"Cyber espionage is here to stay.  But in the absence of international norms in cyberspace, establishing consequences for cyber operations like SolarWinds and Microsoft Exchange will be critical if we want adversaries to recalibrate both the scale and scope of their attacks on our networks and achieve even the slightest deterrence for future intrusions. 

The limited scope of Russia’s attack in comparison with China’s - which left major software vulnerabilities available to be exploited extensively by criminal actors - may suggest some previously limited deterrence measures have worked.