Deterrence is a policy effect that discourages harmful behavior by making the expected cost, risk, or penalty higher than the benefit. In cyber security, deterrence does not stop every attack, but it can influence whether an attacker decides to act, how boldly they act, and how quickly they repeat the behavior. Deterrence can come from laws, platform enforcement, attribution, public exposure, sanctions, account takedowns, or criminal penalties.
In practice, deterrence matters because many attacks depend on speed, anonymity, and low friction. Deepfakes, phishing, fraud, and disinformation all become more dangerous when consequences are unclear or delayed. A strong deterrent works best when it is credible: rules must be enforced, evidence must be collected quickly, and penalties must be visible enough to change behavior. In defense, deterrence is often paired with detection and response, so the goal is not only to punish after harm, but also to reduce the incentive to launch the attack in the first place.