YYS (Yield to Surrender)

Yield to Surrender (YYS) is a cybersecurity strategy where an organisation chooses to relinquish certain controls, information, or assets in response to a cyber-attack. This approach is often considered when resisting or defending against the attack would cause more harm or be impractical, such as during ransomware or distributed denial-of-service (DDoS) incidents.

How It Works

YYS involves assessing the attack’s severity and the organisation’s ability to resist or mitigate it effectively. When the attack surpasses certain thresholds or risks overwhelming the organisation’s resources, decision-makers may opt to surrender specific controls or data to prevent further damage. This might include shutting down affected systems, disconnecting from the network, or surrendering encrypted data to attackers to halt the attack's progression. The goal is to minimise overall harm, such as data loss, operational disruption, or security breaches, even if it means temporarily conceding some control or information.

Implementing YYS requires careful planning and predetermined protocols. Organisations often develop incident response plans that specify under what circumstances surrender is preferable, and how to do so securely. This strategy can be combined with other defensive measures, like backups or containment techniques, to ensure that surrender is a calculated decision rather than a reactive response.

Common Use Cases

• Deciding to pay a ransom in ransomware attacks when decryption is not feasible through other means.
• Discontinuing certain network services during a DDoS attack to prevent further system overload.
• Surrendering control of compromised accounts or systems to limit attacker access and damage.
• Ceasing data collection or sharing temporarily during a breach to prevent further data exposure.
• Allowing attackers to take control of low-value assets to protect more critical infrastructure.

Why It Matters

YYS is a critical concept for cybersecurity professionals and incident responders because it involves strategic decision-making under pressure. Knowing when and how to surrender controls or information can help organisations limit damage, preserve remaining assets, and recover more effectively after an attack. It is also relevant for certification candidates as understanding different response strategies—including surrender—enhances their ability to develop comprehensive incident response plans. Recognising the circumstances that warrant YYS can be the difference between a manageable incident and a catastrophic breach.