Cyber deterrence with imperfect attribution and unverifiable signaling

• Updates strategic nuclear deterrence theory to the cyber domain. • Incudes imperfect attribution and unverifiable signaling (cheap talk). • Defenders can improve deterrence and well-being through cheap talk. • Defenders can also improve well-being through cheap talk by luring attackers. Motivated by the asymmetric information inherent to cyberwarfare, we examine a game of deterrence between an attacker and a defender in which the defender can signal its retaliatory capability but can only imperfectly attribute an attack. We show that there are equilibria in which the defender sends noisy signals to increase its expected payoff. In some equilibria, the defender can use signaling to deter an attacker and increase its payoff. In a different and somewhat counter-intuitive equilibrium, the defender can increase its expected payoff through signaling by luring the attacker to attack more.