Director’s note: The accelerating pace of strategic change

Dear readers,

In a rare joint call to action, the leaders of the Five Eyes cybersecurity agencies issued a stark warning this week that the timeline for frontier AI models “to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities” is not years but months. A day after Five Eyes sounded the alarm, Ben Finley at The Associated Press reported that testing conducted through Project Glasswing resulted in Anthropic’s Mythos model pinpointing vulnerabilities in highly sensitive and secure U.S. government computer systems within hours. At The New York Times, Dustin Volz and Julian E. Barnes reported that the NSA lost its access to testing Mythos and Fable models after export controls were imposed on Anthropic. The strategic challenge is increasingly one of speed. The capability curve is accelerating faster than the institutions responsible for evaluating, securing, governing and deploying these technologies can adapt.

The race to red team and prepare for powerful AI models could not be more urgent. A Chinese cybersecurity firm announced at a Beijing conference this week that it had developed “China’s version of Mythos” with offensive and defensive AI tools it calls a “powerful weapon,” Eduardo Baptista reported at Reuters. At Bloomberg, Maggie Eastland reported that Anthropic accused tech giant Alibaba of waging a large-scale effort to illicitly access its Claude artificial intelligence model in what it called the biggest attempt so far by a Chinese company to piggyback on the work of top U.S. labs. The AI competition is increasingly about more than model performance. It is becoming a contest over who can most rapidly operationalize these capabilities for national security advantage while denying that advantage to competitors.

With headlines this week illustrating how rapidly frontier AI is reshaping cybersecurity, this week on Cyber Focus I sat down with CyberScoop Editor-in-Chief Greg Otto to examine several of the questions increasingly shaping the cyber landscape. How should governments balance vulnerability disclosure with national security? Are export controls strengthening or inadvertently constraining U.S. strategic advantage? What does AI mean for journalism, public-private partnerships and cyber defense? And why is sustained leadership at CISA more important than ever as the threat environment continues to evolve? Along the way, we also explored the fragility of the open-source software that underpins much of today’s digital ecosystem, the implications of the Canvas breach across educational institutions, and what these developments collectively signal about the future of cyber policy and practice.

While frontier AI has understandably dominated recent headlines, quantum computing quietly took an important step forward this week as President Trump signed a pair of executive orders: “Ushering in the next frontier of quantum innovation” and “Securing the nation against advanced cryptographic attacks.” The first order directs federal agencies to work with the private sector and academics to deploy a quantum computer powerful enough to conduct scientific research by 2028, Amrith Ramkumar reported at The Wall Street Journal, while the other directs agencies and government security experts to prepare for quantum systems that can evade standard encryption more quickly than previously anticipated. McCrary senior fellows Ryan Gillis and Matt Hayden told Grace Dille at MeriTalk that the orders are timely at a critical juncture for quantum innovation and reflect necessary urgency. Another development worth keeping an eye on is the launch of RAISE US, a bipartisan initiative bringing together governors, technology companies and major employers to help prepare the American workforce for the AI era. As strategic competition increasingly centers on AI, America’s long-term advantage will depend not only on developing leading technologies, but also on cultivating the talent needed to deploy and sustain them at scale.

As lawmakers hammer out their chambers’ versions of the National Defense Authorization Act, an unprecedented move toward expanding the ranks of offensive cyber operators made it into the Senate Armed Services Committee’s bill. The committee seeks to authorize a pilot program that would assess the feasibility of conducting cyber operations limited to gaining access to systems using civilian contractors with their own infrastructure, but still under the operational direction and authority of U.S. Cyber Command, Mark Pomerleau reported at Breaking Defense. If enacted, it could represent one of the most consequential evolutions in how the United States develops operational cyber capacity, recognizing that private-sector expertise and infrastructure may become increasingly essential components of future cyber operations.

The space sector has been in a heightened defensive stance since the beginning of the conflict with Iran, with one CISO reporting a 400% spike in attack tempo as AI has increased the scale and sophistication, Leandra Bernstein reported at Via Satellite.These developments reinforce a broader reality: Every strategic domain, including space, is increasingly contested in and through cyberspace, with AI accelerating both opportunity and risk. Against that backdrop, the Mitchell Institute for Aerospace Studies released a new report on space superiority through the spectrum of conflict, based on a recent workshop in which experts explored a range of scenarios related to the perception of and response to hostile actions. At Breaking Defense, former Air Force Vice Chief of Staff Gen. Jim Slife (ret.) emphasized that “whoever dominates space has a decisive advantage over our adversaries” and urged the federal government to accelerate and “normalize a new tier of space capabilities built upon highly resilient, rapid, and mass-proliferated orbital architectures.”

One of our Five Eyes partners released their annual threat assessment this week, and Australian Security Intelligence Organisation Director-General of Security Mike Burgess sounded an all-too-familiar warning on nation-state actors prepositioning in the country’s critical infrastructure systems. Australian officials discovered a state-sponsored group not only hacked a CI provider to “cripple it at a time of their choosing” but had the credentials of the IT professionals guarding it – prompting Burgess to establish teams dedicated to defending infrastructure systems from cyber sabotage, Simon Sharwood reported at The Register. The similarities to PRC activity observed elsewhere should serve as another reminder that adversaries continue to prioritize long-term prepositioning over immediate disruption – a strategy designed to preserve options and create strategic leverage long before a crisis unfolds.

The connective tissue across this week’s developments is the accelerating pace of strategic change. Whether the topic is frontier AI, quantum computing, offensive cyber authorities, critical infrastructure or space resilience, the interval between technological breakthrough and operational consequence continues to shrink. That reality demands institutions capable of learning, adapting and acting at a pace more consistent with innovation than bureaucracy. The strategic advantage will belong not simply to those who invent first, but to those who can responsibly field, secure and integrate emerging capabilities faster than their competitors.

This week by the numbers:

• Cyber-scam techniques such as phishing have emerged as the most widespread and financially damaging form of cybercrime, with 33% of countries in Asia and the South Pacific reporting over 10,000 cases. (INTERPOL)

• About 270 organizations in Belgium including law firms, local councils and schools were affected by a cyberattack in February after their firewalls were compromised, and more than 100 of these organizations can still be accessed online using stolen administrator accounts. (Belga News Agency)

• Never too late to patch: The open source data transfer tool and library curl was updated this week with patches for 18 vulnerabilities, including one introduced 25 years ago. (Security Week)

• 38% of respondents in a newly released survey said they would support a data center being built near their home, while 34% would oppose it. Meanwhile, 49% say they support a moratorium on construction of new data centers, while only 16% oppose a moratorium. (Axios)

• A group of associations representing state and local governments asked Senate Appropriations Committee leaders for $300 million to fund a year of the State and Local Cybersecurity Grant Program. (StateScoop)

One of the most thought-provoking pieces I read this week came not from the cyber community, but from researchers examining the intersection of natural systems, resilience and national security. Nicola Ranger, Thea Philip, Tom Tayler and Emma O’Donnell at the London School of Economics and Political Science’s Earth Capital Nexus global research initiative argue that critical natural systems – including forests, rivers, biodiversity hotspots and productive land – are macro-critical infrastructure. This subset is so foundational to wellbeing, economic growth and resilience that manmade or natural threats can impact food, water and energy prices, national fiscal balances, supply chains and financial markets, they write, proposing a new concept of Global Systemically Important Natural Systems (G-SINS) similar to the Global Systemically Important Banks (G-SIBs).

War Eagle,

Frank Cilluffo