State-sponsored cyber attacks are increasingly attracting attention in the literature, with many analysts interested in the firm-level economic implications of these attacks. Nevertheless, the bulk of these studies focus on firms directly targeted in the attacks. In this paper, I examine the broader, often overlooked ripple effects of these attacks on third-party entities like cybersecurity service providers who are frequently at the frontlines of dealing with these attacks. Leveraging data on cyber attacks and stock market returns for a sample of U.S. based cybersecurity defense contractors from 2000 to 2020, I empirically demonstrate that an escalation in the intensity of state-sponsored cyber attacks prompts a behavioral shift among investors and regulators, leading to increased co-movement in firms’ stock returns. This paper thus adds a novel dimension to our understanding of the complex interplay between state-sponsored cyber attacks and the market dynamics of cybersecurity defense contractors, with important implications for national cybersecurity.

States accused of perpetrating cyber operations typically do not confirm or deny responsibility. They issue ‘non-denial denials’ or refuse to comment on the accusations. These ambiguous signals are prevalent, but they are largely ignored in the existing cyber literature, which tends to treat credit claiming as a binary choice. The ambiguity of non-denial denials and ‘non-comments’ allows states to accomplish two seemingly opposed goals: maintaining crisis stability and leaving open the possibility of their involvement in the attack. By deliberately remaining a suspect, a state can manipulate rivals’ perceptions of its cyber capability and resolve. Refusing to deny responsibility can also shape rivals’ perceptions of allies’ capabilities, enhancing the credibility of deterrence. All of this can be accomplished without the escalatory risks that would come with an explicit admission of responsibility. Where previous research has focused on the dangers of escalation and the limitations of costly signalling with cyber, we show that non-denial denials and non-comments make cyber operations considerably more useful than the literature appreciates.

Conflict in cyberspace refers to actions taken by parties to a conflict to gain advantage over their adversaries in cyberspace by using various technological tools and people-based techniques. In principle, advantages can be obtained by damaging, destroying, disabling, or usurping an adversary's computer systems (‘cyber attack’) or by obtaining information that the adversary would prefer to keep secret (‘cyber espionage’ or ‘cyber exploitation’). A variety of actors have access to these tools and techniques, including nation-states, individuals, organized crime groups, and terrorist groups, and there is a wide variety of motivations for conducting cyber attacks and/or cyber espionage, including financial, military, political, and personal. Conflict in cyberspace is different from conflict in physical space in many dimensions, and attributing hostile cyber operations to a responsible party can be difficult. The problems of defending against and deterring hostile cyber operations remain intellectually unresolved. The UN Charter and the Geneva Conventions are relevant to cyber operations, but the specifics of such relevance are today unclear because cyberspace is new compared to these instruments.