Sanctions Are Live. The Power Plants Are Still Open.

# Sanctions Are Live. The Power Plants Are Still Open. The official line from Washington and London is that the new sanctions on Iranian actors—specifically those linked to the Mabna Institute and MOIS—are a victory for deterrence. The logic is straightforward: by naming names, freezing assets, and making it diplomatically expensive for these hackers to operate, we raise the cost of aggression. In this view, sanctioning the architects of attacks on British power plants and U.S. government systems signals that the state is watching and that there are tangible consequences for crossing a certain line. It’s a tidy narrative of accountability where law enforcement and treasury departments act as the shield for critical infrastructure. It's also complete theater. Sanctions don't patch servers. They don't rotate keys. They certainly don't stop an operator in Tehran from hitting "Enter" on a keyboard. While we celebrate the symbolic victory of a Treasury Department press release, attackers are continuing to walk through front doors that have been left unlocked for years. Look at the math of this week. We’re seeing over 270 Zimbra servers breached in ongoing attacks and an unauthenticated remote code execution vulnerability in Oracle WebLogic—CVE-2026-21962—that CISA has already had to add to its KEV catalog because it's being used in the wild. The gap between "diplomatic deterrence" and "operational reality" is where the actual risk lives. While we talk about the Mabna Institute, someone forgot to patch a SAML 2.0 plugin in WordPress, giving attackers admin access to sites they should never have seen. We are treating state-sponsored threats as a separate category of magic, but these actors aren't using ghost-tech; they're often just using the same CVEs and credential leaks that any script kiddie would. When 3.6 million employee records from Fortune 500 companies end up on the dark web, it isn’t a failure of diplomacy. It’s a failure of basic hygiene. The obsession with "attribution" is a convenient distraction for everyone involved. If you can blame a sanctioned entity in Iran or a ransomware gang like Medusa—currently targeting over 500 critical infrastructure organizations—you don't have to talk about why your internal audit failed three times in a row. It shifts the conversation from *negligence* to *victimhood*. Who benefits from this hype? The politicians do, because a sanction is a visible "win" that requires zero technical oversight. The security vendors benefit too, selling "State-Actor Intelligence" feeds that promise to tell you when a sanctioned entity is knocking on your door, while the actual vulnerability—like the one in Oracle WebLogic—is sitting there for anyone to find. The second-order effect here is a false sense of security for the people actually relying on that critical infrastructure. When a power plant operator hears that the government has "neutralized" or "sanctioned" a threat actor, they assume the risk has decreased. It hasn't. In fact, it may have increased, because the incentive to maintain rigorous internal defenses is replaced by the belief that the state is handling the problem at the diplomatic level. We’ve seen this before. After the SolarWinds fallout, there was a rush to identify and name the SVR. It felt productive. It gave the media something to write about. But naming the arsonist doesn't put out the fire if you're still storing gasoline in the living room. The parallel breaks down only when sanctions actually dismantle an organization's ability to function, which almost never happens with state-funded units. They just change their IP addresses and move to a different office. My uncomfortable question for the CISO: If your primary defense against a state actor is "the U.S. government has sanctioned them," why are you still on the payroll? The reality is that we are prioritizing the optics of retaliation over the boredom of maintenance. We’d rather have a high-profile sanction announcement than a quiet, company-wide mandate to actually update legacy systems. It's much easier to point across an ocean than it is to look at a spreadsheet of 270 compromised servers and admit you didn't know they existed. Watch the next few weeks of CISA advisories. If we see more "state-sponsored" warnings paired with a lack of mandatory patching deadlines for the underlying vulnerabilities, then the sanctions aren't deterrence. They're just an excuse.