A Cyber Operations Defence of the ‘Soft’ Sciences

In international relations, do offensive cyber operations trigger escalation? Some describe offensive cyber as inherently escalatory, with the potential to increase the intensity or severity of conflict, others offer a more nuanced view. We need to put greater emphasis on understanding human behaviour and cognition to fully conceptualise the escalatory risk of offensive cyber operations.

Offensive cyber operations are often thought about from a technical sense, with a focus on the software and hardware required to develop and deploy attacks. Yet, the ultimate goal of offensive cyber operations is often cognitive: we are aiming to influence human decision makers.

Culture and context play a significant role in influencing human cognition and behaviour, including when assessing whether an activity has escalatory effect. Yet without evidence-based approaches to understanding human decision making, there is a risk we will assume that adversary actors will behave in the same way that we will. This also impacts assessments of how escalatory offensive cyber operations may be: effects we would not consider to be escalatory may be perceived differently by adversaries. At a time when tensions are growing globally, we require culturally nuanced and evidence-based approaches to minimise the unintended consequences arising from acting in the cyber domain.

Sub-Threshold; the Risk of Escalation to Armed Conflict is Low

Despite initial worries that cyber is escalatory, we have yet to see a state respond to a cyber-attack with conventional force. A lack of historical precedent has led scholars to argue that cyber is associated a low risk of escalation, and in some cases, is de-escalatory – providing states with a non-kinetic response option. This is attributed to several factors, including the ambiguity and uncertainty associated with cyber.

Cyber warfare is often covert. It is not always possible, or even typically possible to identify the perpetrator of an attack. Overt retaliation is not commonly feasible without timely and accurate attribution to a state actor.

Advanced cyber-attacks against adversary systems are also expensive and time consuming to develop. Unless a state has an appropriate retaliatory attack in their arsenal, escalating within the cyber domain (in other words, going up the escalatory ladder) may depend on developing new cyber-attacks, which could take time. Timely retaliation therefore requires a cross-domain response, such as diplomatic, economic or kinetic. So far, states have shown reluctance to engage in such horizonal escalation.

Finally, outside of conventional warfighting, cyber warfare has (to date) remained in the greyzone, below perceived thresholds of armed conflict. For example, cyber effects have yet to cause significant physical harm to civilians. It might be argued that cyberwarfare has yet to escalate into armed conflict because attacks have not crossed a state’s red lines. However, escalation can occur below the threshold of armed conflict. Described as a change in either ‘the intensity or scope of a conflict, that crosses a threshold considered to be significant to a participant’ escalation does not necessarily result in traditional armed conflict. Rather, what constitutes an above threshold attack is purposefully ambiguous, as uncertainly over red lines is assumed to motivate more caution in adversaries. Understanding the risk of escalation, and the associated unintended consequences of acting in the cyber domain is therefore complicated by its inherent ambiguity. Adversary perceptions are integral to this.

Geopolitical Tensions are Changing Escalation Risks

The shape of cyber warfare is, however, evolving. Broader geopolitical tensions are reflected by an increasing cyber threat to Europe and attacks may be creeping closer to ambiguous red lines. In December, the UK’s National Cyber Security Centre (NCSC) issued warnings to UK Critical National Infrastructure, prompted by attacks on Polish energy infrastructure. Attacks uniquely targeted IT systems and physical industrial devices. This could have impacted heat supply to almost half a million customers, including civilians. From a legal perspective, disruption to energy supplies during the winter could have caused serious adverse consequences, potentially reaching the threshold to be considered a violation of sovereignty.

Amid growing tensions, the UK must be conscious of potential unintended consequences of its own actions. While escalation has, to date, been limited in the cyber domain, this may change as the likelihood of full-scale conflict increases. Novel threats, coupled with a lack of red-lines and norms in cyber space means predicting responses to offensive cyber is challenging and fraught with nuance.

We Must Use the Social and Cognitive Sciences to Understand Escalation Risk

Approaches to predicting adversary responses to cyber must be rooted in an understanding of the human decision maker. Behaviour and cognition are highly complex and context dependent, and people do not always behave in ways we expect them to. A multi-disciplinary approach to risk assessment and mitigation during the operational planning cycle is therefore required. This allows for consideration of the human decision maker, alongside technical risks such as attribution or capability loss. Social and cognitive science can underpin such an understanding. As will be illustrated below, there is a vast literature base on decision making processes and the contextual factors that influence how actors select a course of action. Research on the influence of national, strategic and organisational culture can illuminate how and why an adversary’s decision making may differ from our own.

One potential approach to understanding whether an actor will escalate is taken from the nuclear domain. Traditional models of deterrence assume rational decision making – people weigh up the pros and cons of action and make a least-worst choice. Yet, these approaches are a potentially poor fit for the cyber domain, where actors are typically dealing with uncertain and incomplete information. This often precludes the careful consideration of pros and cons and instead, increases the influence of biases and heuristics. Within organisations, for example, we see leaders following failing courses of action once they are in motion, even when it knowingly leads to worse outcomes. This sunk-cost fallacy may see actors make poor decisions within and beyond the cyber domain, simply because they have already publicly expended resources. For example, by continuing to develop effects that will no longer serve strategic outcomes, or burning capability that could have been retained. As such, efforts to predict the risk of escalation should not assume that actors will behave rationally and interpret the pros and cons of acting, in the same way we would.

Culturally bound values and attitudes are also powerful drivers of behaviour. People often make seemingly irrational decisions regarding the values they consider to be central to their identity. When asked to put a monitory price on a human life, for example, people feel disgusted, and often refuse to even engage with the decision. These values will vary between different cultures and are often tied to a group's collective identity and religious narratives. Dehgheni et al. (2010), for example, explored Iranian’s perceptions of a hypothetical negotiation deal where Isreal would surrender its nuclear facilities if Iran also gave up and surrendered its nuclear programme. Iranians who viewed the nuclear programme as intrinsic to Iran’s status and independence felt angry and were less likely to accept a deal when it was associated with monetary incentives (a $40 billion payout) or disincentives (sanctions). For those who didn’t view the nuclear programme as a sacred value, more so-called rational decision making was observed. Understanding whether cyber effects will interfere with such values requires nuanced cultural expertise, not just of national culture, but also decision makers sub-groups. Failure to consider such cultural differences risks unintended consequences.

National and strategic culture will also shape perceptions of the pros and cons of escalating. Cultural concepts such as embarrassment and face-saving are more salient in some cultures. If we take Iran’s response to Israel and the US’s 2025 attacks on Iran, we saw the deployment of hundreds of drones that were never intended to cause significant harm or loss of life. This show of force allowed Iran to save face by retaliating, while also minimising the risk of further escalation. As discussed previously, offensive cyber can serve a similar function – providing states with an escalatory off ramp.

The ambiguous and covert nature of offensive cyber means groups who are likely to engage in face-saving may also be less likely to disclose when they have been the target an operations. In some instances, this may reduce the likelihood of escalation, as this would require disclosure.

Using Social Science can Reduce the Risk of Mirror Imaging

These are, of course, just a few examples that demonstrate why we cannot, and should not, make assumptions as to how an actor will respond to offensive cyber operations. We should not assume a state’s threshold and red lines will mirror our own. As already stated, understanding human behaviour is of course complex, and highly context dependent. Yet, to fully understand how an actor will respond to offensive cyber operations, the UK must use expertise in human behaviour, cognition and socio-cultural psychology. Although not as readily associated with cyber as technical engineering skills, the human and social sciences are no less critical if we are to be an effective and responsible cyber actor.

© RUSI, 2026.

The views expressed in this Cyber Effects Perspectives are the author's, and do not represent those of RUSI or any other institution.

For terms of use, see Website Terms and Conditions of Use.