[Gartner SRM Summit 2025] Cyber Deterrence Strategy

The session on stopping attacks before they even begin, known as Cyber Deterrence, was one of the most thought-provoking at Gartner SRM Summit 2025.

Gartner analyst Will Candrick introduced a novel defensive approach that supplements existing protection and detection measures while focusing on changing attacker behavior or causing attackers to abandon their plans before they launch. Unlawful “hacking back” tactics were explicitly ruled out as impractical and illegal. Instead, the strategy examines attackers’ core motivations - why they attack in the first place - and applies methods to weaken or neutralize those motivations so that attackers decide not to strike at all. This concept is called Cyber Deterrence: a strategy to halt an attack before it even begins by convincing the adversary that success is unlikely or too costly.

In practice, Cyber Deterrence involves:

1. Disrupting the attacker’s profit motives or revenue streams

2. Exposing their tools, techniques and infrastructure to public scrutiny

3. Strengthening legal consequences and partnerships to hold them accountable

4. Raising the operational cost and risk of mounting an attack

When the effort and risk outweigh the potential gain, attackers simply disengage.

Common Misconceptions

• Cyber Deterrence is not hacking back

  Many confuse deterrence with retaliatory hacking. Effective deterrence employs a range of tactics to discourage adversaries without resorting to illegal counterattacks.

  
  

• Cyber Deterrence is not merely proactive prevention

  In security jargon, “proactive” often means enhanced detection or response. By contrast, Cyber Deterrence operates upstream to change attacker intentions before any alert is triggered.

  
  

• Attackers are not infinitely persistent

  Although adversaries can seem relentless, they remain human actors driven by incentives. If those incentives turn negative, through higher cost, reduced anonymity or legal risk, the likelihood they will proceed drops sharply.

Expanding the Security Framework

Cyber Deterrence extends the scope of traditional cybersecurity by intervening before an attack ever begins. Its focus is on changing attacker behavior in the pre-attack phase rather than waiting for protection, detection, response or recovery measures to kick in.

In other words, Cyber Deterrence complements existing security frameworks instead of replacing them. Typical frameworks cover governance, identification, protection, detection, response and recovery but rarely address deterrence itself. The purpose of Cyber Deterrence is to add a new layer of defense that fills this gap. Although most organizations have never implemented deterrence measures, understanding the concept enables them to develop practical methods that strengthen their overall security posture.

Gartner’s PARC Framework

Attackers are human and for the most part act rationally, responding to incentives that benefit them. Gartner therefore analyzed attacker goals and motivations to develop new indicators for deterrence. Based on this work, they introduced the PARC Framework, which uses four core attacker motivations as key metrics. By understanding these drivers and weakening them, defenders can guide adversaries to alter their intended actions through Cyber Deterrence measures.

• Attackers’ objectives vary depending on the target—whether a business, institution or nation-state—and typically include:

  • Espionage (state intelligence gathering, theft of defense technology)

  • Disruption (disabling critical systems)

  • Cyber warfare (attacks or information operations between nations or agencies)

  • Data exfiltration (stealing sensitive data from governments, companies or institutions)

  • Curiosity-driven hacking (initially exploring vulnerabilities, now often escalated to full-scale attacks)

  • Hacktivism (politically or socially motivated intrusion)

  • Extortion (forceful demands such as encrypting data for ransom)

  • Peer recognition (seeking status within hacker communities)

  • Political interference (targeted attacks to influence political outcomes)

  • Revenge (retaliatory or competitive attacks, including illicit “hack back” efforts)

  • Publicity (attacks to boost the attacker’s notoriety or self-satisfaction)

  • Election meddling (disrupting elections, spreading false information or conducting unfair campaigns)

• Gartner PARC Framework

Gartner’s PARC Framework identifies four core motivations that drive attackers toward their objectives. Attackers respond to positive or negative outcomes tied to these motivations, and by influencing them negatively, defenders can deter attacks. Understanding these four motivations is essential for designing effective Cyber Deterrence strategies.

• P Profit – Attackers seek to maximize financial gain while minimizing risk

• A Anonymity – Attackers aim to maintain a low profile and avoid detection or investigation

• R Repercussions – Attackers fear legal, cyber or physical consequences if their identity is exposed and will seek to avoid accountability at personal, group or national levels

• C Costs – Attackers pursue maximum efficiency and will abandon operations if the expense or effort outweighs their goals

Cyber Deterrence - Phase 1

Developing Deterrence Tactics by Attacker Motivation

The first phase of Cyber Deterrence implementation is to develop specific tactics that lead attackers to negative conclusions based on their core motivations. These tactics, grounded in the PARC Framework, focus on disrupting how attackers generate profit exposing their tools and techniques to public scrutiny enforcing accountability for their actions and imposing direct or indirect costs on their operations.

• For Profit motivation tactics aimed at undermining attacker revenue consider establishing a bug bounty program to collaborate with ethical hackers instituting a strict no-ransom payment policy and deploying deception techniques and false data to devalue stolen information.

  
  

• For Anonymity motivation tactics designed to strip away attacker cover consider publicly attributing attacks when perpetrators are identified and exposing unique indicators or tool signatures linked to their campaigns.

  
  

• For Repercussions motivation tactics that impose strong accountability consider immediately publishing detailed threat intelligence including zero-day exploit information partnering with law enforcement to identify and prosecute attackers and collaborating with government agencies on targeted disruption measures.

  
  

• For Costs motivation tactics that raise the effort required consider deploying honeypots and deception environments to delay and frustrate attackers encouraging adversaries to abandon their objectives and working with security vendors or authorities to dismantle attacker infrastructure and recover illicit funds through legal channels.

Cyber Deterrence - Phase 2

Identifying the Most Deterrable Adversaries

It is never easy to deter every type of attacker targeting an organization. Not all adversaries can be deterred equally and not every deterrence tactic will be effective against every threat actor.

To determine which attackers are most vulnerable to deterrence, begin by listing your primary threat actors. Then ask the following three questions for each actor:

• What goal drives this threat actor?

• What outcome are they pursuing?

• Could they achieve their objective elsewhere?

By answering these questions, you can pinpoint the specific adversaries your organization is most likely to deter and focus your deterrence measures accordingly.

Cyber Deterrence - Phase 3

Align Deterrence Tactics to Specific Threat Scenarios

Deterrence measures are effective only when tailored to realistic threat scenarios. We recommend that each organization predefine and document, for every major threat scenario, the attacker’s motivation, the applicable deterrence tactics and a clear execution plan, then formalize these in standard operating procedures.

• Ransomware attacks: These aim for quick and easy ransom payments. You can deter them by adopting and publicly announcing a strict no-payment policy.

• State-sponsored PII theft using zero-day exploits: These aim to steal strategic or sensitive information. You can undercut them by rapidly disclosing the exploit techniques and patch status, thereby reducing the exploit’s effectiveness.

• Cybercriminals hunting for IP data to sell on black markets: These seek to monetize stolen intellectual property. You can deter them by deploying honeypots filled with fake data to trap attackers in decoy environments for rapid detection and by publicly exposing their attack methods.

Cyber Deterrence – Phase 4

Promote Your Cyber Deterrence Measures So Adversaries Know They Exist

The final implementation step is to publicize your deterrence program in order to sap attacker confidence. Be careful not to antagonize or provoke adversaries. Deterrence only works if attackers learn that preventative measures are already in place before they launch an attack. This requires a subtly balanced approach and carefully chosen messaging, for example by:

• Publishing your cybersecurity policies and response procedures on the corporate website or in the annual security report

• Highlighting recognized security certifications such as ISO 27001 or SOC 2 and clearly communicating your security posture

• Announcing completed legal actions or rapid incident responses to demonstrate real-world consequences

• Issuing press releases that outline your deterrence capabilities

• Making your Cyber Security policy publicly available

• Even discreetly sharing deterrence details in appropriate security or hacker forums

The goal of promoting your deterrence measures is to instill doubt in attackers that they can succeed, or fear of failure, so they choose not to target your organization in the first place.

Summary

Integrating Cyber Deterrence into a typical enterprise cybersecurity strategy is no easy task. It requires creating psychological, technical and legal barriers that break an attacker’s will before any breach can occur.

Why bother adopting such a challenging concept?

Applying Cyber Deterrence goes beyond the threat detection and response investments organizations already make. It allows defenders to genuinely threaten attackers with consequences and persuade them to stand down. This approach not only raises overall security maturity but also delivers a clear message to adversaries, reduces organizational risk through proactive measures and ultimately reduces the number of attempted attacks. It represents an evolved form of cyber defense that focuses on preventing attacks, not just reacting to them.

Strategic Element	Implementation Method	Effect
Enhance Detection Capabilities	Operate a SOC, adopt MDR	Early detection of attack stages and reduced response time
Establish Response Framework	Develop IR plans and contract external response teams	Recognition that threats can be neutralized
Share Threat Intelligence	Participate in Threat Intelligence programs and ISACs	Enables participation in deterrence scenarios
Specify Legal Actions	Include sanctions upon breach	Enables participation in deterrence scenarios

Author – Paul Kwon, CEO | PAGO Networks