The FBI's first Cyber Strategy makes disruption the measure of a successful case
The four-pillar document published September 9 promises dismantled infrastructure, seized cryptocurrency and faster victim notification, with no deadline or metric attached. For victims, the nearest-term change is who picks up the phone.
The Watch · Security desk
What happened
- The FBI published its first ever Cyber Strategy on September 9, setting out how it investigates and disrupts cyber threat actors, many of them operating from jurisdictions beyond US law enforcement's immediate reach.
- Its first pillar runs from identifying threats and alerting compromised victims to dismantling adversary infrastructure, seizing stolen cryptocurrency, disrupting nation-state campaigns and taking down ransomware variants.
- The bureau is expanding its Industrial Control Systems Coordinator program to designate dedicated personnel in every field office.
- The capabilities pillar commits the FBI to AI-enabled tools for triaging large datasets, accelerating malware analysis, prioritizing victim notifications, mapping adversary infrastructure and supporting attribution.
- Private sector engagement is to run through three named programs: CISO Academy, Cyber Executive Summits and the Leadership in Cyber program.
Why it matters
- What doesn't add up contradiction Exabeam's Hempel reads the document as demoting prosecution, but the bureau's own text still promises to hold actors accountable wherever they hide, so counsel planning around an eventual indictment should not treat the demotion as stated policy.
- What's now possible capability An operator running control systems gains a designated contact in the local field office, which compresses the first hour of an OT incident that currently routes through generalist intake.
- What it limits constraint With no published notification timeline and no metric, a victim organization has no standard to hold the bureau to when a call goes unanswered for days.
- What it sets up precedent Doctrine that scores infrastructure takedowns as wins, sitting alongside August's authority for private firms to join offensive strikes, moves the request to a vendor or ISP from voluntary favour toward expected contribution.
Next story · Security · Oct 9
Arrests of ShinyHunters suspects reach at least three in two weeks after FBIjobs.gov breachConfirmed14 publishers
The four pillars carry no dates, no notification deadline, and no metric; whatever obligations exist are the bureau's own [15]. What is there is a resourcing plan, and half of it faces outward. Two of the four pillars, Support Victims and Increase Impact Through Partnerships, describe what the FBI will do for organizations rather than to adversaries [14].
Gabrielle Hempel, security operations strategist at Exabeam, called the emphasis on disruption over prosecution "an interesting shift" and listed what she counts as operational wins: "Taking infrastructure offline, seizing money, burning access, exposing tradecraft, and forcing adversaries to rebuild" [6]. The bureau's own sentence is less either-or. It says FBI Cyber will "disrupt adversaries before they can act, expose them when they do and hold them accountable wherever they hide" [9]. Accountability remains part of the doctrine, but it no longer functions as the only scoreboard.
What changes an engagement is the direction of intelligence flow. The victim-support pillar describes the FBI pushing threat intelligence to organizations that are being targeted, and deploying automated indicator-sharing mechanisms to make that faster [10]. That is outbound. The strategy as published does not set out a matching expectation that victims feed data back, and there is no schedule attached to the automation either [15]. An organization calling the bureau after an intrusion should plan for a faster inbound feed, not for a new disclosure duty.
One operational line worth noting is the "best athlete" model: the partner with the strongest authority, access or capability leads the relevant phase of an operation [5]. In practice that means the agency or partner running the takedown phase may not be the one that made the first victim call, which is a coordination question for anyone whose incident becomes part of a wider operation. Infosecurity Magazine reads the whole document as part of a broader US government turn toward proactive disruption [8]; on the evidence of the text, the turn is in how the bureau counts wins, and the machinery to deliver them is still being built.
What to watch
- Whether ICS Coordinator designations actually appear in every field office, and whether victims get a named person rather than a duty desk.
- Whether the automated indicator-sharing mechanism is a new pipe or an extension of existing FBI channels, and who qualifies for access.
- The first joint operation under the August memorandum in which a private firm's role is described in a public filing or affidavit.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption30
- Hype gap+35
- Incentives55
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The FBI published its first ever Cyber Strategy on September 9, providing guidance on how the agency investigates and disrupts cyber threat actors.
- [2]
The strategy addresses escalating attacks by financially motivated cybercriminals and state-sponsored actors who often operate from jurisdictions that put them out of immediate reach of US law enforcement.
- [3]
The Cyber Strategy contains four pillars: Investigate, Disrupt, and Impose Cost on Cyber Adversaries; Support Victims; Increase Impact Through Partnerships; and Enhance FBI's Cyber Capabilities.
- [4]
Under the first pillar, work starts with identifying threats and alerting victims whose networks have been compromised, then moves to operations that dismantle adversary infrastructure, seize stolen cryptocurrency, disrupt nation-state intrusion campaigns and take down pervasive ransomware variants.
- [5]
The FBI said it uses a "best athlete" model so that the partner with the strongest authority, access or capability leads the relevant phase of an operation.
- [6]
Gabrielle Hempel, security operations strategist at Exabeam, said the emphasis on disruption over prosecution is "an interesting shift", that success in cybercrime enforcement has long been measured by arrests that happen years later if at all, and that "taking infrastructure offline, seizing money, burning access, exposing tradecraft, and forcing adversaries to rebuild can be operational wins."
- [7]
In August, President Trump signed a memorandum authorizing federal law enforcement agencies to collaborate with private firms in conducting offensive cyber strikes on foreign threat actors targeting the US.
- [8]
Infosecurity Magazine reported that the new strategy appears to be part of a broader shift by the US government toward focusing on proactive disruption activities against cyber threat actors.
- [9]
The FBI wrote that with the strategy as its roadmap it will impose cost on cyber actors through decisive action, rapid victim support, integrated partnerships and continuous investment in tools and capabilities, and that "FBI Cyber will disrupt adversaries before they can act, expose them when they do and hold them accountable wherever they hide."
- [10]
The victim support pillar includes rapid sharing of threat intelligence with organizations that are being targeted, and the agency aims to deploy automated indicator-sharing mechanisms to speed up that process.
- [11]
The FBI is expanding its Industrial Control Systems (ICS) Coordinator program to designate dedicated personnel in every field office.
- [12]
The FBI said it will expand private sector engagement through three programs: CISO Academy, Cyber Executive Summits and The Leadership in Cyber (LinCY) program.
- [13]
The FBI committed to deploy AI-enabled tools to triage large datasets, accelerate malware analysis, prioritize victim notifications, map adversary infrastructure and support attribution, and to train its cyber workforce through its Cyber Education and Training Unit.
- [14]
Two of the strategy's four pillars, Support Victims and Increase Impact Through Partnerships, describe the bureau's conduct toward organizations outside it rather than toward adversaries.
- [15]
The published strategy as documented states no dates, no deadlines, no victim-notification timelines or performance metrics, and no reporting obligation on organizations outside the FBI.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comFBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors
1 article · September 10, 2026
- therecord.mediaFBI puts its cyber strategy on paper
1 article · September 9, 2026
Topics and entities
Topics
Entities
- Microsoft
- FBI Cyber Division
- Donald Trump
- Exabeam
- Federal Bureau of Investigation
- Brett Leatherman
- Gabrielle Hempel