-threats/attacks collected and mitigated by CERT Vanuatu are of a smaller recorded volume which are summarized in Figure 2. Appendix 2 in the Appendices section of this strategy provides thorough details of the types of cyber incidents reported to the CERT Vanuatu office. These treats were reported using either emails, phone call, website portal and, or walking into the office and reporting the incident. The 2018 and 2019 incident reports were mainly from Government agencies and not as much from the private sector or communities. 11 | Vanuatu’s Cyber Security Strategy 2030