Acknowledging the difficulties of reliable and timely attribution in the immediate aftermath of a malicious cyber operation that may prevent states from invoking self-defence or countermeasures as remedies to justify protective conduct, the chapter zooms in on the customary doctrine of necessity as a circumstance precluding the wrongfulness of state conduct that does not require a responsible adversarial party. The requirements of successfully invoking necessity are analysed with regard to perilous cybersecurity incidents. In particular, it is inquired whether necessity can ever be capable of justifying the use of force by the imperilled state in order to prevent or mitigate harm. Finally, the legal consequences of invoking the doctrine are examined.