When capability becomes a threat

The question “when does capability become threat?” deserves a more nuanced answer than we usually give it: capability indicates threat when combined with evidence of intent and opportunity, but capability alone is merely potential that may never materialize into actual risk.

The fundamental distinction

It’s best to think of capability and threat as two entirely different dimensions. Capability answers the question “can they do this?” while threat answers “will they do this to me?” This seems like a simple distinction, but confusing the two drives an enormous amount of misguided security thinking and policy.

Consider a simple analogy. Your neighbor owns a chainsaw. That chainsaw represents a capability, they possess a tool that could certainly cause harm. But does this capability make your neighbor a threat to you? Obviously not in most cases. The chainsaw becomes relevant to threat only when combined with intent and opportunity. Do they want to harm you? Do circumstances enable them to act on that intent? Without these additional factors, the capability remains just that a potential that exists but doesn’t translate into risk.

Now here’s where things get interesting and psychologically complex. Even though we logically understand this distinction, humans and institutions consistently struggle to maintain it under pressure. The mere existence of a capability creates anxiety and triggers threat perception, especially when the capability is powerful or the entity possessing it is poorly understood.

How the conflation happens in practice

Imagine you work in security at a financial institution. Your team discovers that a sophisticated hacking group has developed a new exploit that could potentially bypass your authentication systems. This is a capability, these attackers have developed a tool that could work against your infrastructure. But notice what happens psychologically and organisationally from this point forward.

The security team briefs leadership about this capability. Almost immediately, the framing shifts. People start asking “when will they attack us?” rather than “might they attack us?” The capability gets discussed as if it represents intent. Resources get allocated, incident response teams go on alert, and suddenly the organisation is responding to a threat that may not actually exist. What happened? The capability triggered a threat perception because humans are deeply uncomfortable with potential danger, even when there’s no evidence of actual danger.

This same pattern plays out at much larger scales. When intelligence agencies assess that a nation-state has developed cyber capabilities that could disrupt critical infrastructure, policymakers often respond as if an attack is imminent or inevitable. The capability itself becomes the threat in how it’s discussed, planned for, and responded to. The crucial questions about intent, opportunity, and actual likelihood get compressed or lost entirely.

So why do we default to this conflation?

Understanding why this happens requires looking at some deep features of human cognition and institutional behavior. Let me break down several reinforcing factors that push us toward treating capability as threat.

First, there’s the asymmetry of consequences. If you assume a capability represents no threat and you’re wrong, the consequences could be catastrophic. If you assume a capability does represent a threat and you’re wrong, you’ve wasted resources but avoided potential disaster. This asymmetry creates a strong bias toward assuming the worst. In decision theory, this is essentially a worst-case analysis that prioritises avoiding the most severe outcome rather than the most likely outcome.

Second, there’s what we might call the visibility problem. Capabilities are often observable or discoverable. You can see the weapons, detect the malware, read the research papers, or analyse the technology. Intent, by contrast, is invisible and constantly shifting. It exists in the minds of decision-makers, changes with circumstances, and often isn’t even clearly formulated until the moment of action. When faced with something concrete and observable versus something abstract and hidden, we naturally anchor on what we can see.

Third, institutional incentives heavily favor conflating capability with threat. If you’re a security professional who warns about a capability and nothing happens, you look prudent. If you downplay a capability and something bad happens, your career might be over. This creates a systematic bias toward overestimating threat. Organisations rarely punish false positives in security as harshly as they punish false negatives.

Fourth, there’s a more subtle psychological mechanism at work involving uncertainty and control. When we acknowledge that a capability exists but might not represent a threat, we’re admitting uncertainty and our lack of control over another actor’s intentions. This is deeply uncomfortable. By treating the capability as a threat, we paradoxically regain a sense of control – now we have something concrete to defend against, to plan for, to respond to. The anxiety of uncertain potential danger gets converted into the more manageable stress of responding to a defined threat.

The escalatory dynamics this creates

Here’s where capability-threat conflation becomes genuinely dangerous, because it creates self-fulfilling prophecies and escalatory spirals that make everyone less secure.

A simple example,  Country A develops advanced cyber capabilities for defensive purposes as they want to be able to detect and respond to attacks. Country B observes these capabilities and, unable to reliably determine intent, assumes they represent an offensive threat. Country B responds by developing their own enhanced capabilities and perhaps pre-positioning access to Country A’s infrastructure as a deterrent. Country A detects this activity and interprets it as confirmation that they were right to be concerned, so they further expand their capabilities. Notice what’s happening here? Capabilities on both sides have grown, actual security on both sides has decreased, and the perceived threat has increased even though neither side initially had offensive intent toward the other.

This same dynamic plays out in corporate security, though usually with less dramatic consequences. One company develops sophisticated threat hunting capabilities. Competitors observe this and worry they’re falling behind in security maturity. They invest heavily in similar capabilities. Security vendors observe this trend and market even more advanced capabilities as necessary for competitiveness. Soon, everyone is in an expensive arms race driven not by actual threat changes but by mutual observation of capability development. Pretty much why most organisations are over tooled! 

The escalation happens because capability development is observable and measurable, while intent is not. Organisations and nations alike feel pressure to match observed capabilities of peers or adversaries. No one wants to be the entity that falls behind in capability, even if the capabilities in question have minimal relationship to the actual threats they face.

When capability legitimately indicates threat

Now, I don’t want to suggest that capability never indicates threat, because that would be equally misleading. There are genuine cases where capability development does signal increased threat, and understanding when this transition is legitimate is crucial for making sound security decisions.

Capability becomes a more reliable threat indicator when combined with several other factors. First, historical behavior matters enormously. If an actor has previously used similar capabilities against you or entities like you, new capability development should absolutely factor into your threat assessment. Past behavior is among the best predictors of future behavior. A threat actor who has repeatedly targeted your industry with ransomware developing new ransomware capabilities represents a very different situation than a researcher developing the same capabilities for defensive analysis.

Second, stated intent carries weight, though it needs careful interpretation. When an actor explicitly declares hostile intentions or frames their capability development in adversarial terms, this obviously changes the calculus. However, you need to weigh stated intent carefully – states and organizations often engage in strategic signaling that may not reflect actual intentions.

Third, the specificity of capability matters. Generic capabilities that could serve multiple purposes deserve different analysis than highly specific capabilities that only make sense for particular attack scenarios. If someone develops broad penetration testing tools, that’s quite different from developing tools specifically designed to exploit vulnerabilities in your unique infrastructure.

Fourth, the context of capability deployment or positioning provides crucial information. A capability that remains in research environments sends different signals than a capability that gets integrated into operational infrastructure or positioned in ways that suggest preparation for use.

Making better distinctions in practice

So how do you actually maintain the capability-threat distinction in practice when all these psychological and institutional pressures push toward conflating them? This requires both individual discipline and organizational culture change.

Start by forcing yourself to explicitly separate questions of capability, intent, and opportunity in your analysis. When you assess a potential threat, literally write out or articulate: What capabilities does this actor possess? What evidence exists regarding their intent toward us specifically? What opportunities do they have to act on any hostile intent? What constraints limit their ability or willingness to use these capabilities against us? By forcing these as separate analytical questions, you resist the automatic compression of capability into threat.

Second, actively seek disconfirming evidence for threat assessments. If you’ve identified a capability that concerns you, deliberately look for reasons why it might not represent a threat to you specifically. Are there alternative explanations for why this capability was developed? Are there higher-value targets for this actor? Do we see evidence of intent toward other targets but not toward us? This cognitive practice fights against confirmation bias.

Third, consider the base rates and opportunity costs of different threat scenarios. If you’re allocating resources to defend against a novel capability-based threat, what more likely threats are you potentially under-defending against? Security resources are always finite, and spending them on low-probability capability-based concerns means not spending them on higher-probability threats.

Fourth, build organizational cultures that can tolerate uncertainty and that don’t punish acknowledging “we don’t know” about intent. If your security culture treats every capability as an imminent threat, you’ll systematically over-invest in defending against the novel and under-invest in defending against the probable. Creating space for nuanced threat assessment requires leadership that values accuracy over certainty.

The broader implications

Understanding when capability becomes threat versus when it remains merely capability has implications far beyond security decision-making. This distinction shapes how nations interact with each other, how companies compete, how communities respond to change, and even how individuals relate to each other.

The capability-threat conflation often drives arms races, whether in military technology, cybersecurity tools, or even social media platforms competing on features. It shapes foreign policy, sometimes pushing nations toward confrontation based on worst-case assumptions about adversary capabilities rather than realistic assessments of adversary intent. It influences resource allocation across societies, as budgets get directed toward defending against theoretical capability-based scenarios rather than addressing more probable risks.

The key insight is that capability creates potential but not inevitability. Someone possessing the ability to harm you is fundamentally different from someone intending to harm you and acting on that intent. Maintaining this distinction requires conscious effort against strong psychological currents that push toward collapsing potential into probability. But making this effort leads to more accurate threat assessments, more efficient resource allocation, and often, more stability in competitive or adversarial relationships.