Some confrontations are not balanced duels. In cybersecurity, attacker and defender do not play the same game: the first need only succeed once, while the second must succeed every time. This asymmetry is no technical detail: it is the key that decides whether a system is stable or vulnerable. And when a technology — here artificial intelligence — lowers the cost of attacking faster than that of defending, the whole balance shifts.
1 The asymmetry
One flaw against every flaw.
The definition
Succeed once versus succeed always
The offense-defense asymmetry describes a structural imbalance: to win, the attacker need only find a single flaw; the defender must close them all, at every moment. This is the "defender's dilemma": the defender must be right a thousand times, while the attacker can be wrong nine hundred ninety-nine times and succeed on the thousandth. The imbalance is not unique to the digital realm — it holds for a border, a dike, an immune system — but it takes on a particular sharpness there, because the surface to defend is immense and constantly shifting.
2 The offense-defense balance
A concept forged by Robert Jervis.
The theoretical frame
When attacking costs less than defending
In 1978, political scientist Robert Jervis formalized the notion of the "offense-defense balance": the ratio between the cost of attacking and the cost of defending. His thesis: when attack is easier and cheaper than defense, the world becomes unstable — everyone has an interest in striking first, and fear feeds the arms race. Conversely, when defense prevails, stability reigns: no one gains from aggression. To understand which way the balance tips is to understand whether an environment is peaceful or dangerous.
3 The cost that tips
Technology shifts the balance.
The mechanism
AI lowers the cost of attacking
The balance is not fixed: each technology shifts it. Fortifications long favored defense; gunpowder, then the tank, favored attack. In cybersecurity, artificial intelligence today plays against the defender: it lowers the cost, the skill and the time needed to attack — democratizing offense — faster than it strengthens defense. What matters is not the absolute strength of each side, but their ratio: from the moment producing an attack tends toward free and instant, the starting asymmetry widens.
4 Deterrence and attribution
No signature, no retaliation.
The analysis
Deterrence rests on attribution
Against an eased offense, pure defense is not enough: one must also deter. But all deterrence rests on attribution: to retaliate, you must know who struck. This is the second effect of the asymmetry in the age of AI: by blurring the attacker's signature, it makes attribution more uncertain — and uncertain retaliation does not deter. Restoring the balance therefore means acting on both levers: making attack more costly (through defense and resilience) and retaliation more credible (through attribution).
The takeaway
The offense-defense asymmetry is not a fate but a ratio of costs that technology shifts. The useful question is never "who is stronger?" but "which way does the balance tip?" — and how to bring it back toward defense.
5 Key points
To remember.
✓
Offense-defense asymmetry: the attacker needs only one flaw; the defender must close them all, at all times (the "defender's dilemma").
✓
Offense-defense balance (Jervis, 1978): the ratio between the cost of attacking and defending; when attack prevails, the world becomes unstable.
✓
Technology shifts the balance: AI lowers the cost of attacking faster than that of defending, widening the asymmetry.
✓
Deterrence: it rests on attribution; blurring the attacker's signature weakens retaliation, and thus deterrence.
This notion illuminates an analysis
First published: July 9, 2026