National Cyber Resilience in the Age of AI

Executive summary

Frontier AI has changed the economics of cyber conflict. The window between a software flaw becoming public and someone exploiting it has collapsed from months to days; in some cases, to hours. The work of an attack (the reconnaissance, phishing, and writing of the exploit) is being done by machines at the same time, and on the same infrastructure that powers the rest of the digital economy. Defender effort rises in a straight line, making spend-for-spend strategy unsustainable. The only path is to make every unit of defence more effective.

That market is now what democracies face. A sustained campaign against a parliamentary state is rarely fought to destroy. It is fought to make a country look broken to its own citizens, and the government slower than the news cycle in answering for it. Every move is kept just deniable enough to keep the response national and slow, rather than allied and fast. Damage is the means; the erosion of public trust is the end. The campaign sits in the gap between what a free press can plausibly report and what an open court can prove, and the defence must operate inside that gap or arrive too late to matter.

With the ongoing proliferation of offensive cyber, the policy question is where national effort has the most impact on the economics of cyber, to keep the defence effort sustainable and actionable against AI-era threats. This paper sets out a doctrine of six moves in the order a state should make them.

Choose what must not fail. Designate the Minimum Viable State: the handful of functions that if lost, harm life, financial system, public order or the workings of the state, and rehearse the fallback for each. Decide where trust comes from. Anchor digital trust in a set of services hardened to a level past the point where breaking them is affordable. Raise the floor. Close the cheap path with a baseline every regulated entity must meet, a stricter regime above it for the systems the country cannot lose, and a regulator with the authority, and the will, to suspend or force fallback mode of a service that is unsafe to fly, forcing adversaries to spend more on attacks. Defend at machine speed. See the estate, shrink it, and give the defender the legal authority, granted in advance and reviewable after the fact, to act within the hours an attacker now has. Mobilise the population. Plan cyber defence the way the Nordics plan total defence: as one national workforce that runs from the professional, through the reservist and the student, to the citizen, so that capacity scales with the 6 threat. Tell the truth first. Trust survives openness, not suppression, and becoming proactive in transparency is the easiest means to deny the aggressor the political payoff.

The outcome is not invulnerability. No state, however well governed, will keep out every attack. The real outcome is attacks becoming non-decisive: where incidents stop becoming crises, crises stop becoming national paralysis, and an attacker pays more than the result is worth. A citizen, watching the system bend, still trusts that it will hold.

FireEye CEO Kevin Mandia, SolarWinds CEO Sudhakar Ramakrishna and Microsoft President Brad Smith before a Senate Intelligence Committee hearing on the SolarWinds breach, Washington, February 23rd 2021. The breach compromised nine federal agencies and roughly 18,000 customers, turning a software compromise into a systemic national-security problem.

Photo: Drew Angerer / UPI

The proliferation of offensive cyber capability

For a decade, the economics of offensive cyber drifted in one direction. Tools grew cheaper, marketplaces deeper, and freelancers more capable. Mounting a serious attack no longer required a state intelligence service; a competent operator and a credit card would do. Defenders adjusted, and the system held. Damage attributed to cybercrime now runs into the trillions of dollars annually.^{1Industry estimates, e.g. Cybersecurity Ventures, Official Cybercrime Report (2024). On cyber risk as a macrofinancial-stability concern, see International Monetary Fund, Global Financial Stability Report, April 2024, Chapter 3: “Cyber Risk: A Growing Concern for Macrofinancial Stability”.}

The cost curve has shifted

Artificial intelligence has changed the curve. The drift of a decade is being compressed into a far shorter cycle, and the capability behind each price point has deepened. Reconnaissance, social engineering, vulnerability discovery and exploit development, work that once rationed serious offensive cyber to a small cadre of skilled operators, are being automated and sold as off-the-shelf services. Attacks have become cheaper, faster and available to a much wider set of actors. The shocks of the past two decades, from Estonia in 2007 to WannaCry, NotPetya, SolarWinds and the war in Ukraine, drew regulatory adjustments, but none shifted the cost curve. This has.^{2On Estonia 2007, see Ottis, Analysis of the 2007 Cyber Attacks against Estonia (NATO CCDCOE, 2008); on WannaCry, see UK National Audit Office, Investigation: WannaCry cyber attack and the NHS (2017).}

Defenders entered the AI era with practices designed for a slower threat: annual penetration tests, quarterly patch cycles and four-eyes controls written for one human checking another. Both speed and cost have moved against them.

The window between a software flaw becoming public and a working exploit being in circulation has collapsed from months to days, with weaponisation now sometimes preceding disclosure.^{3Mandiant, M-Trends 2019 and How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends (October 2024); Verizon DBIR 2018–2024. Disclosure-to-exploitation averaged around two months across widely exploited flaws in 2018–19; by 2023 the average had fallen to five days, with weaponisation now sometimes preceding disclosure.} Around half of the zero-days observed in the wild in 2025 targeted enterprise technologies, with edge security and networking equipment (the perimeter on which most of the rest depends) taking the largest share.^{4Google Threat Intelligence Group, 2025 zero-day exploitation review (2026).} Different data series point the same direction: defenders are being asked to remediate within a window the attacker can close in an afternoon.

The marginal cost of an attempt has fallen by orders of magnitude. General-purpose AI can now perform substantial portions of the intrusion workflow, from the reconnaissance that opens a campaign to the localisation that adapts it for the target market. The decisive effect is parallelism: many tailored attempts running at once, against many targets, on the same infrastructure that powers the rest of the digital economy.^{5UK AI Security Institute and frontier-lab evaluations (Anthropic capability evaluations under its Responsible Scaling Policy, OpenAI red-team reports, Google DeepMind frontier-safety evaluations) report substantial reductions in the marginal cost of intrusion sub-tasks under AI-assisted workflows.} The first campaigns combining several intrusion steps under AI direction were disclosed in late 2025; the structural shift holds whatever line is drawn on machine autonomy.^{6Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (November 2025). Independent commentary contested the degree of model autonomy in the specific campaign.}

The asymmetry runs deeper than tooling

The defender’s costs do not move on the same curve. An attacker only needs one path to succeed and can tolerate a high error rate, since a wasted attempt costs almost nothing. A defender must cover every path and cannot tolerate the same error rate, because a false positive isolates a hospital or freezes a payment rail. Many consequential defender actions, such as blocking, attributing, sanctioning or taking a service offline, are acts of public authority. The requirement that they be lawful, reversible and explainable is where defender AI hits its ceiling.

The asymmetry is also uneven across the digital estate. It hits the systems hardest that are easy to attack and slow to patch, such as industrial controllers, medical devices or the legacy estate that runs much of government and banking. Its bite is weaker on systems that can be tested, fixed and re-deployed at machine speed, such as browsers, mobile platforms and modern cloud-native services. In between sit complex distributed systems. Their flaws are easy to find in code but hard to verify in practice. A strategy that treats the whole problem as one will misallocate effort. The chapters that follow distinguish what the state can re-engineer from what it can only contain and set policies accordingly.

Proliferation and systemic risk

Offensive cyber capability now sits in a single market that runs from state intelligence services at one end to individual freelancers wielding AI tools at the other, with contractor companies, ransomware affiliates and information-operation shops in the middle. Their boundaries are deliberately blurred, and capability has deepened in each tier. The legal categories that govern state responsibility were drafted for a physical world in which the aggressor’s hand was easier to see. The result is a permissive market for sustained pressure that does not cross the threshold for the use of force.

The shift also turns cyber risk from a technology problem into a systemic one. The same tooling, applied in parallel, can target the common software, cloud platforms, payment rails and managed-service vendors on which many essential entities depend. The International Monetary Fund has begun to treat AI-era cyber risk as a question of financial stability; the European Central Bank has warned that AI can chain individually minor vulnerabilities into serious attacks faster than the conventional patch cycle can respond. The campaigns that this market now supports, and the political effects they may produce, are the subject of the next chapter.^{7International Monetary Fund, Financial stability risks mount as artificial intelligence fuels cyberattacks (2026); see also European Central Bank, F. Elderson on AI and operational resilience in banking (2026).}

The war in Ukraine showed how cyber operations, infrastructure attacks and information operations now run alongside conventional military force.

Photo: Josef Cole / U.S. Cyber Command

Cyber conflict on a national scale

The last chapter described economics. This chapter describes the purpose of that market in this economy. A sustained cyber campaign against a parliamentary democracy is rarely fought with the intent to destroy. It is fought to make a country look broken to its own citizens, and to make the government respond slower than the news cycle. Every piece is kept just deniable or ambiguous enough to ensure the response stays national and slow rather than allied and fast.

Disruption is the means. The erosion of public trust is the end.

Four effects, in order

The campaign pursues four effects; in roughly the order it can deliver them. Services are disrupted until citizens feel the inconvenience. The information environment is distorted until the press office responds rather than announces. Officials are demoralised until decisions slow and statements weaken. These three effects lead to the fourth: the erosion of trust. A parliamentary democracy holds its legitimacy on a single condition: that citizens believe the machinery of the state, its institutions and digital systems, works as advertised. Sustained pressure attacks both beliefs. Doubt accumulates among enough citizens, journalists, allies and markets to alter what the country’s government seems able to do. The campaigns fall just inside the gap between what the free press can plausibly report and what an open court can adjudicate.

Two methods: impersonation and cascade

Attackers rely on two operational methods to achieve these four effects. The first is impersonation: the aggressor forges the speech, signatures and records by which a government is believed. The second is cascade: the aggressor chooses targets in such a way that a single break propagates through every system that depends on it. Impersonation manufactures the doubt; cascade scales it. The cheapest path to national-scale effect is therefore a slow accumulation of disruption, distortion and impersonation, sequenced to compound and erode public trust, rather than a single spectacular intrusion.

Work is divided across the tiers introduced earlier. The aggressor state buys depth from its own offensive units, breadth from contractor companies that front as commercial firms, and volume and noise from the criminal and hacktivist market that sits below them. Each tier hands work to the next, and each adds a layer of deniability the next tier inherits.

Table 2 illustrates seven instruments that recur across the categories of campaigns seen in recent years, none of them new in kind. In any specific incident, attribution is probabilistic and contested.

AI is a multiplier for each instrument. The first reported case of an AI system orchestrating much of the intrusion lifecycle with limited human direction was disclosed in late 2025; whether that case is considered the inflection point, the cost shifts that would make such a campaign profitable have already happened.

Why the law arrives late

The whole apparatus is calibrated to fall just short of any treaty article that would justify collective response, including the use of armed force. Article 51 of the United Nations Charter recognises the right of (collective) self-defence against an armed attack. NATO has recognised that the impact of significant malicious cumulative cyber activities might, in certain circumstances, be considered as amounting to an armed attack and could lead to the invocation of Article 5 (the collective defence clause based on UN Charter Article 51) of the North Atlantic Treaty on a caseby-case basis. In practice, the threshold is high and case-specific, and sub-threshold campaigns are engineered precisely to stay below it: each incident ambiguous on its own, and impossible to add up in time to act. Operations are routed through proxies whose contractual relationship to the state can be acknowledged, denied or redrawn as the diplomatic season demands. Infrastructure sits in jurisdictions outside the relevant mutual legal-assistance treaties. Indictments name individuals who will not travel, and sanctions hit shell companies. The legal instruments work slowly, and on the wrong actors.^{8NATO, Brussels Summit Communiqué, paragraph 32 (14 June 2021). On the underlying body of doctrine, see also M. N. Schmitt (ed.), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (Cambridge University Press, 2017).}

Coordination is what makes response instruments timely. Response instruments are slow individually and only bite when several states act together: joint attribution, coordinated takedowns of state-proxy and ransomware infrastructure, sanctions against the financial rails that pay them, and supplier discipline on offensive AI capability.

The campaign is engineered to sit between what the free press can realistically report and what a court can adjudicate. The defence must operate in that gap, or it will arrive too late and be too narrow to matter. The doctrine that follows is built for that gap.

Cyber resilience policies in the age of AI

National cyber resilience is a state’s ability to maintain essential democratic, economic and public-service functions during and after cyber disruption, while preserving legal accountability, public trust and coalition interoperability.

Chapter 1 set out how frontier AI has changed the cost curve of offensive cyber work, which has led to the proliferation of offensive cyber capabilities. Chapter 2 set out the political objectives such campaigns are designed to achieve; rarely territory or money alone. The prize is the erosion of public trust in the institutions on which a free society depends, and most of the apparatus is calibrated to win that prize while staying below the threshold at which collective response would be lawful.

The policy question, then, is not how to defend everything against everyone. It is where national effort has the greatest effect on the economics of attack and defence, and where it can deny the attacker the political prize even when a technical attack succeeds.

That framing is familiar. States have long defended themselves against large adversarial forces by choosing their ground rather than matching mass. They decide in advance what must not fall, prepare it deliberately, train the population for its role, contest the information space, and bind themselves into alliances that make isolated coercion expensive. The same logic now applies in the digital domain, where the asymmetry between a well-resourced attacker and an ordinary defender has widened, and the volume of plausible attackers has risen at the same time.^{9For a longer treatment of this argument, see A. Raieste, A. Rebane, M. Tapupere and K. McBride, Government Resilience in the Digital Age (Oxford Internet Institute, Estonian IT Centre and Nortal, Tallinn, 2024)}

The six policies that follow apply that logic to the digital estate. They choose the ground (Policy 1, the Minimum Viable State), harden the points through which trust is exercised (Policy 2, the National Trust Backbone), raise the floor under everything else through enforceable standards (Policy 3), defend the resulting estate at machine speed and within the law (Policy 4), mobilise the country as a single defensive system (Policy 5), and protect the political prize directly by telling the truth first (Policy 6). They are intended to be read as one doctrine rather than six initiatives, each addressing a part of the same problem, and the gaps between them are where adversaries will look first. Table 3 summarises the effect of the policies.

Policy 1. Designate the Minimum Viable State

Choose what must not fail

A state that defends every asset to the same standard ends up defending none of them well. This fails in two ways. The first is cascade: an attacker finds the weakest peripheral system and rides it through shared identities and dependencies in the systems that the country cannot lose. The second is sovereignty: a capability the state does not own can be withdrawn, throttled or repriced by a foreign supplier, often on the day the state needs it most. Both failures come from the same missing decision by the state: which functions must remain operational under sustained attack or supply-chain failure, and which may be allowed to degrade.

Tier the estate

It helps to name three tiers (Table 4). At the top sits the Minimum Viable State: the functions the country cannot lose for an hour. Below it are essential services that can tolerate degradation for hours or days. Below that, the wider economy, held to a national hygiene floor.

A function belongs in the Minimum Viable State only if its loss within minutes or hours would directly threaten life, constitutional continuity, public order, sovereign authority, financial settlement, or national-scale trust. A politically important service is not automatically MVS. It becomes MVS only when there is no acceptable degraded mode.

The Minimum Viable State belongs in law, or at least in a national strategy. The categories can be public; technical detail need not be. Once a function sits in the top tier, the standard, procurement discipline, monitoring and rehearsed fallback that go with it follow automatically; nothing stays in the top tier on a self-assessed exemption.

Source what matters

For every top-tier function, the state needs to know who is on the hook on the worst day. There is a small menu of answers: run it in-house, regulate a domestic supplier, pool the supply with allies under treaty, or buy it commercially with audit and exit rights written in. Each option carries its own risks, sovereignty choices, and recovery story. The same logic applies to frontier AI: in this context, the strategic asset is not the model itself but the bespoke systems and integrations around it. What no state can afford is a top-tier function for which answers have never been chosen, only became the historical default. Behind the law sits a plain register: for each top-tier function, what it depends on, who supplies it, where the supplier sits, and what the country falls back to if the supply breaks. Where an essential service rests on something the state does not run itself, the state keeps the right to inspect and the duty to explain.

Rehearse the fallback

Untested fallback is not a fallback; it is a hope. Every top-tier function needs an alternative the state has run, whether on paper, in parallel or pooled with allies, and on a schedule the public can see. Rehearsal is what turns a line in a register into something the country can reach for on the day a primary supplier disappears. The results go to the regulator, and when they matter, to the public.

Key recommendations

Ask: Which national functions must remain operational under sustained attack, is that list realistic and capped, and is that choice fixed in law?

Policy 2. Harden the National Trust Backbone

Decide where trust comes from

In a digital state, trust is national infrastructure, not a property each system has to invent for itself. Whether a ministerial notice is genuine, whether a contract was really signed by the person named, whether a property register entry is the one the law recognises: these questions should have the same answer, drawn from the same hardened foundations, whether the party asking is a citizen, a bank, a regulator or a piece of software acting on behalf of any of them. The country needs a federated family of trusted services (identity, signature, registers, exchange, audit, hosting) through which every consequential act inherits its authority. Call it the National Trust Backbone. The Backbone is defined by assurance rather than provenance: it is the set of services, public or private, that the country cannot afford to lose trust in, held to one top-tier standard. A national identity service (or other elements of digital public infrastructure), an interbank clearing rail and a critical legal registry may all sit inside it; what they share is the standard, not the sector. Name it in law, fund it, federate it, and let the rest of the state, and the wider economy, lean on it. Where Policy 1 chose the functions that must not fail, the Backbone is the family of services, owned by various parties under a common regulation, from which those functions inherit their legal and digital authority.

Inherit trust from hardened services

The argument is that digital trust should be inherited from hardened national foundations, rather than reinvented system by system. The backbone is a legally recognised family of federated trust services, held to one top-tier assurance standard, with redundancies and fallbacks. A set of components, audited to the top standard, reaches a level of assurance no patchwork of sectoral half-builds will match. Some solutions are commercial, state-owned, or pooled with allies; the model varies, the standard does not. Table 5 shows the key layers in the trust backbone.

The same logic makes the backbone the country’s highest-payoff target: the more it carries, the more an attacker gains from breaking it. The answer is not to scatter trust thinner, but to spend more on the federated set already chosen: segmentation, cryptographic agility and post-quantum migration, independent audit and rehearsed fallback. Concentrated investment in plural, hardened services makes the attacker’s bet unprofitable.

Containing the blast radius: graceful backbone failure

The backbone must be designed on the assumption that a component will eventually be compromised, and that the damage must be contained at the layer where it occurs. Estonia’s 2017 ID card chip flaw, which forced the precautionary suspension of certificates on some 750,000 cards, showed why: the country kept functioning because it had more than one way to prove who you were. Four principles make this possible.

Redundancy where it matters most. No critical trust function should depend on a single product or cryptographic family. A mature digital state runs several means of authentication in parallel issued under one legal regime but built on different stacks. The same logic applies to signature, time stamping and the hosting of consequential workloads.

Fallbacks that have actually been used. A second route that has never carried real traffic is a hope, not a fallback. The backbone’s alternatives should be in routine use and rehearsed on a published timetable; switchover targets are measured in days.

Integrity that travels with the record. Authoritative registers are the country’s memory of legal facts. Every consequential entry is signed at source, chained to its predecessors, and verifiable by any recipient without trusting the operator. A successful intrusion then becomes an event that can be detected, bounded and reversed, rather than one that has to be believed or denied.

Separation that prevents propagation. Registers are kept apart, each holding only the records its regulated function requires. The service that signs is separated from the service that issues identities. Data moves through a controlled exchange channel rather than by handing out copies, and the most important registers have a second home, across redundant clouds, or in a friendly country under a treaty. Backbone identity and signature are the ordinary route for any consequential act, including those taken by software agents, whose credentials are issued for the job and the moment and revoked when those are done. Standing privileges age into liabilities.

A backbone built this way is still not invulnerable, but it can absorb a compromise and keep the state running — which, at national scale, is the only useful definition of hardened.

Key recommendations

Ask: Can a citizen verify, in real time, whether a public action, record, instruction or signature is authentic, and can they still do so even if part of the backbone itself is compromised?

Policy 3. Raise the security baseline through enforceable standards

Make security an operating licence, not paperwork

Even a patient adversary begins on a cheap foothold. Unpatched software, default credentials, unsegmented networks, copy-pasted code with known vulnerabilities: the same shortcuts that subsidise routine crime are the entry the sophisticated operator reuses before any tradecraft is spent. The attacker, criminal or state, reaches for the cheapest path that still works, because the campaign budget is finite and the next target is one scan away. Frontier-AI tooling has sharpened that logic: reconnaissance and exploit-tuning that once required a specialist now run as a workflow, in parallel, against many targets at once. The aim of a standards regime is twofold: to make the routine campaign unrewarding, and to force the patient adversary to spend tradecraft it would rather hoard, denying the cheap foothold that funds the rest of any operation.

Set a collective baseline and a stricter national regime

Risk-based standards alone no longer suffice. A short list of controls should be non-negotiable for every regulated system; a second list is nonnegotiable for every new or materially updated one. The point is not to enshrine them in doctrine but to remove the discretion to skip them: where controls are missing, the system is not compliant, irrespective of how the rest of the risk assessment reads.

Most modern jurisdictions are converging on the same layered pattern: a horizontal floor for essential services, a stricter operational regime for finance, product-security obligations for what is sold to the public, and a data-protection regime underneath. Europe’s regulatory stack is a good example of this, but the pattern is universal. For the very few systems the country cannot lose, the collective floor is not enough; a stricter national regime sits above it, updated faster, so an operator answers to one set of rules rather than two.^{10Europe’s layered stack comprises the NIS2 Directive (EU) 2022/2555 as the horizontal floor; DORA, Regulation (EU) 2022/2554, as the financial-sector regime; the Cyber Resilience Act, Regulation (EU) 2024/2847, as product-security law; the AI Act, Regulation (EU) 2024/1689; and the Cyber Solidarity Act, Regulation (EU) 2025/38. The European Digital Identity Framework, Regulation (EU) 2024/1183 amending eIDAS, sits alongside as the identity layer.}

Enforce visibly

A standard becomes serious through audits and consequences. Selfattestation is not an audit. Statutory independent audits at a cadence that tracks criticality feed a regulator with the staffing, authority and willingness to impose costs on non-compliant organisations. A regulator that does not impose costs is itself part of the attacker’s subsidy.

The aviation regulator’s instrument applies here: the authority can ground the fleet. The cyber equivalent is the power to ground a system. For the few services the country cannot lose, serious non-compliance must trigger suspension or a forced switch to a tested fallback: from one identity provider to another, one settlement rail to another. The power must be in statute, time-limited, and reviewable in court. The knowledge that the regulator can ground a system changes the price of non-compliance, not how often it is used.

Give procurement bite

A procurement clause with bite costs less than a regulator that must step in repeatedly. What the state buys should default to the tougher standard: hardened identity, signing where records are made, a tested fallback, audit access written into the contract. Non-functional requirements on cyber security make it into vendor contracts. Exceptions are recorded, on the record. The state is among the largest customers in any digital economy; what it asks for sets the price of compliance for every other customer of the same supplier.

Reward balances coercion. Firms that commit beyond the baseline should earn additional advantages: eligibility for state contracts that demand hardened security, and a public certification that customers and counterparties recognise. Together, a coercive baseline, visible enforcement and incentives make meeting the standard the firm’s cheapest path.

Key recommendations

Ask: When a critical digital service is found non-compliant, can the regulator force it into safe operation before an attacker uses the gap?

Policy 4. Defend at machine speed, lawfully

Give defenders the tools, and the law, to keep up

The defender has hours when they used to have weeks. The attackers are using AI for accelerating each step. Defence must follow suit. For this, the defenders need regulatory power to match the attack speed, see what they are protecting, shrink the attack surface, and continuously defend what remains. Each step is straightforward in principle and uncomfortable in practice; together, they are what allows the country to act before the attacker has finished.

Pre-delegated authority to match the attack speed

To match the machine speed, the defender needs the power to act — granted in advance, written into law, and reviewable in court after the fact — against systems inside the country’s own jurisdiction. Action across borders is what coalitions are for. Data-protection law applies in full, and the powers must be rehearsed in joint exercises so they are not invented during the first real crisis. Where the same containment can be done through a contract clause, it should be, on the same terms.

See the estate

It is difficult for the state to effectively shrink an attack surface without first knowing what it is. The country needs a live, machine-readable map of its digital estate, including what each system does, who owns it, how it is supplied, and where it is exposed. A map drawn by humans is out of date the day after it is finished. The new work is to automatically keep the map current to actual code and traffic. The map itself is then a top-tier service, hardened like the others.

Shrink the estate

The cheapest way into a national cascade runs through what the state has stopped looking at: the old payroll system, the portal nobody documented, the open-source library three hops from anything anyone owns, the managed service whose client list reads like a directory of essential entities. Absence of an owner is grounds for retirement, not a problem to be parked for the next administration. What is kept is modernised on a published timetable, with the system named.

For the entities a regulator already watches, it should publish a budget (a cap on the doors and privileged accounts each entity is allowed to keep open) and tighten it year on year. The cap, the instrument within the perimeter an attacker reaches for, shrinks on a timetable everyone can plan for, rather than after the incident.

Defend continuously, lawfully

The old patch cycle no longer fits the threat. AI now strings small flaws together into serious attacks in an afternoon, so priority must follow what is being used against the country, not the abstract severity score. The defender’s reply should be symmetric in tooling and asymmetric in authority: AI triages alerts against the estate map, correlates weak signals across sectors, scores which disclosed flaws are likely to be weaponised against the country, and, within pre-set rules, contains low-consequence incidents without waiting for a human in the loop. The state needs an authoritative list of the vulnerabilities being exploited in the wild with remediation duties at a pace the regulator can enforce. The legacy estate that carries the most risk is modernised on a published timetable, and the modernisation itself (reading undocumented code, recovering lost design intent, generating and testing fixes) is work that AI now shortens from years to months.

The AI tools used for this must also be bought with the same discipline as the systems they protect before they are trusted with anything consequential. Sanctioned tools must displace shadow AI inside the public sector: an unsanctioned tool inside the defender’s perimeter is a supplier the state has not chosen.^{11UK National Cyber Security Centre, guidance for defenders on frontier AI (including Why cyber defenders need to be ready for frontier AI; Preparing for a vulnerability patch wave; 10 questions to ask when using AI models to find vulnerabilities). The evaluation discipline draws on NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (2025).}

Key recommendations

Ask: Within the attacker’s window, can the state name which top-tier systems are exposed to a live vulnerability and act on the answer in law?

Policy 5. Mobilise total cyber defence

Train the country, not only the cyber team

Cyber resilience, like any form of national defence, must be built against the threat it faces. The principle is old: a state sizes its forces, its reserves and its civil preparations to the adversary. In most countries, cyber defence has yet to be brought fully under this discipline. It should be planned whole-of-society, with manpower, reserve capacity and citizen literacy calibrated to a measured threat curve, reported publicly and held to the same standard of accountability as the armed forces themselves. A government that cannot say whether its cyber-capable workforce is growing faster than the danger it faces cannot claim to be defending the country in any serious sense. A digital state needs cyber capacity on the scale of a national workforce, planned the way the Nordics plan total defence, not as a personnel programme bolted onto a security strategy.

Plan capacity as one national output

The closest precedent is the doctrine of total defence: the Nordics, Singapore and Switzerland treat military capacity as a single national workforce, in which conscripts, reservists and civil protection sit inside one plan. The cyber equivalent has the same shape and the same audiences: the professional the state must keep, the reservist it can call on, and the citizen it must teach to spot the phishing email. The university pipeline and the small-business perimeter sit between them. All of it is forecast and funded as one workforce, not separate budgets competing for staff.^{12On total defence as a planning doctrine, see the Swedish, Finnish, Singaporean and Swiss frameworks for whole-of-society defence, in which cyber capacity is treated alongside military and civil reserves.}

Retention is an executive responsibility, not a personnel-policy detail. The non-salary levers matter as much as pay: clearances that move at industry pace, rotations, and sabbaticals. Attrition should be reported annually, by role, so the public can see when the workforce is being run down.

Pool scarce roles

Pooling is how the rarest skills are made available to every ministry rather than recruited separately by each. At the national level, a country can run a single response team, security operations centre and group of incident responders, so that the specialist a ministry needs at three in the morning is reachable. Pooling is also the only credible answer to the rarest skills of all (testing the new generation of AI systems, evaluating them for misuse, migrating to post-quantum cryptography) which no single country can sustain alone.^{13EU-CyCLONe, the European Cyber Crisis Liaison Organisation Network operated under ENISA, is the standing example of allied pooling of crisis coordination at scale.}

The reserve sits alongside the salaried workforce. Volunteer and reservist cyber units (military or civil), give the state surge capacity it could never afford to keep on the permanent payroll, and a route into the regular workforce. Their value lies less in headcount on paper than in the exercises they run with the response team, the regulator and the essential operators, so that on the day a sustained campaign begins, the reserve is already trained, trusted, and known.

Build cybersecurity literacy through life-long learning

Education sits underneath all of it. Basic cyber hygiene belongs in school, gets refreshed in adult life, and is easy for anyone changing careers to pick up. At the professional end, certifications and university courses must keep pace with how attackers truly work, which means the people who teach them must spend time inside the agencies and operators they teach about.

Locked Shields, NATO CCDCOE’s annual cyber-defence exercise. The most scarce cyber capabilities are increasingly pooled, exercised and sustained across allied states.

Photo: Arno Mikkor / The NATO Cooperative Cyber Defence Centre of Excellence

Key recommendations

Ask: Does national investment in cyber defence, in money and in people, bear any honest relation to the share of national harm that cyber attacks now cause?

Policy 6. Defend democratic trust through proactive transparency

Tell the truth first

A democracy that defends trust by destroying its conditions has lost. The campaign described in the second chapter has two ways to win. It can accumulate enough public doubt to narrow what the government feels it is able to do. Or, by overreach, it can goad the defender into becoming the surveillance state the attacker was claiming it was all along. The reply has three parts: tell the truth first, rebut before the rumour is believed, and place every defensive instrument under independent oversight. People do not trust institutions because nothing ever goes wrong. They trust them when failures are reported quickly, explained clearly and investigated independently. The aviation regulator publishes a preliminary report within days and a full investigation in due course; openness, not suppression, is what sustains trust under pressure.

Disclose by default

If the state speaks first, the rumour has no legs. A legal duty by public bodies and essential operators to disclose material incidents, quickly and in terms the public can act on, turns transparency from a reputational risk into a defensive instrument. The campaign trades on the gap between an incident and the public explanation of it; a state that closes the gap inside the news cycle has already won the moment.

The templates for what the state will say are written before the incident, signed on a channel citizens know to look for, and tested in joint exercises with the regulator and the press. The same discipline applies in calmer times. A citizen can already be shown, in real time, who in the state has queried their personal data, when, and on what legal basis: a tangible piece of openness at the individual level, with a route to challenge and a parliament watching the system. Estonia has run such a log since 2017.

Pre-bunk and rebut

A standing team inside the state, working with platforms and public broadcasters, identifies and answers manipulated content before the rumour is widely believed. The trick is to explain the pattern in advance, not only the incident, so the public learns to recognise the move when it appears. Sweden has run a Psychological Defence Agency on these lines since 2022; this is the working reference.^{15Swedish Psychological Defence Agency (Myndigheten för psykologiskt försvar), established 1 January 2022 with a remit covering the identification of, and response to, foreign malign information influence.} Taiwan complements the institutional model with an operational one: line ministries publish a signed clarification within roughly an hour of a rumour appearing, in a form short enough to travel on the same platforms, the discipline being measured in tempo and reach, not volume.

The channels on which the state speaks must be advertised and rehearsed before elections, so that a faked ministerial clip can be answered on a known channel within the same news cycle. Signed channels for ministers, election notices, and emergency instructions are advertised before they are needed, not invented during a crisis. The rules under which the state works with platforms are published, so the line between defence and censorship stays where the public can see it.

Constrain the defenders

Every defensive instrument that touches citizens should be subject to scrutiny, with the right in law to inspect it and the power to recommend its suspension. What must be prevented is the slow widening of a defensive tool into a general-purpose machine for watching the people it was built to protect. Defensive tools must be built without the surveillance features they do not need: what is not collected cannot be misused. The oversight regime is what makes the difference between a free state defending itself and a security state in everything but name. This is what makes a visible difference to the public.

Key recommendations

Ask: When a fabricated ministerial video, forged notice or servicedisruption rumour appears, can citizens verify the truth through a known channel within the same news cycle?