When a cyber-attack causes cascading harm across critical infrastructure, crossing sectors, borders, and the state and non-state divide, the question of responsibility becomes as complex as the attack itself.
This session, held on 15 October 2026 during Singapore International Cyber Week, presented a tabletop exercise (TTX) developed under the 2026 Geneva Dialogue work programme on stress-testing cyber norms and cybersecurity frameworks under geopolitical and operational pressure. It was opened by Alexandra Baumann, Swiss Ambassador to the Republic of Singapore and the State of Brunei Darussalam, as Guest of Honour, and moderated by Anastasiya Kazakova, Cyber Diplomacy Knowledge Fellow at DiploFoundation and Geneva Dialogue Project Coordinator.
Participants, representing governments, operators, technical responders, and international and regional bodies, were split into three groups. Each group worked through the same multi-sector, cross-border crisis scenario involving cascading harm to critical infrastructure. They made decisions under uncertainty, with incomplete information and a narrowing window for action. Each group was led by a team captain: Sofia Martinez Gomez, Eugene Guang E Tan, and Xiang Zheng Teo.
The scenario was designed to surface questions that remain genuinely open. What obligations apply when harm crosses jurisdictions? Who holds the authority to act when the response window is shorter than the time needed for verification? Where does the line between state and operator responsibility fall when infrastructure is privately owned but nationally critical?
The group discussions approached these questions from different angles, and each captain brought back a distinct takeaway.
Sofia Martinez Gomez, Vice President, Cybersecurity at AlixPartners, whose team focused on how quickly an incident escalates, said: “Incidents don’t stop at borders or sectors, and neither should preparation. A technical issue can quickly become operational, cross-sector, then international. Predefined frameworks and shared exercises with multistakeholder actors turn confusion into coordination.”
Eugene Guang E Tan, Associate Research Fellow at the Centre of Excellence for National Security, S. Rajaratnam School of International Studies, Nanyang Technological University, whose team worked through who owes what to whom, reported: “Regulatory requirements are typically not equivalent to responsibility. Responsibility looks different for operators, vendors, and states. Yet most agreed that a responsible response to an incident should be immediate. A cyber strategy can guide that response and build resilience, tempered by the legitimacy of domestic and international law.”
Xiang Zheng Teo, Vice President, Head of Advisory at Ensign InfoSecurity, whose team examined what makes cross-border cooperation work under pressure, concluded: “Mitigating transboundary cyber risk requires cross-sector, multilateral alliances built on continuous engagement. By formalising intelligence sharing and incident response protocols during peacetime, organisations establish the trust essential for swift crisis response.”
Benjamin Ang, Head of the Centre of Excellence for National Security (CENS) and Future Issues and Technology (FIT) at the S. Rajaratnam School of International Studies, and Adli Wahid, Senior Internet Security Specialist at APNIC, joined a fireside chat as part of the session. They examined whether frameworks are keeping pace with increasingly transnational infrastructure, such as cloud services, subsea cables and cross-border supply chains, or still defaulting to national, sovereignty-based definitions of what counts as “critical”. They also discussed how national policies can adapt to simultaneous technological and geopolitical change, and whether the next five years will bring greater shared rules and cooperation or regions and sectors securing themselves on their own terms.
Findings from the exercise will contribute to the third chapter of the Geneva Manual on Responsible Behaviour in Cyberspace. The chapter examines how agreed cyber norms hold up when tested against real-world crisis conditions, and how non-state actors navigate decision-making in the current geopolitical environment.
