27 June 2025

The Pentagon knows its cyber force model is broken. Here’s how to fix it

Erica Lonergan and Jiwon Ma

The U.S. military has tried almost everything to fix its cyber readiness issues except the one solution that would work: standing up a dedicated cyber service.

At a congressional hearing in May, senior defense officials publicly acknowledged that CYBERCOM 2.0 — an initiative launched by U.S Cyber Command (CYBERCOM) to overhaul how it builds and manages cyber forces — fell short of the Pentagon’s expectations. The effort was loosely modeled on Special Operations Command, but even under this model, CYBERCOM still lacks the authority to enforce common standards for the services,

 tailor recruitment to the unique dynamics of cyberspace operations, or control initial training. “We think it needs even more work,” said Laurie Buckhout, the acting assistant secretary of defense for cyber policy.

There have been attempts to address structural shortfalls in the past. Most recently, Congress granted CYBERCOM enhanced budgetary control in fiscal year 2024, giving the command oversight of roughly $2 billion in acquisitions for cyber tools, systems, and training. But the services still control the vast majority of cyber acquisition funds.

More than two decades after declaring cyberspace a warfighting domain, the U.S. military relies on an inefficient and ineffective solution to generate the capabilities needed to defend it. CYBERCOM holds the primary responsibility for operating in and through cyberspace,

but it relies on personnel drawn from five different military services to do so. There are no common standards for recruiting, initial training, or career progression across the services, and none treats cyberspace as a core mission. The result is chronic readiness gaps, inconsistent quality, and top talent regularly lost to the private sector.

No comments: