Here's the unpopular take: when it comes to publicly attributing cyberespionage campaigns to specific nations, restraint might serve our interests better than speed.
The security industry has developed a reflexive habit. A sophisticated malware sample emerges. Infrastructure gets traced. Within days or weeks, we're naming the suspected nation-state behind it. The attribution gets amplified across headlines, briefing slides, and policy discussions. It feels decisive. It feels like we're "calling out" bad actors. But that velocity may be doing more damage than the espionage itself.
Consider what happens when we rush attribution. First, we anchor narratives around incomplete evidence. The recent activity attributed to various state-sponsored groups targeting Southeast Asian governments and diplomats exemplifies this pattern. These campaigns are real, the threats are serious, but the certainty with which attribution spreads often outpaces the actual forensic confidence underlying it. Once a major vendor or government agency stamps an attribution, it calcifies in the public record even if technical details later suggest ambiguity.
Second, rapid attribution invites escalation by design. When a nation is publicly named as responsible for espionage, domestic political pressures mount to respond. The response doesn't have to be military or economic to be damaging. It can be diplomatic, reputational, or reciprocal. We've seen this cycle repeat: attribution leads to accusation, accusation demands response, response triggers counter-response. The espionage itself was the goal; the public theater that follows is the trap.
Third, premature attribution can actually shield the real operators. Watering hole attacks and sophisticated keylogger deployments like ScanBox don't exist in a vacuum. They're often part of larger campaigns involving multiple actors, contractors, or opportunistic exploitation of shared infrastructure. When we attribute Tool A to Nation X, we may have missed that Nation Y was using the same infrastructure, or that a private contractor was doing the heavy lifting. Our neat attribution becomes a narrative covering for messier realities.
The hard truth is that espionage itself is the normal state of international relations. Every significant nation does it. Every corporation of size worries about it. This isn't breaking news; it's background radiation. We don't need faster attribution cycles to understand that it's happening. We need better understanding of what threats matter to our own security and which attributions actually change our defensive posture.
Here's what restraint could achieve instead. By slowing down the attribution pipeline, security teams gain time to understand campaigns more deeply. Slower attribution means resisting pressure to name actors until the case is genuinely strong. It means private attribution to government stakeholders who actually make policy decisions, separate from public-facing analysis that shapes geopolitical perception.
Slower attribution also means accepting ambiguity. Not every sophisticated campaign needs a nation-state name attached. Some threats are genuinely hard to attribute. Some are misdirection. Some are multiple actors working in parallel. That uncertainty, when communicated honestly, is more valuable than false confidence.
The security industry's reward structure pushes toward speed and sensation. Journalists want named sources and dramatic accusations. Vendors want their threat intelligence to break news. Governments want public justification for their actions. But these incentives don't align with better security outcomes.
If we genuinely believe that attribution matters for deterrence, then we should be strategic about when and how we do it. Selective, high-confidence public attribution is more credible than constant accusations. Patient analysis is more actionable than rapid speculation.
The espionage isn't going anywhere. It will continue whether we attribute it in days or months. But our response to it, and the international consequences that follow, might actually improve if we took our time.