+1 Retaliation wrt. to "cyber security incidents" is seldomly a plausible deterrent, exactly because attribution is so hard. Consider a "simple" case like the

+1 Retaliation wrt. to "cyber security incidents" is seldomly a plausible deterrent, exactly because attribution is so hard. Consider a "simple" case like the Nordstream attacks; despite serious efforts there still is no conclusive attribution. Protection and mitigation are usually much more practical defenses than the threat of retaliation.