In the first article in this series, we explored how a growing number of governments are moving from defensive to offensive cyber strategies as a response to increasing levels of malicious cyber activity by other states. While governments have legitimate responsibilities to protect national security, the normalization of offensive-first approaches risks fueling escalation, weakening trust, and increasing harm to civilians, companies, and critical digital infrastructure.
Collateral and cascading harm
One of the most important risks of offensive cyber operations is that their effects and costs are difficult to contain. Governments act in a highly interconnected digital environment made up of shared cloud platforms, complex software supply chains, telecommunications networks, and essential services that often span multiple jurisdictions.
No case illustrates this risk more clearly than NotPetya. In June 2017, malware widely attributed to Russian military actors and aimed at Ukraine spread through a compromised update to Ukrainian tax software before rapidly spreading across the world. The attack disrupted multinational companies including the Danish shipping giant Maersk, which had to rebuild roughly 4,000 servers and 45,000 computers as operations halted at dozens of port terminals worldwide. The malware also forced the pharmaceutical company Merck to stop production of several medicines, including an HPV vaccine, forcing the company to borrow doses from a national stockpile. Merck’s losses alone reached around $870 million, while the total global cost of the attack is estimated at close to $10 billion. The White House later described NotPetya as “the most destructive and costly cyberattack in history.” None of these companies were the intended target, yet all suffered significant consequences.
More recently, the 2022 cyberattack against Viasat’s KA-SAT satellite network also demonstrated how cyber operations can generate significant collateral damage far beyond their intended target. Conducted on the day Russia launched its full-scale invasion of Ukraine, the operation sought to disrupt communications supporting Ukrainian command and control. However, because the targeted satellite network also provided connectivity to commercial and civilian users across Europe, the effects quickly spread beyond the immediate conflict zone. Tens of thousands of customers experienced service disruptions, while approximately 5,800 wind turbines in Germany lost remote monitoring and management capabilities after their satellite communications links were severed.
These examples illustrate just one of the many reasons why governments should treat offensive cyber operations as a measure of last resort and carefully assess their potential risks to global supply chains, critical services, and the broader economy.
Escalation and misattribution
Attribution of cyber operations is notoriously difficult; it is also rarely immediate or certain, and states may interpret the same act very differently. As offensive postures become more common, and a growing number of actors engage in such operations, the opportunities for miscalculation and misattribution increase.
As offensive postures are normalized, private organizations may feel that “hacking back” is a legitimate act. However, private actors may not have the full picture of the situation or legal authority to do this. Attackers often route their operations through compromised third-party systems, so a retaliatory strike may hit an innocent organization rather than the intended target. One organization’s counterstrike can also trigger retaliation by another, creating a cycle of escalation. As former NATO Chief Information Officer (CIO), Dr. Manfred Boudreaux-Dehmer warned in the Cybersecurity Tech Accord’s July signatory call:
“Private-sector hack back risks creating a “Wild West” in cyberspace. Offensive cyber operations should remain the responsibility of governments and authorized state institutions.” — Dr. Manfred Boudreaux-Dehmer, former NATO Chief Information Officer (CIO) and Chief Information Security Officer (CISO)
These risks reinforce the importance of restraint, transparency, accountability, and adherence to responsible behavior in cyberspace. For this reason, Cybersecurity Tech Accord signatories oppose private-sector hack back and endorse initiatives such as the Paris Call for Trust and Security in Cyberspace. The underlying principle is that cybersecurity is best advanced through collective defense, international cooperation, customer protection, resilience, and responsible vulnerability disclosure, rather than through the active use or normalization of offensive cyber capabilities by private actors. This position is also reflected in the Cybersecurity Tech Accord’s recent statement on offensive cyber postures.
Retained vulnerabilities: the exposure everyone shares
Every stockpiled vulnerability is a vulnerability left unpatched. When governments retain software flaws for future cyber operations rather than disclose them for remediation, they leave the same products and services used by businesses, critical infrastructure operators, and citizens less secure.
The consequences of that approach are best illustrated by EternalBlue, an exploit reportedly developed by the U.S. National Security Agency for a flaw in a widely used Windows networking protocol and held for intelligence use rather than disclosed to the vendor. In 2017 it was stolen and leaked publicly by a group known as the Shadow Brokers. Within weeks it had been weaponized into WannaCry, the ransomware that spread to more than 200,000 machines across some 150 countries and paralyzed hospitals, and was later reused in NotPetya. Years later, unpatched systems are still being compromised through the same exploit.
The lesson for industry is that when vulnerabilities are hoarded instead of disclosed and patched, the exposure does not stay with the government that found them, but spreads to everyone who uses the affected technology. This is precisely why the Tech Accord and our signatories place such weight on the importance of coordinated vulnerability disclosure, and why normalizing offensive operations, which creates incentives to keep vulnerabilities secret, cuts directly against the security of the wider ecosystem.
Proliferation and the blurring of responsibility between actors
Offensive capabilities developed by one government may well end up in others’ hands: the tools, expertise, and infrastructure can be transferred, stolen, or commercialized, feeding a growing market of cyber mercenary firms and lowering the threshold for misuse, and reducing the costs of attackers’ operations.
It can also blur the line between public and private responsibilities. As governments lean more heavily on the private sector (the US strategy explicitly seeks to “unleash” companies to help disrupt adversaries), technology providers may face pressure to support state operations in ways that could sit uneasily with their own commitments, or indeed legal obligations they may have in other jurisdictions which are implicated in a given operation. Signatories to the Tech Accord are united by a principle of no offence and a pledge to protect all customers everywhere, regardless of nationality or geopolitical considerations. Being drawn into offensive activity would corrode the trust and technological neutrality on which a well-functioning digital ecosystem depends. The global digital economy relies on the ability of technology providers to serve customers across borders irrespective of political disputes or strategic rivalries. If companies are expected to participate in government-directed cyber operations, governments may increasingly view foreign technology providers as strategic actors rather than trusted commercial partners. This could accelerate digital sovereignty initiatives aimed at reducing dependencies on providers perceived to be subject to foreign government influence and contribute to the fragmentation of the global digital ecosystem.
Opposing the normalization of offensive operations does not mean that industry should oppose all state action in response. Lawful defensive measures and government-led disruption under clear legal authority, with oversight mechanisms and relevant levels of transparency, carry a different risk profile.
Eroding the norms of responsible state behavior
Over more than two decades, states have built a shared understanding of how states should behave in cyberspace. Through the UN framework for responsible state behavior in cyberspace, governments have agreed by consensus that international law and the UN Charter fully apply in cyberspace and have endorsed a set of voluntary norms of responsible state behavior to reflect international legal norms online. These include commitments both to protect and not to target critical infrastructure and not to knowingly allow their territory to be used for ‘internationally wrongful acts.’ In March 2026 the UN launched its first standing body to address international peace and security in cyberspace, reflecting growing recognition that stability in the digital domain requires sustained international cooperation. This broader normative framework has been reinforced by multistakeholder and international initiatives such as the Paris Call for Trust and Security in Cyberspace, which includes a commitment to discourage private-sector hack back, or the International Counter Ransomware Initiative (CRI), which promotes international cooperation, resilience, information sharing, and coordinated action against cybercriminal groups.
The current normative framework is voluntary, fragile, wholly dependent on mutual restraint, and high-level. The normalization of offensive cyber operations therefore places this framework under increasing strain. Norms erode through the accumulation of precedents: every time a state expands the role of offensive action, lowers the threshold for its use, or treats it as a routine instrument of policy, it creates a precedent. As offensive-first postures spread, the norms that took decades to establish risk being hollowed out just as the international community is trying to make them more effective.
The legal framework is equally uncertain. Depending on context, offensive operations, and private hack back in particular, may violate domestic law, infringe another state’s sovereignty, cause collateral damage across borders, or create jurisdictional disputes and conflicts of laws problems.
For example, a company conducting a retaliatory operation against infrastructure located abroad could face legal liability in multiple jurisdictions, whether the targeted systems belong to an innocent third party or a multinational cybercrime network. The attribution difficulties described above compound the problem: acting on a mistaken judgement of who was responsible can itself become an internationally wrongful act.
For industry, norms and legal certainty are crucial; they help keep critical infrastructure from being treated as acceptable targets, for example. When the norm protecting civilian infrastructure weakens, the risk to every provider of that infrastructure rises, with spillover risks to all customers of that provider. The erosion of this framework also undermines confidence among both states and industry, weakening the predictability that enables companies to share threat intelligence and cooperate across borders, and reducing trust overall.
The Cybersecurity Tech Accord recognizes that states have national security responsibilities and may hold cyber capabilities under domestic and international law. We believe those capabilities should remain reserved to states, exceptional, lawful, necessary, proportionate, subject to oversight, and consistent with responsible state behavior in cyberspace.
What this means for industry
For businesses, the strategic takeaway is to recognize that offensive cyber activity is now a risk to be managed, through resilience, secure-by-design engineering, strong identity and privileged-access controls, rigorous vulnerability management and patching, tested incident response and recovery, and participation in trusted public–private threat-sharing. At the same time, the evolving threat landscape calls for more robust engagement between governments and the private sector when considering changes to national cyber strategies and the role of offensive cyber capabilities. As a signatory of the Cybersecurity Tech Accord observed:
“Offence may contribute to deterrence, but resilience remains the control available to every organization, every day.” — Fook Hwa Tan, Chief Quality Officer, Northwave Cybersecurity, Cybersecurity Tech Accord signatory