What the FBI’s new offensive cyber strategy means to the private sector

- Build the company’s relationship with the local FBI cyber squad before the breach: The FBI has made private sector partnerships a critical component of its expanded cyber strategy. General Counsels and executive leadership cannot leave CISOs to navigate this alone. Organizations should establish relationships with their local FBI cyber teams before an incident occurs and participate in programs such as InfraGard and their sector-specific information sharing alliances. - Shift the organization’s security mindset from threat intelligence to disruption intelligence: For this expanded strategy to work, CISOs must change their thought process from focusing on how intelligence protects the business to considering what they know that can assist the FBI. Preserving malware, domains, IP addresses, crypto data and identity telemetry are resources that threat actors depend on, and they are also valuable resources for the FBI to drive disruption. The private sector needs to move from being a consumer of government cyber intelligence to becoming an operational partner in national defense. - Make forensic readiness a priority: In this new environment, logs are more than troubleshooting data. They can become intelligence and evidence. CISOs should take a more focused resilience view, which emphasizes centralized, protected logging and evidence preservation. Corporate America has just now started to embrace the need for in-house forensic capabilities, but the FBI’s strategy will drive the private sector to expand their internal personnel and forensic skillsets. Security Strategy, Plan, Budget What the FBI’s new offensive cyber strategy means to the private sector (Adobe Stock) COMMENTARY: The FBI’s new offensive cyber operations strategic plan marks a decisive shift from a traditionally reactive law enforcement posture to an active disruption strategy.For decades, the FBI built a program around defending the castle: detect the intruder, expel them from the network, patch the vulnerability, and prepare for the next attack. As technology and victim impacts have accelerated, that strategy no longer suffices.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]The FBI’s new strategy helps the agency take the fight upstream to the adversary: identify the infrastructure, money, tools and people enabling cyberattacks and disrupt those ecosystems before they can continue attacking American companies. As a former FBI agent, I see this strategy as a necessary evolution. However, as a former CIO, I’m concerned about the private sector fallout.Why we need an offensive cyber strategyGiven the dynamics reshaping cybersecurity, the FBI’s new strategy represents a step in the right direction.First, cybercrime has evolved into an industrialized and commoditized force. Companies are no longer fighting individual hackers. They are confronting ransomware affiliates, access brokers, malware developers, bulletproof hosting providers, cryptocurrency launders, state intelligence services and commercial technology providers operating as interconnected ecosystems.Second, the boundary between nation-state operations and cybercrime has increasingly blurred. The FBI has specifically warned that state actors and financially-motivated hackers can form a blended threat, while foreign adversaries are also penetrating U.S. networks for espionage and potentially pre-positioning themselves inside critical infrastructure. The result has been a threat environment in which traditional distinctions between cybercrime, espionage, and national security are increasingly difficult to maintain.Third, AI compresses the attack cycle. The FBI has also warned that both nation-states and criminals use AI to increase the speed and scale of their operations.The combination of these factors makes disruption increasingly important. After all, the FBI can't arrest a threat actor in Saint Petersburg or Beijing.Moving from “investigate and indict” to “actively disrupt and dismantle” adversary infrastructure gives the FBI an opportunity to target the ecosystems that run successful cyberattacks rather than simply respond after an American company has been compromised.Why the concern over the impact on the private sector?While I view the FBI’s new strategy as imperative, my experience as a former CIO also makes me focused on helping the private sector prepare for the blowback it could create.Offensive cyber operations inevitably invite retaliation. When the U.S. government disrupts a major threat group, those adversaries don't necessarily hit back at the FBI headquarters. Private enterprises—particularly organizations in critical infrastructure, healthcare, financial services and other high-value sectors—could find themselves caught in the crossfire.For this strategy to succeed, we must pair offensive operations with real-time, unclassified threat sharing for enterprise CISOs. Disruption without private sector coordination invites unmitigated risk.The FBI has signaled that private companies will increasingly become operational partners rather than simply victims or recipients of threat intelligence. That could fundamentally change how CISOs interact with federal law enforcement, how companies preserve and share cyber evidence, and how public-private operations target ransomware groups and nation-state infrastructure. It also raises important questions about attribution, oversight, escalation and the emerging government-supervised role of private cybersecurity firms in offensive operations.We're entering an era in which cybersecurity has become far more operational. Government has authorities the private sector does not, while the industry has technology and visibility that government cannot access directly. The FBI's strategy presents an opportunity to combine those capabilities to impose real costs on cyber adversaries rather than simply cleaning up after them.But that model requires the private sector to contribute and withstand the potential consequences.Here are three steps security leaders should take now: The FBI’s shift toward offensive cyber operations makes sense in the wake of threat groups that are faster, more organized, and increasingly difficult to distinguish from nation-state actors. But taking the fight upstream changes the risk equation for everyone. If government disruption becomes a larger part of the national cyber strategy, businesses will increasingly become both operational partners and potential targets of retaliation.For CISOs, that means building trusted relationships with law enforcement before an incident, treating corporate telemetry as a potential national security resource, and investing in forensic readiness. The future of cybersecurity will depend not only on how effectively organizations defend their networks, but on how prepared they are when adversaries fight back.James Turgal, vice president of cyber risk and board relations, OptivSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial. Get daily email updates SC Media's daily must-read of the most current and pressing daily news You can skip this ad in 5 seconds