Pentagon Cyber Chief: Demand for Capabilities Outstrips Supply

The Pentagon's top civilian cyber policy official, Katie Sutton, has declared that her primary focus is on expanding the cyber capabilities available to the President and the Secretary of Defense, acknowledging a significant gap between what military commanders require and what the force can currently deliver. "The demand far exceeds the supply we have," stated Sutton, who serves as the assistant secretary of defense for cyber policy, during a recent DefenseTalks event.

Sutton traced the department's current posture to 2018, when the military received expanded authorities to conduct cyber operations as a conventional military activity. She noted that while much has been learned in the intervening years, the past year has seen cyber operations truly enter the public spotlight. "We've built up the capabilities, we've built up our force, we have the operational experience," she added, underscoring the growing maturity and integration of cyber within military strategy.

This increased visibility is partly due to high-profile operations where cyber capabilities have been implicated. Sutton pointed to the potential involvement of cyber operations in past events, such as the operation in Venezuela aimed at apprehending former president Nicolás Maduro, where power outages were publicly linked to cyberattacks. While experts have suggested cyber ops may have played a role, the visible physical attacks during the operation could also plausibly explain the disruptions.

The shift in cyber's role, as described by Sutton, is rooted in its evolving application. It is no longer solely a tool for countering other malicious cyber actors in a cyber-on-cyber context, but rather an integrated component of broader cyber warfare. "Data is fundamental to every battle that we fight going forward," Sutton emphasized, explaining that the ability to deny adversaries access to data through cyber tools is crucial for mission success and troop safety during kinetic engagements.

Furthermore, Sutton highlighted cyber as a strategic option for leaders to employ "below the level of armed conflict," providing viable alternatives before resorting to kinetic military actions. This strategic flexibility underscores the growing importance of cyber capabilities in the full spectrum of military operations, offering nuanced options for de-escalation or targeted disruption.

Looking ahead, Sutton discussed the integration of artificial intelligence (AI) into the military's cyber operations, viewing it as a natural progression given the digital nature of the domain. "Cyber is a digital domain; it's all based on zeros and ones," she said, advocating for the department to adopt an "AI-first" organizational mindset. However, she also acknowledged the unique risks associated with AI, such as data poisoning and the potential for weakened security guardrails, necessitating a fundamentally different approach to cyber operations compared to the early internet era.

These concerns echo sentiments from other military leaders, such as Gen. Randall Reed, head of U.S. Transportation Command, who has warned about the vulnerability of predictable military supply chains to AI-enabled adversaries. Reed suggested that AI itself could be part of the solution, helping to make logistics operations less predictable and illustrating how military officials are exploring AI's potential across various operational domains.

The Pentagon's acknowledgment of the growing demand for cyber capabilities and its strategic embrace of AI signal a significant evolution in defense strategy. As cyber operations become increasingly central to national security, addressing the supply-demand imbalance and navigating the complexities of AI integration will be critical for maintaining a strategic advantage.