A Rejoinder to Healey and Snyder: Engaging on Stability

We recently encouraged international security and international relations theorists to engage on cyber persistence theory (CPT). Strengthening the theory through creative application and, at times, critique is important to advance a more precise explanation of security dynamics in and through cyberspace. As the theory permeates numerous countries’ national cyber strategies and broader non-military agency actions, deeper engagement is also important to better inform practice. However, productive engagement requires an accurate portrayal of the theory and its applications.

In 2019, Jay Healey concluded that “the realization that cyber forces are in constant contact is certainly correct and persistent engagement is a reasonable response.” Anticipating escalation, however, he urged caution. Healey has resurrected his cautionary argument in a Sept. 2, 2026, Lawfare essay with Jack Snyder, despite the empirical record to date. Cyber interactions have not escalated to crisis or armed conflict, including between enduring rivals, even as more states adopt the logic of initiative persistence. Healey and Snyder want to focus on the mechanisms of stability (both cyber and strategic, which are distinct), and we wish we could simply engage with that argument. Unfortunately, Healey and Snyder misconstrue core elements of CPT and, at times, gratuitously so. They also conflate CPT with the U.S. practice of persistent engagement. Rather than increasing precision, they introduce confusion for scholars and practitioners in the United States and abroad. Therefore, we must first correct the record before addressing the topic of stability.

We proceed sequentially. First, we reset the table accurately by correcting their perplexing misrepresentations of CPT. Second, we correct mischaracterizations of U.S. policy implementation spanning three administrations. There are many distortions, but in the interest of getting quickly to a theoretically substantive debate, we highlight only a few. From this common and accurate starting point, we then engage with Healey’s and Snyder’s concerns over stability. 

What Healey and Snyder say About CPT, and What CPT Actually Says

Healey and Snyder conclude their essay by calling CPT a “hopeful theory prescribing more offensive cyber operations,” an unfortunate, gratuitous comment in what should be a serious professional debate. CPT is a structural explanatory theory that introduces the logic of initiative persistence as the core dynamic driving behavior in and through cyberspace. The theory extends that logic to a series of expectations, including the expectation that states not anticipating exploitation of cyber vulnerabilities will suffer and lose relative power; conversely, those that seize the initiative in anticipation can increase security.

CPT also challenges the “offense versus defense” characterization of cyber behavior and reorients scholars to the balance of initiative persistence. It is expressly not a theory of the offense; for example, patching vulnerabilities at home after hunt forward operations with allies—an activity that falls under the U.S. defend forward concept—is a critical anticipatory action that follows from the logic of initiative persistence. It should not be misconstrued as offensive cyber operations.

The theory says initiative persistence should manifest minimally as a state seeking to secure vulnerabilities from exploitation by adversaries and maximally as a state exploiting the vulnerabilities of adversaries to advance its own security. Healey and Snyder focus only on the latter half of that prescription and, in that half, misconstrue the activity as only offensive, ignoring exploitation that directly and intentionally contributes to securing one’s own vulnerabilities from exploitation. 

They further assert that “[t]he United States—or any interconnected state, according to [CPT]—must persistently conduct operations to erode its rival’s national security, while simultaneously countering the rival’s operations to do the same.” Again, they misread the theory. The theory offers a strategic prescription for achieving security, not for eroding the security of a rival. The theory is agnostic on rivals’ absolute power. It explains the structure of cyberspace and the imperative that this structure imposes on states—they must anticipate exploitation and thus be active in securing their networks and the digital backbones of their economies, politics, and societies.

Overall, the Healey-Snyder essay is dangerously one-sided in its description of CPT as offensive in logic and prescription. That is simply inaccurate, and a full reading of our book, “Cyber Persistence Theory: Redefining National Security in Cyberspace” (2022), and many of our articles substantiate the critical role of securing one’s own networks and digital assets through proactive anticipation of exploitation that, when translated into practice, is primarily defensive in character. Distorting the theory’s logic is dangerous. It undermines accurate communication with allies and adversaries alike that is necessary for stabilizing dynamics to occur. Bottom line: CPT does not prescribe aggressive, offensive, and escalatory cyber behavior.

What Healey and Snyder say About Persistent Engagement, and What Official Documentation Says

International relations theory rarely translates directly into state practice. There is no doubt that CPT’s explanatory strength has found empirical validation in the number of countries that have shifted to the prescribed proactive posture and the operational constructs derived from the theory’s logic. More and more states are coming to appreciate that reactive cyber postures and operational restraint undermine their security.

There is a difference between theory and practice, however, and the Healey-Snyder essay conflates the two throughout—at times, directly referring to persistent engagement as a theory. It also, curiously, focuses only on the United States, when many states have shifted. To be clear, CPT is a general theory of the cyber strategic environment, not an explanation of U.S. behavior. 

What the essay has to say about the United States is simply not accurate. We do not speak for U.S. Cyber Command—or any government agency—but we have read official publications on persistent engagement. The offensive bias Healey and Snyder reveal in evaluating CPT additionally filters how they present U.S. Cyber Command’s 2018 Command Vision. 

We ask readers to consider the following passage from the Vision. 

We sustain strategic advantage [in cyberspace] by increasing resiliency, defending forward, and continuously engaging our adversaries. Increased resiliency reduces our attack surface at home, anticipates adversary actions, and increases flexibility in our response. Defending forward as close as possible to the origin of adversary activity extends our reach to expose adversaries’ weaknesses, learn their intentions and capabilities, and counter attacks close to their origins. Continuous engagement imposes tactical friction and strategic costs on our adversaries, compelling them to shift resources to defense and reduce attacks.

It is hard to fathom, after reading these words, how Healey and Snyder could assert that “persistent engagement has only one vocabulary—that of offensive cyber operations.” The British, South Korean, Japanese, and Dutch proactive cyber strategies use the same vocabulary—a vocabulary that is inclusive of the full range of anticipatory action that cyber initiative requires, and that is operationally described primarily as defensive.

In addition to ignoring resiliency and defensive operations, Healey and Snyder inaccurately frame disruptive campaigns (a term used initially in the Biden, not Trump, administration) as being exclusively offensive in character. Actual practice shows otherwise. The FBI’s cyber disruption campaigns of botnets facilitating Chinese and Russian exploitation are best understood in the context of securing U.S. vulnerabilities from exploitation by seizing back the initiative lost to an adversary. This example also serves as a reminder that CPT proposes a “whole-of-nation + [with allies]” strategy. A focus on only U.S. Cyber Command and its authorities misses the mark. The opening paragraph of the U.S. 2026 National Cyber Strategy states: “We will act swiftly, deliberately, and proactively to disable cyber threats to America,” followed in the second paragraph with a charge to disrupt adversary campaigns and make our networks more defensible and resilient. This language describing an orientation and posture for the U.S. government is strikingly similar to that in U.S. Cyber Command’s 2018 Vision. 

On Stability

With the record set straight, we turn to the question of stability in the cyber strategic environment.

CPT defines cyber stability as a condition in competition where states are not incentivized to pursue armed attack and are incentivized to bound their cyber activity within a range of tacit agreed competition. (As an aside, we coined the term “agreed competition,” not Thomas Schelling, as Healey and Snyder claim. It is a variation on Max Singer’s term “agreed battle,” which was introduced into international relations theory by Herman Kahn). Stability may emerge in the range below the level of armed conflict and above the floor of inaction. 

Our book explains behavioral mechanisms that support and sustain agreed competition. This occurs primarily through tacit coordination, not tacit bargaining as Healey and Snyder claim, where focal points emerge that avoid shared negative outcomes in the pursuit of national interests. CPT goes further to suggest that states have an interest in ensuring that the effects of cyber activities remain below the level of war, because war is costly and unpredictable and, if states can gain strategically without such cost and risk, why wouldn’t they? There is a convergence around not upsetting the apple cart when you can gain by keeping it upright. Thus, the incentives in the cyber strategic environment to stay within bounded interactions are high—in other words, the condition is structurally stable. 

But the world is still in the early days of cyber competition, and determining the rules of the cyber game will take time. At the tactical and operational levels where states are trying to gain relative to each other, there is not a convergence of interest—one side wants to win on any given day. When interests are in conflict, tacit bargaining through continuous action can foster stability from the bottom up over time by illuminating acceptable behavioral boundaries and minimizing misunderstandings of intent. The British emphasis on responsible cyber behavior in action is the most explicit effort in this direction. Importantly, CPT recognizes that persistent cyber operational activity enabling tacit coordination and tacit bargaining is a complement to explicit bargaining—that is, diplomacy—not a substitute for it.

Healey and Snyder do not provide readers with their definition of cyber stability, nor do they provide empirical evidence of cyber agreed competition failing. They do, however, offer a causal mechanism for cyber stability/instability that differs from CPT when writing “the ups and downs of cyber operations have always been tied to geopolitics. As crises multiply, cyber stability is likely to degrade as well.”

In essence, Healey and Snyder assert that cyber behavior is driven by factors exogenous to the cyber strategic environment. If international relations become more conflictual, they posit, cyber operations will follow, presumably becoming coercive and breaching the armed conflict threshold. This is the logical extension of their claim that cyber operations “have always been tied to geopolitics.”

No war in the 21st century will be fought without cyber capabilities; it is the nature of modern warfare to leverage networked computing. But that does not mean cyber operations will independently lead to war, nor is there empirical evidence of this.

CPT sees the causal mechanism for cyber stability as endogenous to the cyber strategic environment, and again we have explained how states are incentivized toward the tacitly bounded space of agreed competition. The structural features of interconnectedness, constant contact, and mutable exploitable technology induce an imperative to seek initiative in anticipating exploitation. This occurs in the bounded space of agreed competition regardless of whether there are militarized crises or wars occurring around the world. From a research design standpoint, this is an explanatory distinction that needs to be explored empirically. The empirical record shows that states engage in cyber operations and campaigns regularly regardless of geopolitics lends credence to CPT’s explanatory power. In the past seven years, the number of cyber exploits is likely measured in the trillions, and yet we have had no sustained breach of cyber agreed competition. While this is a brief span of time, the amount of activity is astronomical. Given the novel stage we are at, accepting Healey’s and Snyder’s analysis would cause one to expect some spiraling escalation from such intense action, especially among enduring rivals. And yet there is no such evidence. Whereas CPT explains this general stability, Healey and Snyder offer no alternative explanation and essentially set aside the current empirical record.

Geopolitics does change, of course, and international relations in crisis and armed conflict are distinct from each other and from competition. We initially applied CPT to state cyber behavior in a geopolitical condition of competition. As a structural theory, it is equally salient for crisis and armed conflict. Readers can assess for themselves by reading our essays in Lawfare, Binding Hook, and the Cyber Defense Review, which were published well before Healey’s and Snyder’s essay. We also encourage a reading of an essay authored by Maj. Gen. Oleksandr Potii, chairman of Ukraine’s State Service of Special Communication and Information Protection. A comprehensive treatment appears in our forthcoming book, “Cyber Persistence and Campaigning: The Logic and Art of Securing Cyberspace,” where we argue that cyber campaigning ought to be the anticipatory stage-setter for contingencies and is critical to ensuring the military forces that deter and fight are always ready and able to do so. 

Healey and Snyder concede that the past 30 years of cyber competition appear to align with CPT’s explanation or at least its expectation. The crux of their essay is that this is unlikely to hold for another 30 years, and they dive into an assessment of U.S. persistent engagement—again very U.S.-centric—to justify their skepticism of an enduring positive application of CPT: There have been (a) no explicit cyber “victories” (it is unclear how they define victory); (b) no concrete examples of convincing an adversary to “back down”; and (c) no establishment of any “equilibrium.” Setting aside the methodological flaw of equating a theory’s explanatory power with how a particular actor implements it, Healey’s and Snyder’s criteria are not tests of CPT. For example, rather than seeking an explicit “victory,” the relevant questions for assessing CPT are whether states are aligning to the structure of the cyber strategic environment—the answer is clearly “yes”—and whether states that do not align experience relative power loss or relative disadvantage across the competition-conflict continuum. Our new book, for example, reveals how Russia may have failed to seize the cyber initiative in preparation for its 2022 full-scale invasion and how Ukraine did so effectively in anticipation of invasion.

On the metric of states backing down, CPT is a theory of cyber exploitation. It explicitly rejects the logic of coercion. Therefore, coercively forcing an adversary to back down cannot be an empirical test of the theory. A more appropriate measure is reducing consequential impact. Empirical evidence abounds that ceding the initiative to China, Russia, North Korea, and others left U.S. interests and power more exposed. Finally, as noted earlier, trillions of attempted exploits with no escalation suggest an equilibrium. We explain it as agreed competition. Healey and Snyder should take on that empirical reality directly with an alternative explanation.

Not Perpetuating the Cult of the Offense or Defense

Jack Snyder’s groundbreaking research on the cult of the offensive and how it explained the tragedy of World War I demonstrates how misalignment with the strategic realities of the day in both thought and practice can have devastating effects. When we published “Cyber Persistence Theory,” we argued that the United States and its allies were mired in a similar misalignment anchored on a traditional coercive logic and application of a strategy designed for fundamentally different security dynamics than that which has emerged in cyberspace. Fortunately, unlike the General Staffs of the 1914 Great Powers, policymakers, military commanders, and academic researchers across Europe, North America, and Asia have begun to remove the shackles of misaligned thinking and adjust their approaches to operating in and through cyberspace across the competition-conflict continuum. The Healey-Snyder essay reinforces the need for work like CPT that explains the security realities of the day without allowing a bias, in this case toward the offense, to impact policy development.

CPT offers a cogent explanation of the cyber strategic environment in competition, and our new book extends the logic of initiative persistence to the contingencies of crisis and armed conflict. Both books make an argument that may seem counterintuitive to some: It is through persistence in anticipating exploitation that national security can be advanced and a new form of stability may emerge.