Join War on the Rocks and gain access to content trusted by policymakers, military leaders, and strategic thinkers worldwide.
The most successful deterrent threats leave no evidence behind. No missiles fly. No networks go down. No troops cross borders. Nothing happens. For policymakers, that is often the desired outcome. For researchers, it is a nightmare. Imagine, however, being able to observe a decision-maker preparing to attack, receiving a deterrent threat, and then changing their mind. That moment — the instant deterrence succeeds — is arguably the most important observation in international security. It is also one we almost never see.
We can see its failure: the red line crossed, the chemical weapons used, the invasion that follows from “military exercises.” But through normal empirics, we cannot see a deterrent threat’s success. We cannot see what would have happened. Enter wargaming.
Say, for example, that the Nation of Purple threatens the Republic of Green: “Attack our critical infrastructure, and we will respond with a nuclear strike.” The Republic of Green does nothing. Did deterrence work? Or had they planned no attack? There is often no way to know.
Now extend this problem to cyberspace, where even the attacks themselves are frequently invisible. Indeed, opacity defines cyber operations. States often cannot readily observe what capabilities an adversary possesses, where malware has been implanted, or whether an adversary intends to use an intrusion for espionage, pre-positioning, coercive signaling, or imminent attack. This creates acute attribution problems: Even when we observe an attack, identifying the responsible actor with sufficient speed and confidence to support deterrent signaling or retaliation is difficult. Secrecy further compounds the problem because cyber capabilities often lose value once disclosed. Unlike a missile test, public demonstration can undermine rather than strengthen the credibility of a threat by prompting patching, adaptation, or countermeasures. At the same time, cyber operations are generally less physically destructive than nuclear and most conventional attacks, which can reduce the perceived costs of both using and absorbing them — with attendant consequences for escalation. Taken together, opacity, attribution challenges, secrecy, lower destructiveness, and ambiguity of purpose make cyberspace a poor fit for deterrence models that rely on clear signaling, observable capabilities, and readily interpretable thresholds.
The (already) difficult challenge of studying deterrence just got harder.
Our work leveraging wargames as experiments explores complex problem spaces where real-world empirics are scarce. Analysis of data from our Signal wargame, for example, contributed unique insights regarding the effects of low-yield nuclear capabilities on conflict escalation. This method uses intentionally designed games as labs, creating human-derived, large-n datasets, the analysis of which produces insights unavailable by other means.
To address the question of the relative efficacy of deterrence in the cyberspace domain, our team developed the game Tantalus. The key innovation of Tantalus is not the inclusion of cyber, nuclear, and conventional operations within the game per se. Indeed, many games exist, both wargames and hobby games, that include cyber operations (e.g., on critical infrastructure). This innovation is not the introduction of clear mechanics for deterrence threats — our prior game, SIGNAL, included threat mechanics. The key novelty in Tantalus is the mechanics of turn structure.
In the game, players select an initial action they will take. Then, they receive any deterrent threats made by other players. If the threats are relevant to their planned action, players are given an opportunity to change their minds — to be deterred. This creates a window between planned action and action execution, allowing researchers to see what we have never been able to capture: deterrence in action.
By separating action selection from action execution, with a threat phase in between, Tantalus creates a moment that is not visible to conventional observation methods: the moment when a player who was planning to attack chooses to stand down because of a deterrent threat. That revision represents deterrence success, made visible and measurable. Across 394 games and 1,090 players, the team could observe not only what players did, but what they would have done had no threat been made.
This is the methodological contribution, and it matters beyond this particular study because it offers a template for studying other “unobservable” dynamics in international security. Of course, as with all wargames, there are attendant concerns surrounding external validity — put another way, how likely results in a synthetic environment are to mirror those in the real world involving real policymakers. It is for this reason that the scenarios in gameplay reflect the context (and complexity) of the real-world policy environment. Moreover, given the lack of real-world data, wargame data offers a window into deterrence success and failure that researchers otherwise cannot observe — as well as being more appropriate than many of the alternative approaches (e.g., models and simulation) that fail to engage with human decision-making. To some extent, the alternative to wargaming data is no data at all.
In the case of Tantalus, what did this visibility reveal about whether and how deterrence works in cyberspace?
Firstly, it is important to be precise about the term “cyber deterrence.” It is a phrase that can mean many things, leading to many analysts talking past each other, with no clarity on whether they agree or disagree about the underlying principles.
One definition of “cyber deterrence” refers to arresting an attack by another party via the threat of punishment in cyberspace. Here, the “cyber” in “cyber deterrence” refers to the type of punishment one is threatening. In this case, the planned attack can take any form – nuclear, conventional, diplomatic, economic, or cyber – the form of the attack is not the focus, but the form of the threat is. Perhaps unsurprisingly, we find that in this context, cyber threats are less effective than nuclear threats in leading a player to revise their previous course of action. As such, we can reasonably deduce that the problem is not skepticism about the threatener’s capability, but a difference in the perception of cyber threats compared to nuclear threats. This finding reflects prior work that suggests we may be asking too much of cyber capabilities.
A second definition of “cyber deterrence” refers to attempts to deter a cyber operation via the threat of punishment. Here, the “cyber” in “cyber deterrence” refers to the type of action one is trying to deter. In this case, the punishment threatened can take any form. Our Tantalus wargame data offers us good news on this front: Cyber operations can be deterred. In fact, an adversary is just as likely to be deterred whether they are preparing for a cyber or conventional kinetic attack. There is significant skepticism on this point in policy and scholarly communities, so it is worth highlighting that actors do not appear to treat cyberspace differently when assessing deterrent threats.
While it is possible to deter cyber operations from other parties, players reached for deterrent threats far less often when facing potential cyber operations than when facing a potential kinetic attack. Although data shows that the threat would be roughly as effective in either case, players seem to resign themselves to the inevitability of cyber operations on their networks. This aligns with the perspective taken in the 2023 Cyber Strategy, wherein the Department of Defense asserts that “cyber capabilities held in reserve or employed in isolation render little deterrent effect on their own.” Despite this widely held view, our findings here suggest that states are, in reality, leaving a working tool on the table.
Cyber operations may also be less destabilizing and escalatory than originally feared. Nevertheless, they can still disrupt military operations, critical infrastructure, and essential government functions. The key policy takeaway is not simply that it is possible to deter cyber operations, but that states appear reluctant to try — perhaps reflecting the wisdom that cyberspace is primarily one for intelligence contests. While policymakers frequently discuss resilience, defense, and recovery, our findings suggest deterrence deserves a more prominent place in cyber strategy. A threat that is never communicated cannot influence an adversary’s decision calculus. By treating cyber operations as an inevitability, states may be foregoing opportunities to prevent them.
The value of the Tantalus experimental wargame goes beyond these findings about cyber deterrence. As AI tools and vibe coding push the threshold for entering the cyber domain even lower, any credible optimism about deterring casual cyber use is valuable and important. Yet, the central value of Tantalus’s success in finding statistically significant evidence against hard security questions is the demonstration of experimental gaming’s capability to study problems that are otherwise empirically intractable.
Importantly, this is a category of questions in international security where the most important outcomes are definitionally unobservable, including (but not limited to) deterrence success, escalation avoidance, internal decision calculus, and threats left unsaid. Wargames, designed appropriately and used as experimental settings, offer a tool able to capture the data needed to answer these questions. Today, given both changing geopolitical conditions and technology shifts, these tools must be adapted, challenged, and extended — more or less in real-time.
Ruby Booth is a principal member of technical staff at Sandia National Laboratories and a non-resident fellow at the Berkeley Risk and Security Laboratory.
Andrew W. Reddie is an associate research professor at the University of California, Berkeley’s Goldman School of Public Policy, and founder and faculty director of the Berkeley Risk and Security Lab. He is also a non-resident fellow at Sandia National Laboratories, Lawrence Livermore National Laboratory, and New America.
**Please note, as a matter of house style, War on the Rocks will not use a different name for the U.S. Department of Defense until and unless the name is changed by statute by the U.S. Congress.
Image: Jess Lewis via DVIDS
