Why do some states consistently conduct offensive cyber operations while others do so only occasionally? SIS Professor William Akoto's new article in the Journal of Global Security Studies develops a theory of persistence in cyber statecraft, arguing that sustained offensive activity emerges only after states overcome significant fixed costs and reach high levels of technical and organizational capability. Once dedicated cyber units are established within a state’s security institutions and their strategic value is demonstrated, offensive operations tend to become routine components of national strategy.

Drawing on a cross-national dataset of state-linked cyber incidents from 2000 to 2020, the analysis shows that low- and mid-capability states are unlikely to adopt persistent offensive cyber practices. In contrast, the probability increases sharply among highly capable states. Furthermore, once states cross this threshold into persistent activity, they rarely revert to more limited engagement. Variables such as trade openness and leader tenure do not reliably predict this pattern, indicating that even economically integrated or politically stable states maintain ongoing covert cyber campaigns when sufficient capacity and strategic incentives are present.

These findings challenge the view that all states can easily participate in sustained cyber conflict. Instead, persistent state-sponsored cyber operations are best understood as the result of long-term investment, institutionalization, and advanced capabilities concentrated among a relatively small group of states.

Read the full article here.