The proliferation of offensive cyber capability
For a decade, the economics of offensive cyber drifted in one direction. Tools grew cheaper, marketplaces deeper, and freelancers more capable. Mounting a serious attack no longer required a state intelligence service; a competent operator and a credit card would do. Defenders adjusted, and the system held. Damage attributed to cybercrime now runs into the trillions of dollars annually.
The cost curve has shifted
Artificial intelligence has changed the curve. The drift of a decade is being compressed into a far shorter cycle, and the capability behind each price point has deepened. Reconnaissance, social engineering, vulnerability discovery and exploit development, work that once rationed serious offensive cyber to a small cadre of skilled operators, are being automated and sold as off-the-shelf services. Attacks have become cheaper, faster and available to a much wider set of actors. The shocks of the past two decades, from Estonia in 2007 to WannaCry, NotPetya, SolarWinds and the war in Ukraine, drew regulatory adjustments, but none shifted the cost curve. This has.
Defenders entered the AI era with practices designed for a slower threat: annual penetration tests, quarterly patch cycles and four-eyes controls written for one human checking another. Both speed and cost have moved against them.
The window between a software flaw becoming public and a working exploit being in circulation has collapsed from months to days, with weaponisation now sometimes preceding disclosure. Around half of the zero-days observed in the wild in 2025 targeted enterprise technologies, with edge security and networking equipment (the perimeter on which most of the rest depends) taking the largest share. Different data series point the same direction: defenders are being asked to remediate within a window the attacker can close in an afternoon.
The marginal cost of an attempt has fallen by orders of magnitude. General-purpose AI can now perform substantial portions of the intrusion workflow, from the reconnaissance that opens a campaign to the localisation that adapts it for the target market. The decisive effect is parallelism: many tailored attempts running at once, against many targets, on the same infrastructure that powers the rest of the digital economy. The first campaigns combining several intrusion steps under AI direction were disclosed in late 2025; the structural shift holds whatever line is drawn on machine autonomy.
The asymmetry runs deeper than tooling
The defender’s costs do not move on the same curve. An attacker only needs one path to succeed and can tolerate a high error rate, since a wasted attempt costs almost nothing. A defender must cover every path and cannot tolerate the same error rate, because a false positive isolates a hospital or freezes a payment rail. Many consequential defender actions, such as blocking, attributing, sanctioning or taking a service offline, are acts of public authority. The requirement that they be lawful, reversible and explainable is where defender AI hits its ceiling.
The asymmetry is also uneven across the digital estate. It hits the systems hardest that are easy to attack and slow to patch, such as industrial controllers, medical devices or the legacy estate that runs much of government and banking. Its bite is weaker on systems that can be tested, fixed and re-deployed at machine speed, such as browsers, mobile platforms and modern cloud-native services. In between sit complex distributed systems. Their flaws are easy to find in code but hard to verify in practice. A strategy that treats the whole problem as one will misallocate effort. The chapters that follow distinguish what the state can re-engineer from what it can only contain and set policies accordingly.
Proliferation and systemic risk
Offensive cyber capability now sits in a single market that runs from state intelligence services at one end to individual freelancers wielding AI tools at the other, with contractor companies, ransomware affiliates and information-operation shops in the middle. Their boundaries are deliberately blurred, and capability has deepened in each tier. The legal categories that govern state responsibility were drafted for a physical world in which the aggressor’s hand was easier to see. The result is a permissive market for sustained pressure that does not cross the threshold for the use of force.
The shift also turns cyber risk from a technology problem into a systemic one. The same tooling, applied in parallel, can target the common software, cloud platforms, payment rails and managed-service vendors on which many essential entities depend. The International Monetary Fund has begun to treat AI-era cyber risk as a question of financial stability; the European Central Bank has warned that AI can chain individually minor vulnerabilities into serious attacks faster than the conventional patch cycle can respond. The campaigns that this market now supports, and the political effects they may produce, are the subject of the next chapter.
Cyber conflict on a national scale
The last chapter described economics. This chapter describes the purpose of that market in this economy. A sustained cyber campaign against a parliamentary democracy is rarely fought with the intent to destroy. It is fought to make a country look broken to its own citizens, and to make the government respond slower than the news cycle. Every piece is kept just deniable or ambiguous enough to ensure the response stays national and slow rather than allied and fast.
Disruption is the means. The erosion of public trust is the end.
Four effects, in order
The campaign pursues four effects; in roughly the order it can deliver them. Services are disrupted until citizens feel the inconvenience. The information environment is distorted until the press office responds rather than announces. Officials are demoralised until decisions slow and statements weaken. These three effects lead to the fourth: the erosion of trust. A parliamentary democracy holds its legitimacy on a single condition: that citizens believe the machinery of the state, its institutions and digital systems, works as advertised. Sustained pressure attacks both beliefs. Doubt accumulates among enough citizens, journalists, allies and markets to alter what the country’s government seems able to do. The campaigns fall just inside the gap between what the free press can plausibly report and what an open court can adjudicate.
Two methods: impersonation and cascade
Attackers rely on two operational methods to achieve these four effects. The first is impersonation: the aggressor forges the speech, signatures and records by which a government is believed. The second is cascade: the aggressor chooses targets in such a way that a single break propagates through every system that depends on it. Impersonation manufactures the doubt; cascade scales it. The cheapest path to national-scale effect is therefore a slow accumulation of disruption, distortion and impersonation, sequenced to compound and erode public trust, rather than a single spectacular intrusion.
Work is divided across the tiers introduced earlier. The aggressor state buys depth from its own offensive units, breadth from contractor companies that front as commercial firms, and volume and noise from the criminal and hacktivist market that sits below them. Each tier hands work to the next, and each adds a layer of deniability the next tier inherits.
Table 2 illustrates seven instruments that recur across the categories of campaigns seen in recent years, none of them new in kind. In any specific incident, attribution is probabilistic and contested.
AI is a multiplier for each instrument. The first reported case of an AI system orchestrating much of the intrusion lifecycle with limited human direction was disclosed in late 2025; whether that case is considered the inflection point, the cost shifts that would make such a campaign profitable have already happened.
Why the law arrives late
The whole apparatus is calibrated to fall just short of any treaty article that would justify collective response, including the use of armed force. Article 51 of the United Nations Charter recognises the right of (collective) self-defence against an armed attack. NATO has recognised that the impact of significant malicious cumulative cyber activities might, in certain circumstances, be considered as amounting to an armed attack and could lead to the invocation of Article 5 (the collective defence clause based on UN Charter Article 51) of the North Atlantic Treaty on a caseby-case basis. In practice, the threshold is high and case-specific, and sub-threshold campaigns are engineered precisely to stay below it: each incident ambiguous on its own, and impossible to add up in time to act. Operations are routed through proxies whose contractual relationship to the state can be acknowledged, denied or redrawn as the diplomatic season demands. Infrastructure sits in jurisdictions outside the relevant mutual legal-assistance treaties. Indictments name individuals who will not travel, and sanctions hit shell companies. The legal instruments work slowly, and on the wrong actors.
Coordination is what makes response instruments timely. Response instruments are slow individually and only bite when several states act together: joint attribution, coordinated takedowns of state-proxy and ransomware infrastructure, sanctions against the financial rails that pay them, and supplier discipline on offensive AI capability.
The campaign is engineered to sit between what the free press can realistically report and what a court can adjudicate. The defence must operate in that gap, or it will arrive too late and be too narrow to matter. The doctrine that follows is built for that gap.
Cyber resilience policies in the age of AI
National cyber resilience is a state’s ability to maintain essential democratic, economic and public-service functions during and after cyber disruption, while preserving legal accountability, public trust and coalition interoperability.
Chapter 1 set out how frontier AI has changed the cost curve of offensive cyber work, which has led to the proliferation of offensive cyber capabilities. Chapter 2 set out the political objectives such campaigns are designed to achieve; rarely territory or money alone. The prize is the erosion of public trust in the institutions on which a free society depends, and most of the apparatus is calibrated to win that prize while staying below the threshold at which collective response would be lawful.
The policy question, then, is not how to defend everything against everyone. It is where national effort has the greatest effect on the economics of attack and defence, and where it can deny the attacker the political prize even when a technical attack succeeds.
That framing is familiar. States have long defended themselves against large adversarial forces by choosing their ground rather than matching mass. They decide in advance what must not fall, prepare it deliberately, train the population for its role, contest the information space, and bind themselves into alliances that make isolated coercion expensive. The same logic now applies in the digital domain, where the asymmetry between a well-resourced attacker and an ordinary defender has widened, and the volume of plausible attackers has risen at the same time.
The six policies that follow apply that logic to the digital estate. They choose the ground (Policy 1, the Minimum Viable State), harden the points through which trust is exercised (Policy 2, the National Trust Backbone), raise the floor under everything else through enforceable standards (Policy 3), defend the resulting estate at machine speed and within the law (Policy 4), mobilise the country as a single defensive system (Policy 5), and protect the political prize directly by telling the truth first (Policy 6). They are intended to be read as one doctrine rather than six initiatives, each addressing a part of the same problem, and the gaps between them are where adversaries will look first. Table 3 summarises the effect of the policies.
Name the functions that if lost harm life, financial system, public order or the state, and rehearse a fallback for each.
Anchor digital trust in a set of services hardened to a level past the point where breaking them is affordable.
Close the cheap path with a baseline for all, forcing adversaries to spend more on attacks.
See the estate, shrink it, and let the defender act inside the attacker’s window rather than after it.
Spreads defence across a national workforce, so that capacity scales with the threat.
Trust survives openness, not suppression, and becoming proactive in transparency is the easiest means to deny the aggressor the political payoff.
Policy 2. Harden the National Trust Backbone
Decide where trust comes from
In a digital state, trust is national infrastructure, not a property each system has to invent for itself. Whether a ministerial notice is genuine, whether a contract was really signed by the person named, whether a property register entry is the one the law recognises: these questions should have the same answer, drawn from the same hardened foundations, whether the party asking is a citizen, a bank, a regulator or a piece of software acting on behalf of any of them. The country needs a federated family of trusted services (identity, signature, registers, exchange, audit, hosting) through which every consequential act inherits its authority. Call it the National Trust Backbone. The Backbone is defined by assurance rather than provenance: it is the set of services, public or private, that the country cannot afford to lose trust in, held to one top-tier standard. A national identity service (or other elements of digital public infrastructure), an interbank clearing rail and a critical legal registry may all sit inside it; what they share is the standard, not the sector. Name it in law, fund it, federate it, and let the rest of the state, and the wider economy, lean on it. Where Policy 1 chose the functions that must not fail, the Backbone is the family of services, owned by various parties under a common regulation, from which those functions inherit their legal and digital authority.
Inherit trust from hardened services
The argument is that digital trust should be inherited from hardened national foundations, rather than reinvented system by system. The backbone is a legally recognised family of federated trust services, held to one top-tier assurance standard, with redundancies and fallbacks. A set of components, audited to the top standard, reaches a level of assurance no patchwork of sectoral half-builds will match. Some solutions are commercial, state-owned, or pooled with allies; the model varies, the standard does not. Table 5 shows the key layers in the trust backbone.
The same logic makes the backbone the country’s highest-payoff target: the more it carries, the more an attacker gains from breaking it. The answer is not to scatter trust thinner, but to spend more on the federated set already chosen: segmentation, cryptographic agility and post-quantum migration, independent audit and rehearsed fallback. Concentrated investment in plural, hardened services makes the attacker’s bet unprofitable.
Containing the blast radius: graceful backbone failure
The backbone must be designed on the assumption that a component will eventually be compromised, and that the damage must be contained at the layer where it occurs. Estonia’s 2017 ID card chip flaw, which forced the precautionary suspension of certificates on some 750,000 cards, showed why: the country kept functioning because it had more than one way to prove who you were. Four principles make this possible.
Redundancy where it matters most. No critical trust function should depend on a single product or cryptographic family. A mature digital state runs several means of authentication in parallel issued under one legal regime but built on different stacks. The same logic applies to signature, time stamping and the hosting of consequential workloads.
Fallbacks that have actually been used. A second route that has never carried real traffic is a hope, not a fallback. The backbone’s alternatives should be in routine use and rehearsed on a published timetable; switchover targets are measured in days.
Integrity that travels with the record. Authoritative registers are the country’s memory of legal facts. Every consequential entry is signed at source, chained to its predecessors, and verifiable by any recipient without trusting the operator. A successful intrusion then becomes an event that can be detected, bounded and reversed, rather than one that has to be believed or denied.
Separation that prevents propagation. Registers are kept apart, each holding only the records its regulated function requires. The service that signs is separated from the service that issues identities. Data moves through a controlled exchange channel rather than by handing out copies, and the most important registers have a second home, across redundant clouds, or in a friendly country under a treaty. Backbone identity and signature are the ordinary route for any consequential act, including those taken by software agents, whose credentials are issued for the job and the moment and revoked when those are done. Standing privileges age into liabilities.
A backbone built this way is still not invulnerable, but it can absorb a compromise and keep the state running — which, at national scale, is the only useful definition of hardened.
Policy 5. Mobilise total cyber defence
Train the country, not only the cyber team
Cyber resilience, like any form of national defence, must be built against the threat it faces. The principle is old: a state sizes its forces, its reserves and its civil preparations to the adversary. In most countries, cyber defence has yet to be brought fully under this discipline. It should be planned whole-of-society, with manpower, reserve capacity and citizen literacy calibrated to a measured threat curve, reported publicly and held to the same standard of accountability as the armed forces themselves. A government that cannot say whether its cyber-capable workforce is growing faster than the danger it faces cannot claim to be defending the country in any serious sense. A digital state needs cyber capacity on the scale of a national workforce, planned the way the Nordics plan total defence, not as a personnel programme bolted onto a security strategy.
Plan capacity as one national output
The closest precedent is the doctrine of total defence: the Nordics, Singapore and Switzerland treat military capacity as a single national workforce, in which conscripts, reservists and civil protection sit inside one plan. The cyber equivalent has the same shape and the same audiences: the professional the state must keep, the reservist it can call on, and the citizen it must teach to spot the phishing email. The university pipeline and the small-business perimeter sit between them. All of it is forecast and funded as one workforce, not separate budgets competing for staff.
Retention is an executive responsibility, not a personnel-policy detail. The non-salary levers matter as much as pay: clearances that move at industry pace, rotations, and sabbaticals. Attrition should be reported annually, by role, so the public can see when the workforce is being run down.
Pool scarce roles
Pooling is how the rarest skills are made available to every ministry rather than recruited separately by each. At the national level, a country can run a single response team, security operations centre and group of incident responders, so that the specialist a ministry needs at three in the morning is reachable. Pooling is also the only credible answer to the rarest skills of all (testing the new generation of AI systems, evaluating them for misuse, migrating to post-quantum cryptography) which no single country can sustain alone.
The reserve sits alongside the salaried workforce. Volunteer and reservist cyber units (military or civil), give the state surge capacity it could never afford to keep on the permanent payroll, and a route into the regular workforce. Their value lies less in headcount on paper than in the exercises they run with the response team, the regulator and the essential operators, so that on the day a sustained campaign begins, the reserve is already trained, trusted, and known.
Build cybersecurity literacy through life-long learning
Education sits underneath all of it. Basic cyber hygiene belongs in school, gets refreshed in adult life, and is easy for anyone changing careers to pick up. At the professional end, certifications and university courses must keep pace with how attackers truly work, which means the people who teach them must spend time inside the agencies and operators they teach about.
