Two Italian Eurofighters were scrambled and shot down a drone in Lithuanian airspace. In the hours that followed, neither the origin of the aircraft nor the reason for its presence had been established. Nothing in that sequence suggests improvisation, and that is exactly what makes the episode worth examining. We can now be required to act before we have understood what we are reacting to.
The metric the security industry keeps optimising
Anyone who has worked in cyber defence knows the liturgy by heart. Mean time to detect, mean time to respond, dashboards where the seconds fall and somebody applauds. Compressing those intervals is a genuine achievement against ransomware or an intrusion in progress, because the damage grows with every minute of delay.
The trouble starts when the same reflex is exported into politics. There is an interval that should not be compressed at all: the distance between perceiving a threat and deciding to raise the level of a confrontation between states. Call it mean time to escalate. It is the only metric in this field where a longer number can be the better outcome, and it is the one nobody is being paid to protect.
Two clocks running at incompatible speeds
At the political level the interval is still long. Formal attribution, consultation among allies, sanctions and military decisions take days, weeks, sometimes months. On 13 July the European Union adopted the largest package of cyber sanctions it has issued so far against the Russian ecosystem, and packages of that kind are not assembled in an afternoon.
At the tactical level the window is collapsing towards minutes and seconds. Sensors, drones, autonomous systems and automated correlation see, connect and propose a response at a speed that has nothing to do with the traditional rhythm of institutions. The most serious risk today is not that conflicts spread geographically. It is that tactical time drags political time into its own tempo, and that the decision to escalate ends up being shaped by whatever the fastest system in the chain has suggested.
Cheap noise, expensive answers
Sub-threshold pressure works precisely because of that gap. Actions are calibrated to produce an effect without openly crossing the line that would require a military response, and they can still force the other side to move. A relatively cheap drone lights up radars, launches fighters, activates command chains and burns interceptors that cost far more than the object they destroy.
Probing another country’s defences is not new. It was standard practice during the Cold War. What has changed is the unit cost and the scale. It can now be done with uncrewed systems that are expendable and repeatable, while AI correlates what the response reveals with satellite imagery, communications and open sources. It is also politically cheaper. A drone can always be said to have drifted off course. A manned reconnaissance aircraft could not be explained away so easily, and everyone involved knew it.
Cyber widens the same gap
The cyber domain pushes the asymmetry further, because it allows the ground to be prepared long before any confrontation, and because detection and attribution remain genuinely difficult. A digital operation can be prepared and executed in hours. Attributing it formally, building political consensus and responding takes considerably longer.
That distance between operational time and institutional time is not a theoretical concern. It is already a strategic vulnerability, and it is one we have documented, measured and then done almost nothing about, because the institutional side of the problem has no vendor and no product page.
Dependencies are the new terrain
The Middle East shows a different face of the same fragility: the vulnerability of nodes. Before the conflict, an average of roughly 125 large vessels a day transited the Strait of Hormuz. On 15 September the count was four. Nobody had to capture the strait. It was enough to change the risk attached to it for the entire network to start reconfiguring itself.
The same logic applies to a subsea cable, a cloud region, a satellite constellation or a power grid. Geopolitics is increasingly the geopolitics of dependencies. Energy determines industrial capacity, cloud services carry both civilian and military workloads, satellites serve navigation and targeting alike, and drones consume interceptors. The separation between the civil, technological and military domains is becoming difficult to draw with a straight line, which is inconvenient for anyone whose job description depends on that line existing.
Building time on purpose
If the two theatres are starting to resemble each other, it is not necessarily because a single hand is directing them. It is because infrastructure, technology and decision timelines have become interdependent enough that a disturbance in one propagates into the others.
The honest conclusion is unglamorous. The next step in deterrence may not be a more powerful weapon or a faster algorithm. It may be the deliberate construction of time: thresholds agreed in advance, attribution processes that do not require a press conference to begin, and explicit rules about what a single unexplained object does not authorise. None of that photographs well, none of it can be procured as a platform, and none of it will be announced at a defence expo.
Meanwhile we keep buying speed, because speed can be sold. The day the tactical clock finishes swallowing the political one, the interval that disappears will not be a line on a dashboard. It will be the interval in which somebody was supposed to think.
Raffaele Di Marzio
All my “insane” books on cybersecurity and governance are here 👇 https://www.amazon.it/stores/author/B0FB47T6Q4/allbooks