Pentagon's Next Cyber Strategy Will Push for More Aggressive Offensive Hacking, Official Says

The Pentagon is drafting its first cyber strategy since 2023, and the message from the official previewing it is blunt: defense isn't the point.

"We often hear about offense versus defense... but defense in itself is not the outcome; it's not the goal," Brig. Gen. William Wilburn, deputy principal cyber advisor for the Department of Defense, said at the Billington Cybersecurity Summit this week, according to Breaking Defense. "It is to allow us to go on offense with something big, something muscular, and something that will drive the outcomes. Our strategy attempts to do that."

The new strategy would replace the Biden administration's 2023 cyber strategy. It follows the national cyber strategy released in March, which Breaking Defense reports already pushed for a more proactive, offensive posture in line with the Trump administration's broader approach to cyberspace.

Moving Past 'Persistent Engagement'

Since 2018, U.S. Cyber Command has operated under a doctrine called "persistent engagement," which calls for hackers to stay active in cyberspace daily, contesting adversaries and "defending forward" to disrupt attacks before they hit U.S. targets.

Wilburn signaled that era is giving way to something sharper. "We want to move away from things that look like persistent engagement. We want to go to higher impact options," he said. Daily engagement isn't disappearing, he added, but the posture is shifting toward what he called "confrontation."

"What we're trying to do is drive those outcomes in a way that we haven't seen done before," Wilburn said.

AI and Private-Sector Hackers

Officials have previously said the new strategy will lay out a role for artificial intelligence within the cyber force, though specifics haven't been made public yet. More notably, a draft of the strategy reviewed by Politico reportedly showed the Pentagon wants private companies to take part in hacking activities.

Handing offensive cyber missions, even partially, to private firms raises obvious questions. Who's liable if a company's hack hits the wrong target? What legal framework governs a private contractor conducting what amounts to an act of digital aggression? How would Congress oversee operations run outside uniformed chains of command? None of that has been spelled out publicly. The strategy itself hasn't been released, so there's no way yet to know how the Pentagon plans to answer those questions.

A fair critic could argue that outsourcing offensive cyber work to private companies blurs lines that exist for good reason, separating state action from private action, and that blurring those lines could invite retaliation against American companies that never signed up to be combatants. Public guardrails have not yet been disclosed.

The Track Record Officials Are Citing

Wilburn and other officials have pointed to recent operations, including Operation Midnight Hammer, Operation Absolute Resolve and Operation Epic Fury, as examples of cyber capability already integrated into kinetic military action under the Trump administration. Breaking Defense's report doesn't detail what role cyber played in each, only that officials have repeatedly cited them as proof the current approach is producing results.

What's Actually New Here

Cyber has been woven into military operations for years. What's new, based on Wilburn's comments, is the stated intent to prioritize disruptive, high-impact offensive strikes over the slower, continuous friction model that's defined U.S. cyber doctrine since 2018.

Given that China, Russia, Iran and North Korea have all ramped up state-sponsored cyber intrusions against U.S. infrastructure and networks in recent years, a more aggressive posture is a defensible call, and it tracks with the broader push in the March national cyber strategy for the U.S. to stop playing purely defense.

The unresolved piece is oversight. The Pentagon hasn't released the full strategy, hasn't detailed what "higher impact options" actually means operationally, and hasn't explained how private companies would be authorized, supervised or held accountable if they're brought into offensive hacking work. Those answers will matter far more than the rhetoric once the document is public.