Over the course of this series, our first article examined how governments are increasingly adopting offensive cyber capabilities into national security strategies that were previously more defensive, and our second blog explored the risks this can create for businesses, critical infrastructure and users in our second blog. In our third article, former NATO CIO and CISO Dr. Manfred Boudreaux-Dehmer argues that defense alone is no longer sustainable, but that offensive capabilities must remain tightly governed and firmly under state control.
Responsible behavior requires more than restraint. This final article turns to implementation: states must set clear limits on offensive activity, implement existing norms, strengthen defensive capacity, and deepen cooperation with industry.
For the Cybersecurity Tech Accord, our recommendations are underpinned by longstanding commitments to protect users everywhere, oppose cyberattacks that harm innocent citizens and enterprises, and strengthen security through collective action and international cooperation.
Keeping offensive activity bounded
Governments have a legitimate responsibility to protect their citizens and respond to malicious cyber activity. Offensive cyber operations take place across highly interconnected networks and services, where effects can extend well beyond their intended targets.
Here are a few specific recommendations:
- The Tech Accord recommends that offensive actions should be exceptional, lawful, necessary and proportionate which are supported by appropriate authorization and due process safeguards, including oversight and accountability.
- States should build into the authorization process for all offensive cyber operations a robust assessment of reasonably foreseeable civilian, cross-border, and supply-chain effects before acting. Responsible behavior includes avoiding practices that create wider insecurity.
- When it comes to vulnerability disclosure Governments should therefore work from a presumption that vulnerabilities will be disclosed and remediated; any decision to do otherwise should require clear justification, appropriate oversight, and regular reassessment.
Existing initiatives provide useful foundations. The Paris Call established a principle against private-sector hack back, while the Pall Mall Process has advanced accountability, precision, oversight and transparency around commercial cyber intrusion capabilities. Together, they show that greater capability requires clearer safeguards.
The Tech Accord’s August 2026 statement on escalating offensive cyber postures emphasized restraint, transparency, and adherence to international norms, while prioritizing defensive action and lawful accountability over the normalization of offensive activity.
From norms to implementation: the ASEAN case study
Restraint alone is not enough. States have spent more than two decades developing international norms for responsible behavior in cyberspace; the challenge now is implementation. ASEAN offers a useful example. Its Norms Implementation Checklist, completed in 2024 and co-led by Singapore and Malaysia, translates the eleven voluntary UN cyber norms into practical actions across policy, operational, technical, legal, and diplomatic domains, alongside related capacity-building needs.
Agreement on norms is only the starting point. Governments also need the institutions, expertise and processes required to translate those commitments into policy and operational practice. Capacity building, exercises and sustained engagement are therefore integral to responsible state behavior. The ADMM Cybersecurity and Information Centre of Excellence (ACICE) demonstrates this approach: through its Digital Defence Symposium and cyber norms workshops, it has brought governments, defense officials, academics and industry together to build shared understanding and working relationships before serious incidents occur.
The ASEAN Regional Computer Emergency Response Team (CERT) provides a complementary operational layer, supporting information sharing, exercises, and capacity building among national CERTs while developing partnerships with industry and academia. Together, these mechanisms show how regional cooperation can move from broad commitments toward practical preparedness.
Clearer government–industry cooperation
Companies operate much of the infrastructure at risk and hold significant technical expertise and threat intelligence. They can support governments through information sharing, vulnerability remediation, incident response, exercises and capacity building, but governments must retain authority and accountability for state cyber operations.
Companies also need to prepare for an environment in which geopolitical tensions increasingly spill into commercial infrastructure. Strong vulnerability management, secure-by-design engineering, tested incident response, and reliable recovery remain essential regardless of who is behind an attack. Companies should also establish clear internal governance for government requests, including what assistance they are prepared and legally able to provide, who can authorize it, and how customer and cross-border obligations are assessed.
The answer to a more contested cyberspace is therefore not less government–industry cooperation, but clearer cooperation: deeper collaboration on defense, resilience, information sharing, and preparedness, while keeping offensive cyber operations under government authority and limiting the private sector to clearly defined supporting activities.
For signatories, collective defense means strengthening resilience, sharing actionable threat intelligence and supporting effective incident response so that greater cyber capability does not produce greater insecurity.
Ultimately, an effective cyber strategy should be judged not only by whether it imposes costs on an adversary, but also by whether the ecosystem it leaves behind is more secure than the one it found. Restraint is the starting point; responsible implementation, clear accountability, and sustained collective defense are what turn it into practice.