States’ capacity for using information and communication technology (ICT) to inflict grave economic, political and material harm on enemies has been amply demonstrated. In recent years, many states have reported large-scale cyber-attacks against their military defense systems, water supply systems and other critical national infrastructure. Currently there is no agreed-upon set of international rules and norms governing conflict in cyberspace. Many states prefer to keep it that way. They insist that difficulties of verifiability and the challenges raised by rapid technological change preclude international agreement on a formal convention to govern cyber conflict and favor reliance on strategic deterrence to limit conflict. In this article, I review some of the main objections to an international convention regulating the use of cyber weapons. I argue that while there are significant obstacles to effective multilateral arms control in the cyber domain, experience from other areas of international arms control suggest none of these obstacles are insurmountable. I also argue that whereas most observers insist that cyberspace favors offensive strategies, closer examination of the political dynamics of the cyber domain in fact indicates the dominance of defensive strategies. This in turn improves the prospects for striking effective multilateral agreement(s) to reduce risks of international cyber conflict.