Nuclear security conditions are dramatically declining in Russia and the United States due to the suspension of crucial international cooperation, increases in quantities of weapons-usable nuclear materials, and weakened security oversight.

• The United States’ overall score decreased by 10 points, the largest negative change ever shown by a country between editions of the NTI Index.
• Three executive orders issued by the United States in 2025 have undermined the political independence of its nuclear regulator and implementation of internationally accepted principles of security culture.
• Russia’s overall score decreased by seven points between 2023 and 2026, continuing a trend of decline that began in 2020.
• Since the 2023 NTI Index, Russia has produced enough new weapons-usable nuclear materials for more than 300 weapons (4,000 kilograms).

A geographically varied group of 12 countries has emerged as the new driving force for global progress on nuclear security by sustaining domestic progress, offering support to other governments, and increasing engagement with key international institutions. With tensions between China, Russia, and the United States disrupting the established dynamics of nuclear security leadership, several countries are newly stepping forward and driving global progress: Australia, Canada, Finland, Ghana, Hungary, Japan, Jordan, the Netherlands, Senegal, Ukraine, the United Arab Emirates, and the United Kingdom.

• Between 2018 and 2026, Finland improved requirements for tests and assessments of security systems, insider threat awareness programs, security culture assessments, and joint exercises between on-site and off-site response forces.
• Since the creation of the Sabotage: Protect Facilities ranking in 2016, Hungary has maintained strong regulatory frameworks (including construction-phase cybersecurity and security culture assessment requirements) and has participated consistently in the Nuclear Security Guidance Committee. In 2026, Hungary contributed to the IAEA Nuclear Security Fund for the first time since 2018.
• Jordan established requirements for comprehensive tests and assessments of security systems, insider threat awareness programs, and security culture assessments in 2020, and joined the Nuclear Security Guidance Committee in 2023.
• Since the 2023 NTI Index, Australia, Canada, Finland, Japan, the Netherlands, and the United Kingdom have contributed to the IAEA Nuclear Security Fund, have become founding members of the Global Forum to Prevent Radiological and Nuclear Terrorism, have participated in the G7 Global Partnership, and have sent ministerial-level representation to the 2024 IAEA International Conference on Nuclear Security.
• Since the 2023 NTI Index, 13 countries (Armenia, Bosnia and Herzegovina, Burkina Faso, Côte d’Ivoire, Cuba, Georgia, Ghana, Greece, Mongolia, Morocco, Qatar, Senegal, and Uruguay) without weapons-usable nuclear materials have joined the Nuclear Security Guidance Committee, bringing the total number of participating countries to 52.
• Ghana, the Philippines, and Senegal—countries planning civil nuclear energy programs—participate in the Nuclear Security Guidance Committee, sent ministerial-level representation to the IAEA International Conference on Nuclear Security in 2024, and attended the 2022 Review Conference for the Amended Convention on the Physical Protection of Nuclear Material.

Countries operating the largest spent fuel reprocessing facilities are posing significant and unnecessary risks to global nuclear security by rapidly accumulating stocks of separated plutonium and falling short of international nuclear security standards.

• Eight countries currently operate reprocessing facilities (China, France, India, Israel, Japan, North Korea, Pakistan, and Russia), down from nine in 2022 following the United Kingdom’s closure of the Sellafield facility.
• Of the eight reprocessing countries, only Japan has regulatory requirements for insider threat awareness programs at nuclear facilities.
• India, Israel, and North Korea have no regulatory requirements for nuclear facilities to maintain inventory records.
• France, the world leader in reprocessing by tonnage, has accumulated 32,900 kilograms of civil separated plutonium since 2020, enough for over 4,000 nuclear weapons. This brings its total stockpile of separated plutonium to 119,700 kilograms.
• Stockpiles of civil separated plutonium have grown rapidly in India, Pakistan, and Russia. These three countries produced an additional 3,960 kilograms of separated plutonium since 2023. Russia holds the world’s largest stockpile of separated plutonium at 193,000 kilograms.
• Of the 47 countries and Taiwan with nuclear facilities, 40 maintain a once-through fuel cycle. Ten of the 40 countries and areas that maintain a once-through fuel cycle have explicitly committed to forgoing reprocessing (Australia, Finland, Germany, Indonesia, Romania, Spain, Sweden, Switzerland, the United Arab Emirates, and the United Kingdom).

Stockpiles of highly enriched uranium are increasing in a handful of countries, despite the downward trend in total global inventories.

• Global inventories of HEU exceed 1,254,000 kilograms, enough for more than 50,000 nuclear weapons.
• Global HEU inventories decreased by just 6 percent (81,200 kilograms) since 2023.
• National stockpiles of HEU increased collectively by over 5,000 kilograms from 2023 to 2026 in Belgium, Germany, India, Iran, Pakistan, and Russia.
• Of the 22 countries with weapons-usable nuclear materials, just 4 (Australia, France, Germany, and the United Kingdom) have made annual public declarations of their HEU inventories over the past decade.

Personnel-related nuclear security measures—including insider threat prevention, security culture, and comprehensive vetting programs—are weak or absent in most countries and areas with weapons-usable nuclear materials or nuclear facilities. Among the 50 countries and areas with weapons-usable nuclear materials or nuclear facilities:

• Just 14 countries (Argentina, Australia, Belgium, Brazil, Canada, Finland, Hungary, Indonesia, Jordan, Norway, Slovenia, Ukraine, the United Arab Emirates, and the United Kingdom) have implemented requirements for nuclear facility operators to conduct security culture assessments. Thirty-five countries and Taiwan still have no such requirement.
• Seven countries (Algeria, Bangladesh, Egypt, Kazakhstan, Mexico, Morocco, and South Africa) have no regulatory requirements to screen personnel before hiring them.
• Just 20 countries require personnel vetting that includes background checks, drug tests, and psychological or mental fitness evaluations. Canada, Indonesia, the United Arab Emirates, and Uzbekistan were the only countries to improve their personnel vetting requirements since the 2023 NTI Index.
• Twenty-five countries and Taiwan (52 percent) require employees to report suspicious activities at nuclear facilities. Progress has stagnated with no additional countries having introduced these requirements since 2023.
• Twenty-eight countries (56 percent) do not require personnel to participate in training programs on both insider threat and cyber threat awareness. Since 2020, Belgium, Japan, Ukraine, the United Arab Emirates, and Uzbekistan are the only countries that have introduced new requirements for both types of programs.

Most countries and areas with nuclear facilities have cybersecurity requirements that are outdated in design, incomplete in scope, and insufficiently tested to keep pace with evolving threats. Among the 47 countries and Taiwan with nuclear facilities:

• Nine countries have no basic requirements to protect nuclear facilities from cyberattacks (Algeria, Argentina, Bangladesh, Egypt, Indonesia, Mexico, Morocco, North Korea, and Peru).
• Eleven countries have comprehensive requirements that include a cybersecurity program during facility construction to address supply chain vulnerabilities (Belgium, Canada, Finland, Hungary, Iran, Jordan, Slovenia, South Korea, Ukraine, the United Arab Emirates, and the United States).
• Fourteen countries (up from 11 in 2023) have a modern approach that protects assets on the basis of the function of the system they support, the probability that they could be compromised, and the potential severity of that outcome.
• Nineteen countries have requirements for mandatory cybersecurity awareness programs for personnel with access to digital systems.
• Twenty-nine countries and areas require tests and assessments of cybersecurity measures, but only 11 require that they be conducted at least annually.

The International Atomic Energy Agency has not updated its benchmark guidance for nuclear security in 15 years, leaving growing gaps in its coverage of insider threats, cybersecurity, and emerging technologies. The revision of this guidance, initiated in 2024, presents an opportunity for countries to provide input on the development of new best practices addressing modern threats.

• Thirty-two countries and Taiwan with nuclear facilities have no insider threat awareness program, an issue inadequately covered by INFCIRC/225/Rev.5.
• Only 11 countries and Taiwan require cybersecurity assessments to be conducted at least annually.
• Nineteen countries lack basic requirements for assessments of cybersecurity measures, although six have implemented such requirements since 2023 (Belgium, Chile, Indonesia, Slovenia, the United Arab Emirates, and Uzbekistan).

Progress has stalled on developing technical support institutions, requiring threat-based testing, regularly updating design basis threat, and building cybersecurity capacity among regulatory bodies and technical support organizations in countries and areas with weapons-usable nuclear materials and nuclear facilities. Among the 50 countries and areas with weapons-usable nuclear material or nuclear facilities:

• Forty countries and Taiwan have established institutions to provide nuclear security technical support to their regulatory bodies.
• Fourteen countries do not have technical cybersecurity institutions with a nuclear security role.
• Only 16 countries require personnel with security responsibilities to undergo additional training or certification.
• Just 12 countries require both realistic threat-based evaluations and regular force-on-force exercises to assess nuclear security systems’ effectiveness. Since 2020, Finland and France are the only countries that have strengthened their regulations to include these requirements.
• Thirteen countries and Taiwan do not require use of a regularly updated DBT.
• Five countries that require a regularly updated DBT do not explicitly include cyber threats in the threat assessment process (Algeria, Kazakhstan, Morocco, Peru, and Turkey). Just two countries have added these requirements since 2023 (Armenia and Ukraine).

Countries and areas with weapons-usable materials or nuclear facilities have not consistently adopted and implemented measures designed to protect nuclear infrastructure from complex and sustained crises.

• Twenty-seven countries with nuclear facilities are currently in conflict. From March 2025 to May 2026, 16 (Belarus, Brazil, Chile, Egypt, France, Germany, Indonesia, Iran, Israel, Jordan, Pakistan, Peru, Russia, Sweden, Ukraine, and the United Arab Emirates) experienced confirmed battles or explosions within 10 miles of their facilities.
• Thirty-eight of the 50 countries and areas with nuclear facilities or weapons-usable nuclear materials have all-hazards plans in place to protect nuclear infrastructure in the event of natural or human-made disasters, leaving 11 countries and Taiwan with no plan at all.
• Of the 38 countries with all-hazards plans, only 18 require that the plans be tested at defined intervals.
• Since the 2023 NTI Index, Slovakia is the only country that has developed an all-hazards plan to protect nuclear infrastructure, and Brazil, India, Switzerland, and the United Arab Emirates are the only countries that have instituted annual testing requirements.
• Thirty-three of the 50 countries and areas with nuclear facilities or weapons-usable nuclear materials (66 percent) conduct joint exercises between on-site and off-site responders, but only 21 conduct their exercises annually. No new country has instituted a requirement for joint exercises since 2023, and only Finland and Switzerland have introduced annual testing requirements.
• Thirty-one of the 50 countries and areas with nuclear facilities or weapons-usable nuclear materials have endorsed the IAEA’s Seven Indispensable Pillars for Ensuring Nuclear Safety and Security During an Armed Conflict. Of those 50, 41 have ratified Additional Protocol I of the Geneva Conventions.
• Forty of the 50 countries and areas with nuclear facilities or weapons-usable nuclear materials participated in the IAEA’s 2025 ConvEx-3 field exercises, a multilateral exercise that stress-tests domestic, regional, and international emergency preparedness.

Forty-seven countries have not ratified the Amended Convention on the Physical Protection of Nuclear Material, and implementation remains uneven among those that have.

• Forty-seven countries have not yet ratified the Amended CPPNM, with the largest gaps in Sub-Saharan Africa (18 countries), Asia-Pacific (14 countries), and Latin America and the Caribbean (10 countries).
• Sixteen states parties to the Amended CPPNM have not designated a competent authority to be responsible for implementing the treaty, a statistic that has not improved since the 2023 NTI Index.
• Five of the 46 countries and areas with weapons-usable nuclear materials or nuclear facilities that are party to the Amended CPPNM (Bangladesh, India, Morocco, South Africa, and Uzbekistan) have not met their treaty requirement to submit reports to the IAEA describing the national legislation implemented to give effect to the treaty. Of the 17 countries that attended the 2022 Review Conference for the Amended CPPNM as observers, 7 have since ratified the treaty: Belarus, Laos, Mongolia, Mozambique, Oman, South Africa, and Zimbabwe.

The gap between political commitment and national implementation of radiological security is widening, with governments pledging adherence to international best practices but lagging in the development and implementation of security measures. Among the 176 countries and areas in the Radioactive Source Security Assessment:

• Eight countries have made political commitments in support of the IAEA’s Code of Conduct on the Safety and Security of Radioactive Sources since the 2023 assessment, increasing the total to 148 countries.
• Twenty-six countries have committed to abide by the IAEA’s Guidance on the Management of Disused Radioactive Sources since the 2023 assessment, increasing the total to 75 countries.
• Fifty-four countries and areas lack any security requirements for radioactive sources, with just three countries improving since the 2023 assessment.
• One hundred forty-six countries have a dedicated regulatory body with oversight for safety and security of radioactive sources, though no new countries have established one since the 2023 assessment.
• Ninety countries and areas do not maintain a registry of radioactive sources to support regulatory oversight, with just one country enacting laws to require a national registry since the 2023 assessment.