Cyber Shockwaves

Imagine a simple piece of computer code shutting down nuclear power plants, paralyzing transportation networks, and disrupting vital military systems. For more than a decade, cyberattacks against critical infrastructure have been more than just intrusions; they can have effects comparable to those of conventional acts of war, and threatening global stability. For nuclear democracies, the question has become crucial: at what point does a digital incident cross the threshold of severity required to trigger deterrence calculations, or even justify a nuclear response?

Cyberspace is now a theater of constant confrontation where adversaries seek to undermine each other’s trust, disrupt economies, and test resilience. This invisible competition weakens traditional deterrence mechanisms, which rely on clear signals. In cyberspace, nothing is clear, with uncertain effects and often unintentional escalation. Yet, the potential damage of a sophisticated cyberattack against an electrical grid or supply chains could exceed that of a conventional bombing. The problem stems from three major developments.

Critical Weak Spots

The first development is the increasing vulnerability of critical infrastructure, whose technical complexity creates countless points of weakness. Hospitals, refineries, water distribution systems, and railway networks rely on technologies that are sometimes outdated and rarely protected against determined state and non-state actors. A coordinated and simultaneous attack against multiple sectors could severely paralyze a country for weeks to months, causing economic chaos and widespread social disruption.

The second development concerns the strong integration of cyberspace and nuclear power. Command, control, and communication systems have become more digital than ever, and thus more exposed to cyberattacks. Even a non-destructive intrusion, subtly targeted and difficult to detect, could be interpreted as an attempt to undermine the capacity to retaliate. In such cases, the precise or approximate perception of risk becomes as dangerous as the attack itself, amplifying the potential for misunderstandings and unintentional escalation.

The third development, finally, is the bolder behavior of adversaries of democratic regimes, who use cyberspace as a tool for exerting pressure without incurring significant costs. Who would doubt that Russia, China, North Korea, and Iran regularly demonstrate their ability to disrupt the institutions of democratic regimes? The relative success of their operations encourages them to push the boundaries even further, as they are aware of the existence of a “gray zone” where traditional deterrence does not fully apply.

These major transformations lead to a fundamental question: should democracies clarify as quickly as possible that certain cyberattacks could cross a threshold triggering a major military response, including nuclear? The objective of a new doctrine would then not be to lower the nuclear threshold, but to re-establish a credible and robust level of deterrence. Because if adversaries believe that cyberattacks are “zero-cost,” they will continue to systematically target vital infrastructure, exploiting critical vulnerabilities with impunity and minimal risk to themselves.

Strategic High Stakes

A first argument for clarifying the doctrine rests on proportionality: a massive cyberattack targeting critical infrastructure could have consequences comparable to a bombing. In this context, it would be consistent to specify that the response is not limited to conventional means. Analysts point out that U.S. nuclear doctrine already considers the possibility of devastating consequences from non-nuclear strategic attacks, and they believe that the nuclear threat is not explicitly excluded, even if the no-first-use scenario remains dominant.

A second argument concerns strategic stability. Today, adversaries regularly stress the defenses of democratic regimes in the “gray zone,” without immediate risk of escalation. Clarifying the rules of engagement and explicitly integrating cyberspace into strategic thinking could strengthen deterrence and limit adversarial gambles in this gray zone. The United States, the United Kingdom, and France could thus reduce uncertainty regarding the potential consequences of sophisticated cyberattacks, one form of irregular warfare, while emphasizing that any major offensive would have significant repercussions.

A third argument concerns the protection of nuclear command. Even a limited attack on control systems could be interpreted as an attempt to neutralize the second-strike capability, creating an extreme risk of miscalculation, especially with the increasing use of artificial intelligence. By clearly announcing that such an intrusion would be considered a serious and unacceptable act, democratic regimes would strengthen their strategic stability, discouraging any hostile action and reducing the risk of unintentional escalation during times of international crisis.

Perilous Lines

This doctrinal shift, however, carries significant risks, notably the unintentional lowering of the nuclear threshold. Even if the clarification primarily aims to strengthen deterrence, it could be perceived as an excessive threat by non-democratic States, prompting them to rapidly modernize their nuclear arsenals or develop sophisticated offensive cyber capabilities. The proliferation of cyber threats with potentially physical effects creates a low-profile but ultimately strategic space for competition, paradoxically exacerbating tensions and instability.

Responding to a cyberattack with a nuclear strike requires absolute certainty as to its true perpetrator. Yet, operations in cyberspace often involve proxies, opaque international relays, and technical masking of the source. An attribution error could have profound consequences. Additionally, a cyber intrusion seen as preparation for a major attack might provoke an overreaction during a crisis. Any doctrine that includes the possibility of a nuclear response must therefore incorporate rigorous deconfliction mechanisms, otherwise the worst will happen.

However, these risks should not obscure a strategic reality: current doctrine dates to a time when cyberattacks could not paralyze a country in minutes. This is no longer the case. Adversaries of democratic regimes have understood that cyberspace offers them a means of inflicting considerable damage while remaining below the threshold for a nuclear response. Doing nothing would amount to accepting a structural vulnerability, especially since middle ground is emerging. This involves explicitly defining two categories of cyberattacks likely to trigger an appropriate military response:

1. Attacks causing massive impacts on the civilian population or critical infrastructure (hospitals and emergency services, water distribution networks, etc.).
2. Intrusions targeting the command systems of the armed forces, even without destructive effects, with the aim of degrading a country’s decision-making capacity.

Though it would not directly reference nuclear weapons, this clarification would connect strategic cyberattacks to potential responses, giving decision-makers flexibility while clearly warning adversaries. A more explicit doctrine should reduce the risks of accidental escalation and limit the audacity of State and non-State actors willing to test the nerves of democratic regimes, in line with recent analyses on the evolution of the U.S. nuclear posture in the face of new strategic threats that the war in Ukraine has only exacerbated.

About the Author

Gilles A. Paché is a Professor of Marketing and Supply Chain Management at Aix-Marseille University, France, and a member of the CERGAM Lab. His research focuses on logistics strategy, distribution channel management, and military studies. On these topics, he has authored over 700 scholarly publications, including articles, book chapters, and conference papers, as well as 24 academic books. Views expressed in this article are the author’s own.

Hacking the Apocalypse: How Cyberattacks Could Trigger Nuclear Escalation was originally published on Global Security Review.

Prior to Russia’s invasion of Ukraine, Germany was one of Russia’s closest economic partners. At the outset of the war, Germany was criticized for its hesitant offer to Ukraine of 5,000 military helmets, at a time when other European states, especially the Baltic nations, were offering weapons and heavy military equipment to defend against the Russian invasion.

This hesitancy had two facets. First, the belief that military aid would escalate the war to unmanageable levels. Second, the fear that Russia could easily achieve its military objectives. In such a case, it was unwise for Germany to risk its economic interests, particularly its heavy reliance on Russian natural gas.

However, Germany, later, began supplying weapons and other military aid to Ukraine under domestic and international pressures. Later, Germany even supplied heavy military equipment to Ukraine. As of August 2025, Germany is one of the largest suppliers of military aid, amounting to $47 billion worth. This includes air-defense systems, advanced drones, and heavy artillery. German action illustrates how incremental support erodes Russia’s nuclear red lines.

Incremental Steps Eroding the Threshold 

In the Russian conceptualization of deterrence, strategic deterrence (strategicheskoye sderzhivaniye), both nuclear and conventional deterrence merge into one holistically integrated framework. The threat of or actual use of nuclear weapons would deter a conventional attack on Russia, help achieve military objectives, prevent third parties from entering a war, and help de-escalate a war. In the 1990s, when Russia fielded a conventionally inferior armed force, it relied primarily on nuclear deterrence for its security.

However, a nuclear-deterrence-focused security strategy does not consider the erosion of thresholds owing to incremental changes during war (i.e., incremental changes test interwar and intrawar deterrence). After Pakistan became a nuclear power, Pakistan employed sub-threshold tactics (terrorism) against India, assuming that the fear of mutual nuclear vulnerability would prevent India from using kinetic means in retaliation. However, this approach failed when India employed conventional force against Pakistan in 2016, 2019, and, more prominently, in Operation Sindoor (2025). Similarly, Ukraine challenged Russia with its aggressive attacks in response to Russian invasion.

Russia’s updated nuclear doctrine (2024) brought the threshold of nuclear employment to an even lower level than earlier doctrine. This includes “actions by an adversary affecting elements of critically important state or military infrastructure” and “the massive launch […] of air and space attacks means (strategic and tactical aircraft, cruise missiles, unmanned, hypersonic and other aerial vehicles).”

Ukraine’s Operation Spyder Web crossed these “nuclear thresholds” set in the 2024 doctrine. Russia’s numerous threats of tactical nuclear weapons use are not taken seriously by Europe any longer. This creates a stability-instability paradox where “conventional balances also reduce the credibility of nuclear threats precisely because there is a conventional alternative to resorting to nuclear weapons.”

One of the implications of the stability-instability paradox in international relations is that while nuclear weapons create stability at the strategic level by deterring large-scale war between nuclear-armed states, they increase the likelihood of smaller, limited, or conventional conflicts. This is reinforced in the Ukraine conflict, where Russia simply cannot use nuclear weapons to deter third-party military help to Ukraine and Ukraine’s counteroffensives.

Nuclear deterrence has limitations and does not deter incremental or conventional actions of lower yields. The costs associated with utilizing nuclear weapons for deterring incremental erosion of thresholds is unimaginable. It is difficult for parties in a war to agree upon thresholds. Thus, resorting to conventional attacks rather than escalating to nuclear use becomes more likely, even after crossing stated red lines. 

States Should Build on That 

For that matter, those states looking to augment their defence preparedness should invest in conventional deterrence capabilities that can guarantee security. This goes beyond just building missile and air-defense systems of a high calibre. Conventional deterrence is not merely about weapons to deter an adversary.

Military thinking needs to go beyond just inventing new weapons and focus on military strategy. States need to go beyond a one-size-fits-all understanding of deterrence, where all states subscribe to the same benchmarks, variables, and conceptualization of deterrence, and have a shared sense of it. Situating deterrence within the fold of strategic culture, how a state’s strategic culture shapes deterrence, is more helpful. For instance, in contrast to the denial versus punishment typology, Russia uses the forceful versus non-forceful scheme for deterrence.

States may need to invest in the re-invention of military doctrines, strategy, and thinking to suit current challenges. It is worth studying how adversaries see the concept of deterrence. It confers two advantages. First, it helps one remain prepared for any incremental utilization of force under the fear of mutual destruction. Second, it allows the defender to assess the opponent’s risk-taking appetite and nuclear threshold in a war. This would confer advantages associated with effectively using conventional means.

At the same time, both parties need to be aware of over-extension, where a misguided action can cause a catastrophic nuclear exchange. Since agreeing on the same trigger point is subjective and difficult, states must study the pace, timing, and intensity of the use of non-nuclear forces to effectively achieve objectives without jumping to the nuclear step on an escalatory ladder.

In the end, preventing nuclear war is critical. Thus, understanding thresholds is important. If war is unlikely to end, ensuring it does not escalate to nuclear use should be a top priority.

Anshu Kumar is a Junior Research Fellow at the Centre for Russian & Central Asian Studies, Jawaharlal Nehru University, New Delhi.

The Russia-Ukraine Conflict Showcases the Limits of Nuclear Deterrence was originally published on Global Security Review.

The simulated conflict ended without regime change in Pyongyang, allowing Kim Jong Un to claim a political victory. While avoiding nuclear escalation may seem prudent, such an outcome could deal a lasting blow to the credibility of America’s extended deterrence in East Asia.

The Guardian Tiger scenario should not be dismissed as an academic exercise. It reveals a critical vulnerability in the psychological foundation of deterrence: the perception among adversaries and allies of American willingness to use nuclear weapons in defense of its partners. If allies conclude that Washington will not cross the nuclear threshold even after a nuclear attack, they may question the value of the nuclear umbrella. Adversaries, meanwhile, may learn that nuclear coercion, carefully calibrated, can succeed.

In the simulation, North Korea escalated to a tactical nuclear strike against a South Korean Navy destroyer in the East Sea (Guardian Tiger I) and later against the Chinhae naval base (Guardian Tiger II), home to the Republic of Korea Navy’s Submarine Force Command and occasionally used for allied submarine visits. According to the report, American leaders debated nuclear retaliation but settled on conventional “pulsed” strikes.

In a real-world scenario, such strikes could plausibly involve precision-guided munitions from long-range bombers like the B1-B and Tomahawk cruise missiles launched from Arleigh Burke-class destroyers, aimed at targets such as missile transporter-erector launchers, hardened artillery positions along the DMZ, and command-and-control facilities near Pyongyang. In the exercise, the US stopped short of regime change, seeking to avoid further nuclear escalation and prevent a direct war with China—a decision that would have allowed Pyongyang to absorb the damage, count the survival of its regime as a strategic win, and enter negotiations from a stronger position.

Extended deterrence depends on more than military capability. It is rooted in the belief, shared by allies and adversaries alike, that the United States is willing to defend its partners by all means necessary, including nuclear weapons. An American failure to respond in kind to North Korean nuclear use would plant seeds of doubt. Japanese and South Korean leaders could begin to question whether Washington would truly “trade Los Angeles for Tokyo or Seoul” if the stakes involved limited nuclear use rather than an existential threat to the United States.

That doubt could trigger cascading effects. Calls in Seoul’s National Assembly for indigenous nuclear weapons, expanded production of the Hyunmoo‑4 ballistic missile, and pressure on Tokyo to more seriously pursue nuclear sharing arrangements have already entered the political debate.

This concern is amplified by North Korea’s 2022 nuclear weapons law, which openly authorizes preemptive nuclear strikes in scenarios ranging from an imminent attack on leadership to undefined overwhelming crisis situations. Analysts note that the law’s language effectively lowers the threshold for nuclear use, implying tactical employment to repel invasion and seize the initiative in war. Rather than viewing nuclear use as a desperate last resort, Pyongyang now appears willing to employ such weapons early. For example, a low‑yield detonation against South Korean or American forward-deployed forces to shock Washington and Seoul into political concessions.

The challenge grows sharper in the event of a dual contingency: simultaneous crises on the Korean Peninsula and in the Taiwan Strait. Guardian Tiger II simulated such a scenario, with China launching a multi-domain assault on Taiwan while North Korea escalated on the peninsula. In such a real-world situation, US Indo-Pacific Command could be forced to divert the USS Ronald Reagan Carrier Strike Group from Yokosuka to the waters east of Taiwan, deploy B‑52H bombers to deter Chinese operations, and even consider repositioning some Terminal High Altitude Area Defense and Patriot missile defense batteries from South Korea to protect American assets in Okinawa and Guam.

Such shifts illustrate how a stretched American posture could reduce missile interception capacity on the peninsula and temporarily remove some nuclear-capable platforms from immediate Korean defense. North Korea could calculate that Washington, already balancing a larger confrontation with China, would avoid nuclear escalation in Korea to conserve resources and limit the risk of an all-out US-China war.

The political and strategic consequences would ripple across the region. In Seoul, public and elite opinion could shift sharply toward developing an independent nuclear arsenal—something 71 percent of South Koreans already support. South Korea’s nuclear latency, widely assessed by proliferation experts, suggests it could potentially produce a weapon in as little as 6 months if political consensus formed.

In Tokyo, the debate over counterstrike capabilities, missile defense expansion, and potential nuclear sharing with the United States would intensify, potentially accelerating deployment of Tomahawk missiles and further integration of F‑35A fighters, which, in the US fleet, are being certified for B61‑12 nuclear bombs, into allied defense planning. Beijing, meanwhile, could seize the opportunity to position itself as a stabilizing broker, offering to mediate between Seoul and Pyongyang while shielding the latter from full international accountability, further eroding American influence.

Avoiding nuclear escalation in a limited-strike scenario is understandable, but Washington cannot afford such a decision to be interpreted as weakness. Strengthening deterrence credibility in Northeast Asia will require more than declaratory statements. Clear and credible red lines for nuclear use must be communicated both publicly and privately. Integrated nuclear-conventional planning with allies should ensure that flexible response options, from proportionate nuclear strikes to overwhelming conventional retaliation, are executable on short notice. Contingency planning must explicitly account for simultaneous conflicts in Korea and Taiwan, with pre-positioned munitions, dispersed basing arrangements for nuclear-capable aircraft, and rotational deployments of dual-capable ships and submarines to maintain strategic presence even under force diversion.

Equally important is sustained alliance signaling. These include high-visibility joint exercises like the US-ROK Freedom Shield exercises, regular port visits by nuclear-capable submarines, and trilateral missile tracking drills with Japan. These measures reassure allies, complicate adversary calculations, and demonstrate that any nuclear use will incur unacceptable costs.

The Guardian Tiger exercises are valuable not because they predict the future, but because they reveal how quickly deterrence can fray in the fog of crisis. A single decision to refrain from nuclear retaliation, however understandable at the time, could reverberate for decades and reshape the strategic balance in East Asia. In the nuclear age, preserving deterrence means guarding against both uncontrolled escalation and the perceptions of hesitation that could invite it.

Dr. Ju Hyung Kim, President of the Security Management Institute, a defense think tank affiliated with the South Korean National Assembly, is currently adapting his doctoral dissertation, “Japan’s Security Contribution to South Korea, 1950 to 2023,” into a book.

A Nuclear Umbrella in Peril: Lessons from North Korea’s Escalation Scenarios was originally published on Global Security Review.