How the Pentagon wants to buy cyber outcomes, not equipment

Breaking Defense | Mark Pomerleau

The United States Department of Defense is advancing a Cyber Effects-as-a-Service model to procure operational offensive and defensive outcomes rather than standardized hardware or software tools. Assistant Secretary of Defense for Cyber Policy Katie Sutton highlighted that military demand signals across combatant commands significantly outpace current organic supply.

This operational mechanism shifts private contractors from traditional technological vendors into direct operational partners capable of executing tailored cyber missions. Cyber threats evolve too quickly. The Department of Defense seeks to bypass traditional acquisition delays by contracting directly for immediate tactical results. However, expanding contractor participation in active military operations introduces legal and operational uncertainties regarding statutory combat authorities and civilian involvement in warfare. Drafts of the forthcoming Department of Defense cyber strategy reflect this institutional shift toward direct industry participation in military mission execution. While officials prioritize speed, integration risks between private firms and military personnel remain a critical unresolved governance challenge.

Comment

Contracting operational outcomes under Cyber Effects-as-a-Service creates severe friction with statutory Title 10 combat authorities governed by U.S. Cyber Command. Under the Law of Armed Conflict, executing offensive cyber operations constitutes direct participation in hostilities, a role legally restricted to uniformed military forces. Delegating mission execution to commercial contractors blurs command accountability within tactical units like the Cyber National Mission Force.

A comparable friction emerged during Operation Iraqi Freedom, where reliance on private security contractors under Coalition Provisional Authority orders eroded operational control in combat zones. In cyberspace, contractor-executed operations risk triggering unintended counter-strikes without clear operational authority resting in military commanders. Integrating commercial operators directly into target development exposes U.S. Cyber Command to grave operational ambiguity during crises.

Strategic Question for Discussion

If Cyber Effects-as-a-Service transfers mission execution to private contractors, how does U.S. Cyber Command maintain lawful command and control under Law of Armed Conflict constraints?

The operational framework suggests that U.S. Cyber Command will maintain a strict command approval architecture, treating contractor capabilities as technical delivery systems rather than autonomous operational actors. However, this statutory boundary becomes precarious when dynamic combat environments require instantaneous cyber counter-measures faster than uniformed military commanders can authorize. The trajectory points toward a constrained employment model where contractors develop and deliver payloads, while Title 10 execution authority remains strictly within the Cyber National Mission Force.

Share your assessment in the comments below.