The shift from defensive cybersecurity to offensive capability has been quietly brewing for years, but when a national government explicitly builds it into strategy, that’s worth paying attention to. The Trump administration’s 2026 National Cybersecurity Strategy represents a significant inflection point—one that moves away from the posture of “defend our networks” toward something more assertive. I need to be honest about what this means, and more importantly, what could go wrong.
The Logic Behind Going on Offense
There’s a seductive simplicity to the offensive argument. If adversaries are constantly probing your systems, launching attacks, stealing intellectual property, and conducting espionage, why shouldn’t you have the ability to strike back? It’s intuitive. Someone attacks you; you attack them. Case closed.
Except it isn’t. The reasoning goes something like this: traditional deterrence through retaliation works. If Iran knows the US can disrupt its infrastructure, maybe Iran thinks twice before launching the next attack. If China understands there’s a cost to stealing trade secrets, perhaps they’ll recalculate. It’s mutually assured disruption, or at least that’s the theory.
I understand the appeal. From a pure game theory perspective, it makes sense. If your adversary believes you can hurt them back, they’re theoretically less likely to initiate hostilities. But here’s where my scepticism kicks in: cyberspace doesn’t work like traditional warfare. Attribution is murky. Collateral damage is unpredictable. And once you normalize offensive operations as a standard policy tool, you’ve opened a door that’s genuinely difficult to close.
The Second-Order Problems We’re Not Talking About Enough
What worries me most isn’t the strategy itself—it’s the execution and the precedent it sets. Let me break down some specific concerns:
- Attribution cascades: When you launch an offensive cyber operation, you’re probably going to mask your origin. That means an adversary might attribute the attack to someone else entirely. Now you’ve accidentally escalated a conflict between two third parties. The second-order effect? Regional instability, retaliatory strikes against the wrong target, and a general erosion of trust in international norms.
- Civilian infrastructure entanglement: Critical infrastructure is a mess of public and private systems. Power grids, hospitals, financial networks—they’re all interconnected. An offensive operation targeting a state actor’s network could easily spill over into civilian systems. We’ve seen this happen before with Stuxnet, which was elegant and contained. But not every operation will be that surgical.
- Recruitment of skilled operators: You can’t build a serious offensive capability without attracting genuine talent. But where do those operators come from? Some will be from military and intelligence backgrounds. Others will be private sector talent lured away. This creates pressure on the private cybersecurity workforce and potentially weakens defensive capabilities across the board.
- The normalization problem: Once the US operationalizes offensive cyber as routine strategy, other nations follow. We’re already seeing cyber operations from Russia, China, Iran, and North Korea. Making offense the standard playbook internationally means we’re moving toward a cyber wild west where every nation-state assumes it can strike first, ask questions later.
What About Oversight and Accountability?
Here’s the thing about offensive operations: they’re classified. The public doesn’t know when they happen, against whom, or what the actual results were. That’s a feature for operational security, but it’s a bug for democratic accountability.
When you bomb a building, there are physical consequences everyone can see and debate. When you conduct a cyber operation, you can claim success or failure and hide behind classification. Did it work? Was there collateral damage? Did it actually deter anything? These are hard questions to answer when the operations themselves are secret.
I’ve reviewed enough after-action reports and technical analyses to know that cyber operations rarely work exactly as planned. The complexity of interconnected systems means surprises are inevitable. Some of those surprises might stay hidden for months or years. By then, the strategic calculus has already shifted based on incomplete information.
Finding the Right Balance
I’m not arguing for pure defense. That’s naive. An adversary doesn’t respect a purely defensive posture when they can probe endlessly with low cost. But I am arguing for extreme caution about how aggressively we move toward offense as standard practice.
The uncomfortable truth is that we don’t fully understand the dynamics of cyber conflict at scale. We have historical examples—some successful, some disasters waiting to happen—but we don’t have a clear strategic doctrine that accounts for the unpredictable nature of cyber operations. Until we do, building massive offensive capabilities without corresponding restrictions on their use is basically gambling with infrastructure that millions of people depend on.
The strategy shift deserves serious debate. Not whether we should have offensive capabilities—that’s already decided—but under what circumstances they should be used, who approves them, how we verify they work as intended, and what happens when they don’t. Those conversations are harder than talking about deterrence and striking back. But they’re the ones we actually need to have.
Source: Beyond Defence: The Offensive Turn in US Cybersecurity Strategy
Sarah Mitchell
Emma Clarke