Cyber deterrence is often studied from the point of view of deterrence by punishment or offensive cyber strategies. A vast amount of studies claim that deterrence in cyberspace can never be successful with cyber means alone due to technical challenges and the problem of attribution. Some scholars argue that cyber resilience is an essential part of cyber deterrence, since not every cyberattack can be countered. These reviews are usually technical and concentrate on investigating the balance of offensive and defensive cyber strategies. The technical view leaves gaps in the physical and cyber-persona layers of cyberspace. This paper examines resilience from a societal perspective and reflects on the findings of cyber deterrence theories. The Concept of Comprehensive Security (CCS) is a Finnish model for building and sustaining resilience in society. Preparation for disruptive situations is carried out with the operating principle of overall safety, where society´s vital functions are protected in collaboration between the authorities, the business world, organisations, and citizens. The growing importance of cyber security has led to emphasising the importance of cyber resilience in the Concept of Comprehensive Security. This study investigates the possibilities to utilize the CCS as a tool for cyber deterrence and aims to create a new perspective on the international academic discussion of cyber deterrence. The research method is content analysis. The investigated material consists of Finnish CCS documents, as well as academic cyber deterrence and cyber resilience literature. The characteristics of the CCS are compared to the factors found in the cyber deterrence material to answer the research question. The key observation presented in this study is that a comprehensive approach to building resilience in the society is essential for the credibility of cyber deterrence. Resilience in cyberspace should be viewed from the perspective of every layer, including logical, physical and cyber-persona layers.

The Deterrence theory was formed after the World War II to describe the tensions between nuclear-armed states. Because of its origins, deterrence is mainly researched from the point of view of powerful states. However, deterrence nowadays is essential for any state to include in their strategies. The ever-increasing dependence on technology forces states to protect their sovereignty in cyberspace as well as in other domains. Cyber operations should be considered not just as a means to protect the cyber domain, but as means of deterrence. Cross domain deterrence (CDD) is a theory that includes all the warfighting domains in creating deterrence, including cyberspace. Despite these new perspectives, the use of military cyber operations as a deterrent has been studied mainly in terms of offensive strategies. Incorporating all types of military cyber operations into deterrence strategies is understudied. This study focuses on the possibilities of a small state to use cyber operations to create deterrence. The research question is: “How can a small state use cyber operations as a deterrent?” According to the Finnish understanding, cyber operations can be divided into three types: offensive, defensive and supportive operations. Using Finland as a case study, this paper argues that using military cyber operations is noteworthy for any state dependent on cyberspace, not only for military purposes, but for building CDD. The CDD theory and characteristics of cyber operations are studied in order to form better understanding of the topic and provide ideas for academic discussion. The research methods are content and SWOT analysis. The key observation presented is that each type of cyber operation has a role in forming CDD. For a small state, it´s profitable to use every type of cyber operations and thus expand the tool box for deterrence.