Artificial intelligence and the risk of strategic cyberattack

Cyber weapons have long been described as strategic instruments of statecraft. In practice, they have almost always been tactical in their application. Attackers have struggled to predict the effects of their operations with confidence, overcome complex classification structures, and assemble the expert-level capacity required to execute sophisticated cyberattacks at scale. As a result, cyber operations have rarely achieved the kind of broad, sustained strategic effects that theorists, journalists, and U.S. government sources have long anticipated.

In a new RAND paper, the author argues that artificial intelligence (AI)—particularly agentic AI, meaning systems capable of pursuing goals with some degree of autonomy—will significantly expand the strategic potential of cyber operations. It will do so primarily by alleviating the constraint on expert-level human capacity that has most limited strategic outcomes to date.

The author first examines the tactical-strategic divide as it applies to tools of statecraft and force. He then reviews why publicly known cyber operations have largely fallen short of strategic expectations, identifying three key characteristics that have confined most cyber activity to tactical uses. Finally, he assesses how current developments in AI are likely to reshape each of these three factors, though not equally, and what that means for the future strategic potential of cyber operations.

Read more at RAND