The Five-Step Ladder Beyond Cyberattacks

Is Being Connected to the Internet Really Something We Can Take for Granted?

AI is beginning to change the nature of cyberattacks.

On October 21, 2026, Microsoft Security Research and Microsoft Threat Intelligence reported that Storm-0940, which Microsoft assesses as a China-state aligned actor, had used an agentic AI penetration-testing framework called ARTEX.

According to Microsoft, hundreds of organizations around the world were targeted. In several cases, the time from initial targeting to obtaining privileged access to cloud infrastructure was less than three hours.[1] [microsoft.com]

ARTEX is an open-source penetration-testing framework capable of using AI models to automate various offensive-security tasks. Microsoft describes it as a system of LLM agents capable of conducting penetration-testing activities, from reconnaissance to data exfiltration, with limited human intervention.[1] [microsoft.com]

A report by Nikkei also describes ARTEX as an orchestration layer coordinating multiple AI models for different tasks.[2] [中国系AIのARTE…質改造が横行.pdf | PDF]

AI agents are not constrained by human working hours.

Microsoft points out that agents can operate around the clock, including weekends and holidays, and attempt multiple breach paths simultaneously. This can significantly reduce the time between selecting a target and achieving an objective.[1] [microsoft.com]

In other words, cyberattacks may be moving from human time to machine time.

What happens, then, when such attacks grow in scale and become a matter of national security?

Based on these developments, I would like to propose a simple conceptual framework: a Five-Step Ladder.

The first step is grounded in attribution. The remaining steps should be understood as my policy proposal, rather than measures proposed by Microsoft or the other sources cited here.

Step 1: Identify Who Is Behind the Attack

The first step is to identify the responsible actor as accurately as possible and make credible information public.

Cyber attribution is difficult. Demonstrating a direct chain of command between a government and a specific cyber operation can be particularly challenging.

In this case, Microsoft describes Storm-0940 as a**"China-state aligned actor."**[1] [microsoft.com]

That does not, by itself, establish that the Chinese government directly ordered each individual operation.

This distinction matters.

Technical evidence, intelligence assessments, attack methods, tools, targets, and evidence of connections to state interests or state-linked actors should therefore be accumulated carefully and, where appropriate, shared internationally.

That is Step 1.

Step 2: Ask States to Take Responsibility for Restraint

The next question should not be limited to:

"Did your government order this attack?"

There is another question the international community can ask:

"If cyberattack groups assessed as being connected or aligned with your state are operating repeatedly, what is your government doing to investigate, restrain them, and cooperate with international investigations?"

Even when the immediate attacker is a non-state actor, meaningful action by the relevant state could help reduce the threat.

If such action is taken and the situation improves, escalation should stop here.

But if serious activities repeatedly continue without adequate corrective action, the issue begins to affect trust between states.

The issue then shifts from:

Who conducted the attack?

to:

What responsibility does a state have to restrain harmful cyber activity associated with actors operating within its sphere of influence?

Step 3: Reflect Security Risk in Economic and Procurement Decisions

If serious security concerns remain unresolved, those concerns may eventually affect economic and procurement decisions.

But this should not become a simplistic rule such as:

"Do not buy Chinese products because they are Chinese."

The more defensible question is:

"Can this product or service be trusted from a national-security perspective?"

For government procurement and critical infrastructure in particular, risk assessments could consider factors such as:

• supply-chain transparency,
• the security of software updates,
• access to sensitive data,
• responses to discovered vulnerabilities, and
• broader national-security risks.

Products or services that cannot satisfy appropriate security requirements could then be excluded from particularly sensitive systems.

This distinction is important.

The principle should be risk-based security assessment, not nationality-based rejection.

Step 4: Narrow the Scope of Digital Connectivity

If severe cyberattacks nevertheless continue, the next issue is connectivity itself.

Instead of assuming that everything should connect to everything else, networks could increasingly be viewed as separate zones:

Trusted

↓

Conditionally connected

↓

High-risk and restricted

The more critical the system, the more carefully its external connections should be evaluated.

At this point, the nature of the discussion begins to change.

It is no longer simply:

"How do we defend against cyberattacks?"

It becomes:

"Who should we remain connected to, and to what extent?"

This is no longer only a technical cybersecurity question.

It becomes a question of national policy.

Step 5: Reconsider Connectivity Itself

Eventually, there is a physical boundary condition.

Cyberspace may appear intangible, but communications depend on real infrastructure, including telecommunications networks, data centers, and network equipment.

That means the logic ultimately reaches a difficult question:

"If safe connectivity cannot be maintained, should the same level of connectivity continue indefinitely?"

We normally assume:

Connectivity is the default. Disconnection is the exception.

Under severe and persistent national-security conditions, however, even that assumption may eventually have to be reconsidered.

The question becomes whether maintaining a particular connection creates an unacceptable security risk.

This would be an extraordinarily serious step.

Major restrictions on communications and networks could have substantial consequences for citizens, businesses, international commerce, and third countries.

Any such measure would therefore require careful consideration of legal authority, necessity, proportionality, scope, collateral effects, and clear conditions for lifting the restrictions.

Step 5 should be understood as exactly that:

a last resort.

The Goal Is Not to Reach Step 5

This is the most important point.

The purpose of the Five-Step Ladder is not to create a roadmap toward disconnecting networks.

It is almost the opposite.

The ladder makes the possible escalation visible:

1. Identify the actor

↓

2. Demand restraint and cooperation from relevant states

↓

3. Reflect risk in economic and procurement decisions

↓

4. Restrict digital connectivity where necessary

↓

5. Reconsider connectivity itself as a last resort

The existence of Step 5 gives greater meaning to Steps 2 and 3.

Ideally, the problem should be resolved long before the final step becomes necessary.

And the ladder must work in reverse as well:

Effective restraint

↓

Verification

↓

Restoration of trust

↓

Relaxation of restrictions

↓

Normal connectivity

This is not fundamentally a ladder of retaliation.

It is a model of conditional connectivity designed to preserve a secure and open network environment wherever possible.

Why This Matters to Ordinary Internet Users

According to Microsoft, Storm-0940 used ARTEX to automate attacks against a large number of organizations.

In the ConnectWise-related incident, Microsoft assesses Storm-0940 as responsible for the supply-chain compromise and reports that ARTEX was used to attempt sign-ins to more than 2,250 tenants.[1] [microsoft.com]

An important qualification is necessary.

This does not mean that more than 2,250 tenants were successfully compromised.

Microsoft reports attempted sign-ins and explicitly cautions that successful authentication does not necessarily mean that customer data was accessed or exfiltrated.[1] [microsoft.com]

Nevertheless, the case provides an important example of how AI could alter the speed and scale of cyber operations.

Cybersecurity therefore can no longer be viewed only as:

"Something the IT department handles."

Beyond cybersecurity lie diplomacy, economics, and national security.

And eventually there is a very simple question:

Who should we remain connected to?

We have grown accustomed to thinking of Internet connectivity as something almost automatic.

Perhaps it is time to reconsider that assumption.

Connectivity is not necessarily unconditional.

Maintaining a safe and open networked society requires responsibility from those who participate in it.

As AI begins to change the speed and scale of cyber operations, one idea may be worth keeping in mind even for ordinary Internet users:

At the very end, there is still a boundary called connectivity itself.

Notes and Sources

[1] Microsoft Security Research and Microsoft Threat Intelligence, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise," Microsoft Security Blog, October 21, 2026. Microsoft assesses Storm-0940 as a "China-state aligned actor" and reports on the actor's use of ARTEX in cyber operations. [microsoft.com]

[2] Nikkei, "Malicious Modifications of China-Origin AI Tool ARTEX Spread, Raising Concerns over Continued Use in Cyberattacks"[title translated from Japanese], Nikkei Electronic Edition, October 24, 2026. Original article published in Japanese. [中国系AIのARTE…質改造が横行.pdf | PDF]