The Pentagon needs a new plan to deter hackers from attacking American critical infrastructure, say senators who aim to write that into law.
In its version of the 2026 National Defense Authorization Act, the Senate Armed Services Committee would require the Pentagon to develop a strategy to “reestablish a credible deterrence against cyberattacks targeting American critical infrastructure using the full spectrum of military operations,” according to an executive summary of the bill that was marked up and passed in closed sessions this week.
“As we’ve seen in the last two years—particularly with Volt and Salt Typhoon—there’s obviously a growing, more aggressive and capable threat against our critical infrastructure that supports the Department of Defense,” a senior congressional official told reporters Friday following the bill’s finalization.
The strategy, if the provision is adopted in the final legislation, would outline a complete range of options that could be used to deter adversaries.
“There is a clear concern with the fact that they continue to do so, or rather that the [People’s Republic of China] continues to attack our critical infrastructure,” the official said. “Because obviously, in today’s environment, they’re still doing it, so the deterrence is no longer working.”
Concerns about China’s cyberattacks on U.S. networks and infrastructure—including those belonging to defense contractors—have mounted in recent years, culminating in calls for better policies and increased attention to workforce needs.
Some lawmakers and Trump administration officials have touted offensive cyber operations as a way to boost deterrence alongside ongoing efforts such as adopting zero trust architecture and investing in cyber defense tools.
“I am concerned about the threats to our critical infrastructure, the disinformation that can come through cyber threats and also zero-day exploits,” Justin Overbaugh, nominee for the Deputy Under Secretary of Defense for Intelligence and Security, testifies before the Senate Armed Services Committee on Capitol Hill May 1, 2025 in Washington, DC. The committee heard testimony from Overbaugh on his nomination as well as testimony fro told senators during his May nomination hearing to be the Pentagon’s lead for intelligence and security matters. “And I think some of our solutions in zero-trust architecture, active cyber defense, private-public collaboration and offensive cyber capabilities are tools that we’ll be able to bring to bear to meet those threats.”
Overbaugh also noted that “offensive cyber capabilities and an increased focus on Defense human intelligence are areas for opportunity,” according to responses to policy questions sent ahead of the hearing.
Katherine Sutton, who is nominated to be assistant defense secretary for cyber policy, has similarly stressed offensive cyber operations.
“We are not going to deter the adversary with defenses only,” Sutton said at her May confirmation hearing. “China’s growing cyber capabilities and its ongoing attempts to target our infrastructure underscore the critical importance of bolstering our own cyber capabilities. Although the United States has made significant strides in cybersecurity, we must act with urgency to accelerate the development and integration of new technologies and advanced capabilities, like artificial intelligence, that will ensure our continued cyber superiority.”
But despite increasingly urgent calls to mitigate cyberattacks, the Defense Department still faces workforce concerns.
“China is the primary threat to our national interests and the most significant threat we face in cyberspace. At the same time, we must also manage the cyber threats posed by Russia, Iran, North Korea, and violent extremists and criminal organizations, all of whom continue to invest in a broad arsenal of cyber capabilities, with the clear intention of challenging U.S. national interests at home and abroad,” Sutton wrote in responses to policy questions. “Managing these challenges will require continued progression to improve our defenses and deterrent capabilities against longstanding cyber policy challenges, while positioning our still limited cyber resources against the greatest threats.”
That means developing talent and tools that can meet current and future needs.
“We must continue to develop top-tier cyber talent,” Sutton wrote. “Our workforce must include specialized talent that can rapidly respond to priorities and develop robust options for the President.”
Senators added several provisions to the NDAA that focus on cyber talent and making sure there are enough professionals to do the work, according to the executive summary. Among them:
- Updating and expanding the Cyber Excepted Service civilian personnel;
- management system to improve hiring, pay, and management as well as include the entire Department of Defense cyber workforce;
- A mandatory inspector general review of U.S. Cyber Command’s acquisition activities and workforce needs;
- Required reports that “certify that DOD has fully identified, tracked, and integrated” reserve component into its Cyber Mission Force structure and operational planning; and
- A defense secretary review on “employment concepts for cyber operations, including assessment of personnel policies that might be needed to support any such evolving cyber force.”
