When a headline warns of a coming cyber catastrophe, ask what the source documents, what it only projects, and what you can do either way. Government advisories on infrastructure show real intrusions and real outages, and they also show limits. A calm reading keeps the risk and drops the drama.
Five questions for any doomsday claim
1. Who is the source, and did they see it? An agency advisory based on incident response is different from a vendor forecast or a social media thread. CISA's Volt Typhoon advisory is written by CISA, NSA and FBI and states a high-confidence assessment.
2. Is it an event, a capability or a scenario? Ukraine in 2015 was an event: about 225,000 customers lost power. Pre-positioning is a capability: access held in case of a crisis. A solar storm or quantum computer is a scenario with no date.
3. What is the scale? The Ukraine outage hit three regional distribution companies and was restored. That is serious and also bounded.
4. What is the date, if any? NIST gives no date for quantum code breaking and says only that some experts expect a capable device within a decade. A claim of "2027" with no source is a flag.
5. What can I do about it? Real advisories end with mitigations. If a piece of writing has fear but no action, treat it as marketing.
Examples applied
- Grid attack: documented once in Ukraine, with a restoration. See Can a cyberattack shut down the power grid?.
- Volt Typhoon: documented access, stated intent of disruption in a crisis, and ordinary mitigations. See Volt Typhoon pre-positioning explained.
- AI attacks: documented assistance, no reported fully autonomous end-to-end attacks. See Will AI cause mass cyberattacks by 2027?.
Why calm is not complacent
Calm lets you do boring work: inventories, patching, backups, tested restore steps, a tabletop exercise. Panic makes teams buy a product or freeze. The record shows attackers often get in through ordinary routes such as stolen credentials, exposed remote access and unpatched edge devices.
A habit to build
Keep a running note of scary claims you meet and what became of them a year later. Many forecasts are never checked, so writing down the claim, the source and the date builds your own calibration. Over time you will see which kinds of source tend to be accurate and which tend to be loud.
Share the five questions with your team. A common vocabulary, event, capability or scenario, makes it easier to discuss risk without arguing about tone, and it keeps planning in proportion to evidence.
Quick check
What is the fastest way to test a doomsday claim?
Ask for the primary source and whether it describes an event, a capability or a scenario. Then check for a date and a mitigation.
Sources
- CISA alert IR-ALERT-H-16-056-01 on the Ukraine power grid attack
- CISA, NSA, FBI advisory AA24-038A on PRC state-sponsored actors
- NIST: first 3 finalized post-quantum encryption standards
Last reviewed: 19 October 2026.
