Seeing only what we can see: why cyber strategy may be built on illusion

Abstract

Debates about cyber strategy lean on a handful of high-profile operations—Stuxnet, NotPetya, SolarWinds—as if they were clean tests of competing theories. But the evidence we get to see is filtered by actors with their own reasons for revealing or concealing, and that filtering is not neutral. We call the result a “visibility trap”: paradigms whose claims happen to predict the kind of evidence the public record produces look well supported, while paradigms whose claims turn on what stays hidden—coercion above all—struggle to find a clean test even where they may be right. We develop two concepts, the “visibility pipeline” and “epistemic congruence,” to trace how clandestine operations become public knowledge and to show why some theories are advantaged at the point of evidence rather than at the point of truth. The argument is epistemic, not empirical: we do not claim the dominant paradigms are wrong, only that we cannot tell from public evidence whether they dominate because they are correct or merely because they are visible. Recognising the trap is a first step toward a more honest, and more useful, account of cyber strategy.