Nuclear and chemical weapons are limited by treaties, inspections and export controls. Cyber weapons are different: they are cheap, invisible, easy to copy and often built from the same tools defenders use. Cyber arms control is the effort to limit the development, spread and use of offensive cyber capabilities, mainly through international norms, agreements and export rules.
This article explains the goals of cyber arms control, the agreements that exist today, why progress is slow and what it means for organizations.
Goals of cyber arms control
Arms control in any domain tries to reduce the risk of war and limit the damage if it happens. In cyberspace, the main goals are:
- Stability: reduce the risk that a cyber incident escalates into armed conflict.
- Protection of civilians: keep attacks away from hospitals, power grids and other critical services.
- Transparency: build trust through dialogue, contact points and information sharing.
- Limiting proliferation: slow the spread of powerful hacking tools to criminals and unstable actors.
- Accountability: create shared expectations, so violators face diplomatic or legal consequences.
What exists today
There is no binding global treaty that limits cyber weapons. Instead, several overlapping efforts exist.
UN norms of responsible state behaviour
In 2015, a UN Group of Governmental Experts agreed 11 voluntary norms, later endorsed by the UN General Assembly. For example, states should not knowingly attack critical infrastructure that serves the public, and should not harm the emergency response teams (CERTs) of other countries. UN working groups have continued these discussions since then.
Confidence-building measures
Regional bodies, such as the OSCE, have agreed practical steps like sharing national cyber contact points and consulting during incidents. These measures do not ban anything, but they reduce the chance of misunderstanding.
Export controls
The Wassenaar Arrangement added controls on “intrusion software” and IP surveillance tools in 2013. Similarly, many countries now restrict exports of commercial spyware. In addition, some governments have sanctioned spyware vendors.
Multi-stakeholder pledges
The 2018 Paris Call for Trust and Security in Cyberspace gathered support from many governments, companies and civil society groups. Likewise, some technology companies have made their own commitments not to help offensive operations.
Cybercrime law
The Council of Europe’s Budapest Convention (2001) and the UN Convention against Cybercrime, adopted by the UN General Assembly in December 2024, focus on crime rather than state conflict. Still, they shape how countries cooperate on investigations.
Why cyber arms control is so hard
- Dual use: the same exploit can test a network or attack it.
- No verification: you cannot count cyber weapons the way you count missiles.
- Attribution: it takes time to prove who carried out an attack.
- Secrecy: states rarely admit their offensive capabilities.
- Non-state actors: criminal groups and contractors operate outside state agreements.
- Different views: countries disagree about internet governance and what counts as a “cyber weapon”.
Advantages and limits of current measures
| Advantages | Limits |
|---|---|
| Shared language and expectations | Mostly voluntary, with no enforcement |
| Diplomatic channels for crises | Key states interpret norms differently |
| Pressure on spyware markets | Tools still leak and spread |
| Support for victims through attribution statements | Attribution can take months |
What it means for businesses
Norms help, but they will not stop most attacks on companies. Criminal ransomware gangs ignore them, and state groups often target suppliers anyway. Therefore, organizations should still invest in strong basics: patching, MFA, segmentation, backups and incident response.
Related guides
Sources
- UN Office for Disarmament Affairs: ICT and international security
- Paris Call for Trust and Security in Cyberspace
Worried about targeted attacks on your business? Our VAPT services find weaknesses before attackers do, and our OSINT investigations show what is exposed about your organisation online. Contact us for a quote.
