From Cyber Warfare Labs to National Cyberwarfare Capabilities: Reframing Policy for Contemporary Cyber Conflict

Introduction

Across the world, governments are announcing the establishment of cyber warfare laboratories as symbols of strategic intent, technological modernity, and national resilience. These announcements are often accompanied by images of advanced infrastructure, controlled research environments, and elite technical personnel. Yet beneath the optics lies a deeper policy problem. The notion that cyber conflict preparedness can be anchored primarily in laboratories reflects an outdated understanding of how cyber power is generated, exercised, and sustained. Cyber conflict today is not bounded by experimental spaces, nor is it driven primarily by discrete technological breakthroughs. It is continuous, adaptive, population-centric, and deeply entangled with information disorder, espionage, economic coercion, diplomacy, and political legitimacy.

This paper argues that a state that conceptualises cyber warfare primarily through the lens of a “lab” has fundamentally misunderstood the nature of contemporary cyber conflict. The correct policy focus is not the construction of cyber warfare laboratories, but the deliberate development of cyber warfare capabilities. These capabilities must be adaptive, distributed, doctrine-led, and aligned with national resources and long-term strategic realities. Drawing on frameworks from irregular warfare, capability-based defence planning, and contemporary cyber operations scholarship, the paper demonstrates why a laboratory-centric mindset is strategically insufficient and proposes a capability-centric reframing as the only sustainable policy path.

Cyber Conflict as Irregular Warfare by Other Means

Modern cyber conflict aligns more closely with irregular warfare than with conventional war. Irregular warfare is characterised by blurred boundaries between civilian and military domains, contested populations, persistent competition below the threshold of declared war, and the centrality of information and legitimacy rather than territorial conquest. The framework articulated by Hurley and the Institute for Defense Analyses emphasises that irregular warfare is fundamentally population-centric, dynamic, and shaped by continuous interaction across political, informational, economic, and technological environments. Cyber operations map almost perfectly onto this model. Information disorder campaigns target public trust and social cohesion. Espionage operations exploit civilian infrastructure and private sector platforms. Cyber exfiltration undermines economic competitiveness and state sovereignty without a single shot being fired. Diplomatic signalling increasingly occurs through cyber means, including attribution statements, sanctions, and retaliatory disclosures. None of these activities occur in laboratories. They unfold in live networks, real populations, and contested information environments.

The irregular warfare framework also emphasises three classes of capability: understanding, shaping, and engaging. Understanding requires intelligence, cultural awareness, and situational insight. Shaping involves influence, narrative control, and institutional alignment. Engaging may be kinetic or non-kinetic, but is always calibrated to minimise backlash and maximise legitimacy. Cyber warfare capabilities fit squarely within this triad. A laboratory can assist marginally with understanding tools or vulnerabilities, but it cannot substitute for the broader institutional capabilities required to understand populations, shape information ecosystems, or engage adversaries across legal, diplomatic, and technical domains.

The Strategic Error of the “Cyber Warfare Lab” Mental Model

The laboratory model reflects an industrial-era conception of warfare in which advantage flows from controlled experimentation, proprietary technology, and centralised research facilities. This model made sense for weapons development, aerospace engineering, and nuclear research. It does not translate well to cyberspace.

First, cyber capabilities do not mature in isolation. Unlike physical weapons, cyber tools are perishable, context-dependent, and often obsolete the moment they are deployed. Their effectiveness depends less on technical novelty and more on integration with intelligence, access, doctrine, and timing. A laboratory may produce a proof-of-concept exploit, but without operational access, legal authorisation, intelligence support, and strategic intent, that exploit is irrelevant.

Second, cyber conflict is not episodic. It is continuous. States are engaged in persistent cyber competition that spans peacetime, crisis, and conflict. This reality aligns with Blumbergs’ observation that cyberspace is now a recognised operational domain in which attribution is uncertain, escalation is ambiguous, and defence requires constant active engagement rather than episodic response. Capability therefore resides in readiness, resilience, and institutional coherence, not in facilities .

Third, the laboratory mindset encourages a technology-first approach rather than a strategy-first approach. States announce labs before articulating doctrine, legal frameworks, interagency coordination mechanisms, or workforce pipelines. This reverses the logic of sound capability development. As Correia demonstrates in his analysis of military capability and strategic planning, capabilities must emerge from clear ends, coherent ways, and realistic means, with continuous attention to risk and adaptability. A lab without doctrine is a showroom. A lab without trained personnel embedded across government is a silo. A lab without policy integration becomes a vanity project.

Capability-Based Thinking and the Cyber Domain

Capability-based planning emerged precisely because threat-based planning failed in environments characterised by uncertainty, complexity, and rapid change. The cyber domain exemplifies these conditions. Threat actors are diverse, ranging from states to criminal networks to loosely affiliated influence operations. Tools proliferate rapidly, often commodified and democratised. Attribution is contested and politicised. Planning around specific threats quickly becomes obsolete.

Capability-based planning instead asks what a state must be able to do, regardless of who the adversary is. Correia’s work demonstrates that capability is not a single asset, but an emergent property arising from multiple lines of development, including doctrine, organisation, training, personnel, information, adaptability, and policy.  Importantly, he shows that small and middle powers cannot afford to imitate the structures of great powers. Their ends are constrained by their means, and risk management becomes central.

This insight is critical for cyber policy, particularly for developing states and emerging cyber powers. A cyber warfare lab model implicitly assumes abundant resources, long research cycles, and a capacity to absorb failure. Most states do not have this luxury. What they require instead are scalable, modular capabilities that can be embedded across institutions and adjusted as the threat environment evolves.

Information Disorder as a Core Cyber Warfare Concern

One of the clearest illustrations of the inadequacy of the laboratory model is information disorder. Disinformation, misinformation, and influence operations are now central instruments of cyber conflict. They target elections, public health responses, social cohesion, and trust in institutions. These operations rely less on sophisticated malware and more on narrative engineering, platform dynamics, and human psychology.

No laboratory can meaningfully simulate the complexity of an information ecosystem at national scale. Effective response requires coordination between cybersecurity agencies, electoral bodies, media regulators, civil society, platforms, and diplomatic channels. It requires legal clarity on speech, surveillance, and platform accountability. It requires public education and resilience.

These are capabilities, not experiments. They depend on doctrine, institutional relationships, and legitimacy. The irregular warfare emphasis on human terrain is directly applicable here. As Hurley notes, shaping population attitudes and narratives is central to success, and requires sustained engagement rather than episodic technical interventions.

Espionage, Exfiltration, and Persistent Engagement

Cyber espionage and data exfiltration further illustrate the limits of laboratory-centric thinking. Espionage operations exploit long-term access, trust relationships, and supply chains. They are enabled by human intelligence, insider risk, procurement practices, and regulatory gaps. Laboratories may develop tools, but they do not manage access, nor do they govern how intelligence is fused, prioritised, and acted upon.

Blumbergs highlights that even with advanced forensic tools, attribution remains probabilistic and politically mediated. Effective cyber defence therefore relies on active defence, threat hunting, and institutional learning rather than static controls . These practices require trained analysts embedded within operational environments, supported by legal authorities and diplomatic frameworks. Again, capability resides in people, processes, and governance, not facilities.

Diplomacy, Law, and Cyber Power

Cyber warfare does not occur outside law and diplomacy. On the contrary, cyber operations increasingly trigger diplomatic responses, sanctions, alliances, and norm-setting processes. States that fail to integrate cyber capabilities into their foreign policy apparatus risk strategic incoherence. A laboratory has no diplomatic standing. A capability does.

Capability-centric policy requires clear articulation of thresholds, escalation pathways, attribution standards, and response options. It requires alignment between defence, foreign affairs, justice, and intelligence institutions. It requires engagement in international norm-building processes and regional confidence-building measures.

This integration mirrors the expanded lines of development proposed by Correia, particularly the inclusion of information and knowledge, adaptability, interoperability, and interagency coordination as core capability components. Cyber power that is not diplomatically integrated is strategically brittle.

Rethinking Investment and National Priorities

Perhaps the most damaging effect of the cyber warfare lab narrative is misallocation of scarce resources. Laboratories are expensive, visible, and politically attractive. Capabilities are less visible, harder to explain, and slower to demonstrate. Yet capability investments yield far greater strategic returns.

Investing in workforce development, legal reform, interagency coordination, threat intelligence sharing, and public resilience may not produce ribbon-cutting ceremonies, but they create durable cyber power. For small and middle powers, this distinction is existential. As Correia demonstrates, when states behave as if they are great powers without the means to support such ambitions, they incur unacceptable strategic risk. A state that announces a cyber warfare lab without first articulating doctrine, capability objectives, and governance structures has not merely misplaced emphasis. It has lost the plot.

Conclusion

Cyber conflict is not a laboratory problem. It is a governance problem, a capability problem, and ultimately a political problem. The realities of information disorder, espionage, exfiltration, and cyber diplomacy demand adaptive, distributed, and integrated national capabilities rather than isolated research facilities.

This paper has argued that the persistence of the cyber warfare lab narrative reflects an outdated mental model that obscures the true nature of cyber power. Drawing on irregular warfare frameworks and capability-based planning theory, it has shown that effective cyber preparedness depends on understanding, shaping, and engaging within complex human and institutional environments. Laboratories may have a limited supporting role, but they cannot substitute for doctrine, people, processes, and policy coherence.

For states seeking to align cyber policy with resource realities and future needs, the imperative is clear. Abandon the lab-centric illusion. Invest instead in national cyber warfare capabilities that are resilient, legitimate, and strategically grounded. Only then can cyber power serve national security rather than merely symbolise it.

References:

Hurley, W. J., A Framework for Irregular Warfare Capabilities, Institute for Defense Analyses.
Correia, J., “Military capabilities and the strategic planning conundrum”, Security and Defence Quarterly, Vol. 24, No. 2 (2019).
Blumbergs, B., Interview on cyberspace operations and attribution, Help Net Security (4 November 2025).

Author:
Desmond Israel, Esq. is a Lecturer and Head of Department of Public Law And Governance at the GIMPA Law School, He is also a Partner in charge of Cyberlaw & Technology Practice at AGNOS Legal Company, a Lead Consultant at Information Security Architects Ltd and a Senior Policy Analyst with Institute for Liberty and Policy Innovation (ILAPI)