No Shortcuts: Why States Struggle to Develop a Military Cyber Force

Max Smeets — a researcher at the Center for Security Studies at ETH Zurich and one of the field's leading scholars of offensive cyber operations — addresses a question that most accounts of cyber conflict take for granted: why is it so difficult for states to build effective military cyber forces? His answer, developed through case studies of a dozen states across different levels of capability, is that building offensive cyber capability requires not just technical talent but a specific organisational culture, operational security architecture, and institutional learning capacity that most militaries struggle to develop.

No Shortcuts matters for practitioners for a counterintuitive reason: it provides an evidence-based corrective to the inflation of cyber threat assessments. Not every state that wants offensive cyber capability can build it effectively; the barriers are higher than most public discourse suggests. At the same time, the states that have invested seriously — the United States, Russia, China, Israel, Iran, the DPRK — have developed capabilities that are genuinely formidable. For organisations advising clients on threat assessment, understanding the gap between cyber ambition and cyber capability across different state actors is essential for accurate risk calibration. A rigorous and practically useful work.