Main threat seen from China
Senior US defence officials delivered a stark warning to US lawmakers on May 16, 2025, spotlighting the growing dangers posed by state-sponsored cyber actors and criminal organisations that exploit cyberspace to undermine US national security.
The remarks came during a high-stakes hearing before the House Armed Services Committee’s subcommittee on cyber, information technologies and innovation.
Laurie Buckhout, acting assistant secretary of defence for cyber policy, and Army Lt. Gen. William Hartman, acting commander of US Cyber Command (Cybercom), issued urgent calls for strategic focus, technological innovation and investment in cyber talent. Their message was clear: the digital domain is a fully contested battlespace, and the US must act decisively to maintain the upper hand.
Buckhout, a veteran with more than four decades of experience in communications, intelligence and cyber operations, emphasised the mounting threat Chinese cyber actors pose. Chief among them is Volt Typhoon, a group accused of covertly infiltrating US critical infrastructure through highly sophisticated tactics that make detection extremely difficult.
“Adversaries transform cyberspace — a domain powering global connectivity, communications and innovation — into a contested battlespace,” Buckhout warned the lawmakers.
Referencing a 2024 Cybersecurity and Infrastructure Security Agency advisory, Buckhout detailed how Volt Typhoon has penetrated key sectors, including energy, water, and telecommunications. The group reportedly uses “living off the land” techniques, relying on legitimate software tools to mask its presence and avoid traditional cyber defences.
“Their actions expose the urgent need for relentless vigilance and advanced countermeasures,” Buckhout stressed, highlighting the potential for large-scale disruption and long-term espionage.
Beyond China, Buckhout underscored the complex web of threats from Russia, Iran and North Korea. She noted that Russia continues integrating cyber warfare into broader geopolitical manoeuvres, while Iran and North Korea pursue persistent cyberattacks, increasingly turning to ransomware to generate revenue. She also called attention to transnational criminal groups targeting critical infrastructure for financial gain, further complicating the cyber threat landscape.
These threats underscore a central theme within US Defence Secretary Pete Hegseth’s strategic vision. He has championed cyber dominance as a defining factor in future conflicts. Speaking recently at the US Naval Academy, Hegseth reinforced the department’s commitment to embedding cyber operations into offensive and defensive military planning.
“In a world where cyber and space dominance will determine future battlefields, if we do it right … it should be our comparative advantage,” he said.
Cyber command’s expanding front line
Lt. Gen. Hartman vividly described Cybercom’s current operational tempo, describing a relentless, daily battle to protect national interests in cyberspace.
“We fight cyberwarfare daily, defending the nation, securing DOD networks and empowering the joint force,” he told the committee.
In 2024 alone, Cybercom conducted over 6,000 operations, a 25% increase from the previous year. These missions targeted a wide range of malicious cyber actors worldwide. Hartman said this pace is expected to grow in both complexity and intensity.
He highlighted the critical partnership with the National Security Agency (NSA), which enables Cybercom to harness cutting-edge technical expertise and optimise shared resources. This collaboration, combined with a congressionally mandated artificial intelligence roadmap, is helping the department pilot AI-powered tools to enhance speed and precision in threat detection and response.
“AI transforms how we analyse threats and deploy capabilities,” Hartman said, echoing President Donald J. Trump’s prioritisation of AI in national security strategy.
The evolution of Cybercom 2.0
Buckhout also addressed the ongoing overhaul of the Cybercom 2.0 framework, a legacy initiative from the previous administration. The programme aims to streamline cyber workforce management and innovation, but Buckhout said the model needs refinement to meet today’s dynamic threats.
“We value Cybercom 2.0’s foundation but recognise its shortcomings,” she said, noting that the current administration is conducting a thorough review to update the strategy.
During the hearing, Hartman shared that Cybercom supports adopting a structure similar to the US Special Operations Command. This would centralise training and force development under a unified command, leaving operational control for regional combatant commanders.
“This model balances efficiency with flexibility,” Hartman explained, suggesting it could lead to better alignment between training, mission readiness and operational needs.
Recruitment and retention in a competitive market
A recurring concern throughout the hearing was the challenge of recruiting and retaining top cyber talent. While Hartman said roles such as network operators, analysts and coders are still attractive to mission-driven professionals, broader talent acquisition remains difficult due to stiff competition from the private sector.
“We offer opportunities no tech company can match,” he said, referring to the unique and impactful nature of national defence missions. However, gaps persist in recruiting key support roles, including linguists and intelligence analysts, specialists critical for sustained cyber operations.
A department-wide hiring freeze and voluntary separation incentives exacerbate the issue, leading to losing 5 to 8% of Cybercom’s personnel.
“Our junior leaders will step up, but the loss is significant,” Hartman acknowledged.
Concerns over the mental health of cyber personnel also surfaced during the hearing. Lawmakers pointed to a recent congressional report highlighting insufficient mental health resources for cyber operators who face high levels of stress and isolation.
In response, Hartman confirmed that Cybercom hired its first psychologist this year and is actively working to expand support services.
Image: US Army Lt. Gen. William Hartman, acting commander of US Cyber Command, testifies before the US House Armed Services Committee’s cyber, information technologies and innovation subcommittee during a hearing in Washington, on May 16, 2025. Credit: US Army
