Key Takeaways
- Determining whether a hacking group is truly state‑affiliated remains a major obstacle for both governments and private‑sector defenders.
- Ambiguity in affiliation creates legal gray zones that can discourage industry from taking offensive action against cyber criminals.
- State sponsors may deliberately cultivate relationships with hacker groups to shield them from retaliation, turning the line between state and non‑state actors into a strategic tool.
- Artificial intelligence is advancing more quickly in offensive cyber tasks (e.g., vulnerability exploitation) than in defensive or attribution‑heavy activities, potentially widening the offense‑defense gap.
- Clear, internationally accepted conventions on state affiliation and stronger intelligence sharing are essential to enable effective private‑sector participation in cyber defense.
- Policymakers should invest in attribution capabilities, develop norms for responsible AI use in cyber operations, and clarify rules of engagement for industry‑led offensive measures.
Introduction: The Evolving Landscape of Overlooked Cyber Threats
Cyber security continues to dominate the agenda of both public and private sector leaders because criminal syndicates, hostile nation‑states, and extremist actors constantly devise new ways to exploit digital infrastructure. Despite heightened awareness, the rapid pace of technological change means that certain risks fall through the cracks of traditional threat assessments. To illuminate these blind spots, four experts were asked to identify a cyber security threat to U.S. national security that analysts and policymakers often overlook. Their insights reveal structural ambiguities—particularly around the attribution of cyber acts to state actors—and emerging asymmetries in how artificial intelligence (AI) is reshaping offense and defense dynamics.
Emily Harding: The Challenge of Defining State‑Affiliated Hackers
Emily Harding, Director of the Intelligence, National Security, and Technology Program at the Center for Strategic and International Studies, stresses that determining whether a hacking group is truly state‑affiliated is a “complex challenge.” The Trump administration’s memorandum on “transnational cyber‑enabled crime” sought to draw a bright line: private firms may engage in offensive cyber operations against criminal groups, but any activity deemed “state‑associated” is prohibited. Harding points out that the reality is far messier. In Russia, for example, the spectrum ranges from Kremlin‑owned hacking units, to government employees who freelance as criminals, to outright criminal syndicates that occasionally perform favors for the state. This gradient makes it difficult to decide which groups are “fair game” for industry‑led counterstrikes.
The memorandum’s attempt to create a clear dichotomy may unintentionally produce a perverse incentive. States like China and Russia could deliberately foster relationships with hacker groups to provide them a layer of plausible deniability, thereby shielding the attackers from retaliation. Without robust intelligence on these ties and universally accepted conventions defining what constitutes state affiliation, private companies risk becoming mired in legal debates rather than taking decisive action. Harding argues that overcoming this impasse requires both clearer normative frameworks and improved attribution capabilities that can reliably map the blurred boundaries between state sponsorship and criminal entrepreneurship.
Caleb Withers: AI’s Asymmetrical Advancement in Offensive Cyber Tasks
Caleb Withers, a Research Associate for the Technology and National Security Program at the Center for a New American Security, highlights a different but equally consequential oversight: the divergent rates at which AI improves offensive versus defensive cyber capabilities. Withers observes that AI is already advancing rapidly in tasks that favor the offense—such as discovering and exploiting software vulnerabilities, crafting persuasive phishing lures, and automating the lateral movement inside networks. Success in these areas is often self‑evident: a exploit either works or it does not, providing a clear feedback loop for machine‑learning models to refine their performance.
Conversely, defensive applications—like anomaly detection, threat hunting, and attribution—remain comparatively messy. These tasks require contextual understanding, nuanced judgment, and the ability to fuse disparate data sources under uncertain conditions. The lack of a clean, binary success metric makes it harder to train AI effectively, slowing progress in the defensive domain. Withers warns that if this imbalance persists, adversaries will gain a growing edge in speed and precision, while defenders struggle to keep pace, potentially widening the offense‑defense gap that already strains national cyber resilience.
Implications for U.S. National Security Policy
The combined insights from Harding and Withers underscore two interrelated vulnerabilities in the current U.S. cyber security posture. First, the ambiguity surrounding state affiliation undermines the legal and operational frameworks that permit private‑sector actors to contribute actively to cyber defense. When firms fear inadvertent violations of prohibitions against “state‑associated” targets, they may opt for caution, leaving critical threats unaddressed. Second, the accelerated offensive maturation of AI threatens to outstrip defensive capabilities, potentially enabling adversaries to launch more frequent, sophisticated, and harder‑to‑attribute attacks.
Together, these trends suggest that policymakers must pursue a dual‑track strategy: (1) clarify and operationalize norms that distinguish criminal hackers from state‑sponsored groups, and (2) invest in AI research that bolsters defensive functions such as predictive threat intelligence, automated attribution, and resilient system design. Without progress on both fronts, the United States risks ceding strategic advantage to adversaries who can exploit legal ambiguities and technological asymmetries.
Recommendations for Closing the Gaps
To address the attribution challenge, the government should establish an interagency cyber attribution hub that consolidates signals intelligence, financial tracking, and human‑source reporting to produce timely, high‑confidence assessments of hacker groups’ ties to states. This hub would also issue clear guidance documents outlining what evidence qualifies as state affiliation, thereby giving private firms a reliable reference point for decision‑making.
On the AI front, Congress and the executive branch should fund targeted programs that pair machine‑learning experts with cyber defense practitioners to develop defensive AI tools grounded in real‑world operational feedback. Emphasis should be placed on creating explainable AI models that can justify their alerts and recommendations, facilitating trust and easing legal scrutiny. Additionally, international dialogues—perhaps within the framework of the UN Group of Governmental Experts—should seek to establish norms limiting the weaponization of AI in cyber conflict, mirroring efforts to curb the proliferation of other dual‑use technologies.
Finally, incentivizing information sharing between industry and government through liability protections and streamlined reporting mechanisms can help firms act decisively against criminal hackers without fear of inadvertent entanglement with state‑linked actors. By coupling clearer legal standards with strengthened defensive AI capabilities, the United States can better safeguard its critical infrastructure against the evolving spectrum of cyber threats.
Conclusion: Turning Overlooked Risks into Actionable Priorities
The cyber threat landscape is defined not only by the actors who seek to exploit it but also by the structural blind spots that allow those threats to persist. Emily Harding’s analysis of the murky distinction between criminal and state‑affiliated hackers reveals how legal ambiguities can paralyze potentially effective private‑sector responses. Caleb Withers’ warning about AI’s asymmetric advancement highlights a technological trend that could tip the balance toward offense unless deliberate steps are taken to bolster defensive capacities.
Recognizing these overlooked threats is the first step toward mitigating them. By establishing precise attribution standards, fostering international norms, and directing investment toward defensive AI, policymakers can transform current vulnerabilities into sources of resilience. In doing so, the United States will not only protect its own networks but also contribute to a more stable and secure global cyberspace.