Escalation Lens
Analyze how cyber operations move through phases of escalation, from initial access to strategic consequences, and how states signal, restrain, or intensify.
Unpeace Spectrum
Each incident is positioned on a 0–100 unpeace axis reflecting peak escalation tier and the thresholds crossed from the closed list (governance is a separate axis). Hover or tap an incident to inspect.
Stable (10)
Contested (15)
Escalation Categories
Cyber operations are classified along a six-tier escalation ladder. Each tier describes a qualitative shift in the nature and severity of the operation, not a linear progression.
Scanning, reconnaissance, and testing defences without meaningful disruption. Establishes access potential.
0 incidents in dataset
Unauthorized access gained and maintained. Data may be collected but no operational effect is imposed on the target.
11 incidents in dataset
Operations that temporarily deny or degrade services. Systems recover without permanent damage, but operational continuity is interrupted.
5 incidents in dataset
Sustained impairment of target capabilities. May involve data destruction, prolonged outages, or significant economic cost.
10 incidents in dataset
Irreversible damage to systems, data, or infrastructure. Recovery requires rebuilding rather than restoring.
5 incidents in dataset
Operations with national-security or international significance, affecting critical infrastructure, economic stability, or interstate relations.
2 incidents in dataset
Compellence vs. Deterrence
Thomas Schelling distinguished two coercive logics: compellence (forcing an adversary to change behaviour through imposed costs) and deterrence (dissuading action by signalling capability and willingness to retaliate). Cyber operations often blur this distinction, the same intrusion can serve as intelligence collection and a latent threat. This split offers an analytical lens, not a definitive classification.
Compellence
Operations that impose costs to force a change in behaviour
NotPetyaJune 2017
Crossed 2 thresholds: civilian service harm, unintended spillover.
Stuxnetcirca 2007 – 2010
Crossed 2 thresholds: physical effects, unintended spillover.
Ukraine Grid IDecember 2015
Crossed 2 thresholds: physical effects, civilian service harm.
Ukraine Grid IIDecember 2016
Crossed 2 thresholds: physical effects, civilian service harm.
WannaCryMay 2017
Crossed 2 thresholds: civilian service harm, unintended spillover.
Colonial PipelineMay 2021
Crossed 1 threshold: civilian service harm.
Oldsmar WaterFebruary 2021
Crossed 1 threshold: physical effects.
Viasat KA-SATFebruary 2022
Crossed 4 thresholds: physical effects, civilian service harm, unintended spillover, wartime use.
Costa Rica / ContiApril – May 2022
Crossed 1 threshold: civilian service harm.
Albania / IranJuly – September 2022
Crossed 1 threshold: civilian service harm.
Industroyer2April 2022
Crossed 1 threshold: wartime use.
Change HealthcareFebruary 2024
Crossed 1 threshold: civilian service harm.
KyivstarDecember 2023
Crossed 2 thresholds: civilian service harm, wartime use.
Deterrence
Operations that signal capability without imposing irreversible harm
SolarWindsMarch 2020 – December 2020
Restraint observed: Operated within traditional espionage norms, collection, not disruption.
Sony PicturesNovember – December 2014
Restraint observed: Targeted a single corporation, not government or critical infrastructure.
Exchange/HafniumJanuary – March 2021
Restraint observed: Initial phase was narrowly targeted espionage.
Shamoon / AramcoAugust 2012
Restraint observed: OT and production control systems were air-gapped and unaffected.
Bangladesh BankFebruary 2016
Restraint observed: A typo in a transfer request triggered manual review, limiting losses.
Australia ParliamentJanuary – February 2019
Restraint observed: No destructive or disruptive actions taken, activity consistent with intelligence collection.
Iran Nuclear Cyber2020 – 2021
Restraint observed: Incidents were narrowly targeted at specific nuclear facilities.
Taiwan Telecom2022 – 2023 (disclosed 2023)
Restraint observed: No disruptive or destructive actions observed.
MGM / Scattered SpiderSeptember 2023
Restraint observed: Financially motivated, no geopolitical or destructive intent.
Storm-0558May – July 2023
Restraint observed: Activity consistent with targeted intelligence collection, not disruption.
Volt Typhoon2023 – 2024 (disclosed 2024)
Restraint observed: No disruptive or destructive actions observed, activity consistent with preparation, not execution.
Midnight BlizzardNovember 2023 – January 2024 (disclosed January 2024)
Restraint observed: Activity consistent with espionage, no destructive or disruptive payload deployed.
India–Pakistan Cyber2016 – 2019 (multiple incidents)
Restraint observed: Operations remained within espionage parameters, no destructive payloads documented.
Gaza Cybergang2018 – 2022 (ongoing, landmark incidents)
Restraint observed: Operations remained focused on intelligence collection, not disruption.
Belgacomcirca 2010 – disclosed September 2013
Restraint observed: Activity consistent with intelligence collection, not disruption, no destructive payload, no manipulation of communications integrity disclosed.
OPM2014 – disclosed June 2015
Restraint observed: Activity confined to data exfiltration; no destructive payload, no manipulation, no public release of the stolen data.
APT12006 – disclosed February 2013; indictment May 2014
Restraint observed: Activity confined to economic and business intelligence collection; no destructive payload, no manipulation of data.
Salt TyphoonAccess established earlier; disclosed September–December 2024 (note: investigation and disclosures ongoing as of May 2025)
Restraint observed: Activity to date consistent with intelligence collection; no public evidence of destructive payload or manipulation of communications integrity.
FlameActive circa 2007 – disclosed May 2012
Restraint observed: Activity confined to intelligence collection; no destructive payload, no manipulation of operational systems.
Cloud HopperActive circa 2014 – publicly disclosed April 2017; indictment December 2018
Restraint observed: Activity confined to intellectual-property and business-intelligence collection across MSP client networks; no destructive payload, no manipulation.
Analytical note: This classification uses the operation's primary coercive function as a heuristic. Many operations serve both logics simultaneously, an espionage campaign that pre-positions destructive capabilities deters through demonstrated access while also enabling future compellence. The distinction is most useful as a teaching tool for examining how states signal intent through cyber operations, not as a rigid taxonomy.
On reading escalation
Escalation is not a conveyor belt, incidents do not inevitably progress from probing to destruction. Restraint is as analytically important as escalation. States frequently choose not to escalate, and understanding those choices requires examining governance constraints, norm commitments, and deterrence calculations alongside technical capabilities.
The categories and positions shown here are derived from the dataset's incident records. They reflect analytical judgement, not predictive modelling. All assessments should be read alongside the source material linked in each case.