National Cyber Resilience in the Age of AI

The economics of cyber attack have shifted against the defender. AI has
made many offensive tasks cheaper, faster and easier to scale, while the
defender’s duty to be lawful, reliable and right has not changed. Estimates
of the annual cost of cybercrime now run into the trillions. Most nations
now face an adversarial volume larger than their defensive capacity. They
are, in effect, the smaller force.

Estonia has been in that position since 2007, when it absorbed the
first national-scale cyberattack, and has defended against sustained
campaigns by a far larger adversary ever since. The doctrine that emerges
is asymmetric by design: lower the cost of defence, raise the cost of
attack, and deny the political payoff that makes a country worth attacking
in the first place. The aim is not invulnerability but to make incidents nondecisive.

This paper sets out that doctrine, for an era in which attacks are cheaper,
faster and more numerous, and human-paced defence is no longer
enough.