What must be remembered in deterrence is that for the deterrent threat to be perceived as credible, the one who is seeking to deter must show it has the capabilities and intentions to follow through with its actions; this is the basis of a valid deterrent.  The problem here lies within the need to overtly show that an actor possesses some offensive and defensive cyber capabilities without showing its full hand.  Since many cyber capabilities might possibly be used in a single shot capacity before being rendered ineffective, actors may use their tools solely in a covert or clandestine fashion.  Without making its intentions and a few of its capabilities known to the aggressors, the aggressor may not accurately perceive the message and cyber deterrence would fail.

In this domain in which equal damage can be inflicted by individuals or nation states with an almost infinite variety of motives, incentives, and notions of rationality, and in which attribution is an unsolved problem, traditional notions of deterrence action may need rethinking. For example, taking a demonstrative action that shuts down or damages computers or network links through which an attack is routed, may or may not reach the source attacking party in any topological or timely way- but could cause enormous collateral damage to non-adversaries or to one's own economy, society, or security.

At the least, until a deterring party can focus tightly on setting priorities about the assets it desires to protect, and exposing noticeableactions to both protect and respond, it seems likely to be in a permanent defensive posture, learning from successful attacks only that it is vulnerable.