Cyber Deterrence Matrix
Explore the multilevel framework for achieving cyber deterrence, and assess how states can use these tools to strengthen deterrence strategies and inform campaign design.
This interactive mapping tool accompanies the paper Beyond ‘Cyber’ in Deterrence: A Multilevel Framework. It is designed to help states assess their readiness and willingness to use different tools, both independently and collectively. The findings can help inform the design of deterrence campaigns and identify how tools traditionally associated with other areas can be used to achieve cyber deterrence outcomes.
Use the tabs below to explore 52 tools across four functional categories and consider how each could contribute to cyber deterrence.
Row Colour Coding
- Blue = cyber tool
- Yellow = non-cyber tool
- Green = both / hybrid tool
Cyber Deterrence Matrix
Raising the Bar
Actions and instruments that reduce the likelihood, impact and/or payoff of malicious cyber operations by making attacks and operations harder to conduct, politically and/or technically costlier to attempt and less rewarding when executed.
Imposing Costs
Actions and instruments that actively degrade, disrupt, slow down and impose consequences on adversaries or third countries conducting and/or harbouring malicious cyber activity, through periodic or persistent proactive activity and/or reactive punishment.
Benefits / Inducements
Positive measures such as rewards or withdrawal of penalties based on conditionalities that are offered to adversaries, perpetrators, harbouring states or negligent states in exchange for - or as a recognition of restraint and/or behavioural change. The framework covers two types of benefits rewards (for example, market access, technology cooperation/exchange); and penalty relief (for example, lifting of sanctions, removal from grey lists).
Enablers
Cross-cutting foundational instruments that do not stop malicious cyber activity but strengthen the effectiveness of both raising the bar and imposing costs (for example, attribution capacity, capacity building and public-private cooperation).
Key and Acronym Glossary
Key
*Meaning of particular statuses in the 'Used for Cyber?' column
'Yes' - Explicitly deployed as a response to malicious cyber activity, with documented precedents.
'Partial' - Application to cyber is emerging, incomplete or untested at scale. The instrument is being built out for cyber but is not yet mature.
'Indirect' - The instrument is fully deployed, but its cyber-deterrence effect is downstream of another primary purpose. Distinguished from 'Partial' because the policy implication is opposite: the instrument exists and works — the question is whether it can be pointed at cyber, not whether to build it.
'No' - Not yet applied to cyber in any in-force mechanism, but with established precedent and theoretical applicability from another domain (such as Counterterrorism (CT), arms control or trade).
List of Acronyms
Acronyms and initialisms used across the Raising the Bar, Imposing Costs, Benefits or Inducements and Enablers tabs of the matrix. Operation names, malware and threat-group names and company names are not listed.
