What Motivates Cyberattacks: Lack of Consequences or Abundance of Attack Vectors?

Abstract

This study examines whether cyber-attacks are motivated by attacker impunity due to lack of deterrence or ease-of-attack due to offense dominance. We empirically measure whether ease-of-attack, measured through Common Vulnerabilities and Exposures (CVEs), drives cyberattack activity. Using global CVE and cyberattack data from 2000 to 2024, we find a statistically significant—though modest—correlation, with the strongest alignment appearing at a one-year lag. This suggests attackers typically take about a year to exploit new vulnerabilities. The findings lend conditional support to deterrence-by-denial, indicating that reducing vulnerabilities can meaningfully influence adversary.