Nation-states have an extensive range of capabilities, making it difficult for even sophisticated businesses to protect against cyberattacks. Additionally, the consequences of taking legal action against a suspected nation-state attacker can be politically complicated.