The global defense establishment loves a good infrastructure panic. Every time a state official beats their chest about retaliating for cyberattacks on critical infrastructure, the markets flinch, the talking heads panic, and the media runs the same tired playbook.
Case in point: the reaction to statements out of Iran's security council regarding retaliatory strikes against Israeli critical infrastructure. The consensus view is that we are on the precipice of a digital apocalypse where a few lines of code will turn off the lights, poison the water, and collapse modern civilization.
It is a compelling narrative. It is also entirely wrong.
The lazy consensus treats cyberwarfare as an extension of conventional artillery—a predictable, linear escalation ladder. The reality is that infrastructure cyberattacks are historically ineffective, strategically clumsy, and fundamentally misunderstood. We are not watching the dawn of a new era of digital warfare. We are watching a high-stakes game of geopolitical theater where the weapons are deliberately loud because the actual damage is remarkably quiet.
The Flawed Premise of Digital Attrition
The core mistake analysts make is equating access with destruction. For two decades, I have watched security firms and state actors hype the threat of Industrial Control Systems (ICS) vulnerabilities. The assumption is always that if an adversary penetrates a Supervisory Control and Data Acquisition (SCADA) system, the targeted nation grid collapses.
It does not.
In the real world, critical infrastructure is stubbornly resilient. It is not resilient because its software is impenetrable—most legacy infrastructure software is shockingly insecure. It is resilient because it is a messy, redundant, hybrid mess of digital components and physical, mechanical overrides.
When a state actor targets a power grid, they face a fundamental engineering problem. Software can cause a temporary disruption or trick a sensor into misreporting data. But physical machinery possesses physical inertia. Safety valves, manual breakers, and analog backups exist specifically because mechanical parts fail on their own. Overriding a digital system rarely stops a human operator from walking over to a breaker box and flipping a physical switch.
Look at the historical precedents instead of the hypothetical nightmares. The 2015 and 2016 cyberattacks on Ukraine's power grid—widely considered the high-water mark of state-sponsored infrastructure disruption—left parts of Kyiv without power for a grand total of a few hours. The operators did not need a team of elite computer scientists to fix the problem. They bypassed the compromised digital systems and ran the grid manually.
The High Cost of One-Time Use Weapons
The public views cyber weapons as infinite ammo. The truth is that high-end cyber capabilities targeting specific critical infrastructure are bespoke, fragile, and highly perishable.
To build a cyber weapon that can cause actual physical damage, an offensive state actor needs to know the exact make, model, firmware version, and physical configuration of the target's machinery. This requires immense intelligence gathering, millions of dollars in research, and the discovery of zero-day vulnerabilities.
The moment you deploy that weapon, you lose it.
Once the code is executed, the defender captures the payload. They analyze it, patch the vulnerability, and share the indicators of compromise with the rest of the world. A missile can be manufactured a thousand times on an assembly line. A sophisticated cyber weapon is often a single-shot rifle that melts in your hands after the trigger is pulled.
State actors like Iran and Israel know this math. They are not going to burn their most prized, deeply embedded strategic access points for a tactical retaliatory strike that results in a temporary news cycle. When you hear public threats about targeting infrastructure, you are hearing political posturing, not operational planning.
The Reality of Retaliation
Imagine a scenario where a state actually succeeds in causing catastrophic infrastructure failure via digital means—say, shutting down a water treatment plant for weeks.
The immediate result is not a continuous digital chess match. The result is conventional war.
The illusion of cyber warfare is that it offers deniability or a "soft" alternative to kinetic violence. It does not. If an operation causes mass civilian casualties or permanent economic ruin, the victim nation will not respond with a counter-hack. They will respond with precision-guided bombs.
The red lines of international conflict do not care about the medium used to cross them. Therefore, state-sponsored cyber operations against infrastructure are intentionally calibrated to stay below the threshold of kinetic war. They are designed to annoy, to embarrass, and to signal capability. They are not designed to destroy.
Dismantling the Panic Economy
If the threat to infrastructure is so heavily constrained by physical realities and strategic risks, why does the media continue to hyperventilate every time an official makes a threat?
Follow the money. The cyber panic economy serves three distinct masters perfectly:
- State Bureaucracies: Threat inflation secures massive budgetary allocations for cyber commands and intelligence agencies.
- The Private Defense Sector: Cybersecurity vendors rely on the specter of "the big one" to sell enterprise software to utilities that actually just need to enforce basic password hygiene.
- Adversarial Regimes: The perception of a devastating cyber capability is far cheaper to maintain than an actual devastating cyber capability. Deterrence is built on what your enemy thinks you can do.
The next time an official threatens consequences to critical infrastructure, stop looking for code. Look at the theater. The danger is not that a digital attack will plunge a nation into the dark ages. The danger is that the frantic, uncalculated political reaction to a minor digital disruption will trigger a very real, very bloody, conventional war.
Stop preparing for the digital apocalypse. Start managing the geopolitical noise.
