Three people familiar with the plan told Defense One that the Pentagon is close to publishing its new cyber strategy, possibly as early as Tuesday of next week. Only one of the three named that day. The other two cautioned that it could slip. None would speak on the record.
The document comes out of the office of Katie Sutton, the assistant defense secretary for cyber policy, who also serves as the secretary’s principal cyber adviser. Her team has worked on it for months. Officials had originally promised it for the summer. When it lands, it will be the department’s broadest statement on cyber since 2023, and an action plan is expected to come with it.
A job listing on the website of the contractor Parsons offers a peek at that plan. It describes about nine strategic initiatives and 34 lines of effort, though it gives no detail on what they are, and it is unclear when the ad went up.
What Sutton has promised
Sutton told lawmakers in April that the aim was “the most capable, lethal and agile cyber force in the world.” She laid out three priorities for Congress: weaving cyber tools into every domain of warfare, gaining an edge over adversaries, and reorganizing the military’s cyber forces so they are sharper and more agile.
In practice, officials say, that means treating cyber operations like any other part of a campaign. A tool that knocks out an enemy’s communications or computer systems would be planned alongside airstrikes and other conventional action. They point to recent Trump-era operations in Venezuela and Iran as examples.
The strategy also turns the White House’s March cyber strategy into narrower military priorities and spending choices. That earlier paper promised to use the government’s full range of offensive and defensive cyber capabilities, stop threats before they reach American networks, and make foreign hackers pay more. None of this is a clean break. The Pentagon’s 2023 strategy already embraced “defend forward,” which means confronting hostile cyber activity nearer its source. What is expected to be new is the stress on handing cyber options to combatant commanders and fusing them with conventional forces.
AI and the force behind it
Artificial intelligence should feature heavily. In June, Sutton said the strategy would set a “clear and specific vision” for AI across the cyber force, backed by coordination among Cyber Command, the Pentagon’s chief information office and its Chief Digital and Artificial Intelligence Office.
The Pentagon and the National Security Agency have been widening their access to commercial models that can hunt for software vulnerabilities and automate pieces of cyber operations. Last week, NSA Deputy Director Tim Kosiba said the agency wants access to “all the models” and is talking with leading developers.
All of this ties into Cyber Command 2.0, the overhaul of how the Pentagon recruits, trains and uses cyber personnel. It favors specialization and purpose-built teams, plus a Cyber Innovation Warfare Center meant to put commercial technology in operators’ hands for testing.
The timing is awkward. Officials are dealing with an apparently sweeping Iran-linked campaign to reach water systems and other critical infrastructure. The department has also started an accelerated move to quantum-resistant encryption, aiming to protect its highest-impact systems by 2030. And last month the administration moved to let vetted American companies run government-approved operations against foreign cybercriminal groups, which raises the question of how Justice, Homeland Security and Defense will split the work without stepping on each other.
