Stuxnet demonstrates cyberspace's vulnerability to determined attackers, but it also highlights the need to avoid rigid frameworks in developing appropriate rules of engagement for our cyber-defense systems.