FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors

The FBI has published its first ever Cyber Strategy , providing guidance on how the agency investigates and disrupts cyber threat actors.

The new document , published on September 9, highlights the need for strategic response to escalating cyber-attacks perpetrated by financially-motivated cybercriminals and state- actors, who often operate from jurisdictions that put them out of immediate reach of US law enforcement.

The new strategy appears to be part of a broader shift in strategy by the US government towards focusing on proactive disruption activities against cyber threat actors.

“With this strategy as our roadmap, the FBI will impose cost on cyber actors who target the United States through decisive action, rapid victim support, integrated partnerships and continuous investment in tools and capabilities. FBI Cyber will disrupt adversaries before they can act, expose them when they do and hold them accountable wherever they hide,” the FBI wrote.

Commenting on the FBI strategy document, Gabrielle Hempel, security operations strategist at Exabeam, said: “The emphasis on disruption over prosecution is an interesting shift. ‘Success’ in cybercrime enforcement has long been measured often by arrests that happen years later, if at all. Taking infrastructure offline, seizing money, burning access, exposing tradecraft, and forcing adversaries to rebuild can be operational wins. I like that the FBI is broadening what a successful takedown looks like.”

In August, President Trump signed a memorandum authorizing federal law enforcement agencies to collaborate with private firms in conducting offensive cyber strikes on foreign threat actors targeting the US.

A Four-Pronged Strategy

The Cyber Strategy contains the following four pillars:

Investigate, Disrupt, and Impose Cost on Cyber Adversaries

In this pillar, the document sets out how the FBI seeks to disrupt and impose costs on cyber adversaries that target the US.

It described how different cyber threat teams within its cyber workforce work together for this purpose. This starts with identifying threats and alerting victims if their network has been compromised.

The stage is launching operations to disrupt adversaries, including dismantling adversary infrastructure, seizing stolen cryptocurrency, disrupting nation-state intrusion campaigns and taking down pervasive ransomware variants.

The FBI said it uses a “best athlete” model to ensure it partners with the strongest authority, access or capability leads the relevant phase of an operation.

The FBI detailed a range of methods it uses to help victims respond and recover from cyber-attacks. This includes rapid sharing of threat intelligence with organizations that are being targeted and the agency aims to deploy automated indicator-sharing mechanisms to speed up this process.

The FBI said it aims to quickly engage victims when cyber incidents occur and support their containment and recovery efforts. This is especially important for critical infrastructure, and the agency is expanding its Industrial Control Systems (ICS) Coordinator program to designate dedicated personnel in every field office.

Increase Impact Through Partnerships

The FBI said it is committed to expand and deepen relationships throughout government, international allies and across the private sector to support its objectives. This includes building systems and process to quickly actionable intelligence with these partners.

The agency added that it will expand engagement with the private sector through three programs – CISO Academy, Cyber Executive Summits and The Leadership in Cyber (LinCY) program.

Enhance FBI’s Cyber Capabilities

This pillar discusses the FBIs efforts to recruit and retain top cyber talent and implement new technical tools and techniques, including AI.

The agency will provide technical and operational training across its cyber workforce through its Cyber Education and Training Unit (CETU).

The FBI has also committed to deploy AI-enabled tools that support activities such as triaging large datasets, accelerate malware analysis, prioritize victim notifications, map adversary infrastructure and support attribution.

Image credit: Poetra.RH / Shutterstock.com

FBI and French Police Shutter BreachForums Domain Again News 13 October 2025

FBI and French Police Shutter BreachForums Domain Again

Russian Espionage Group Static Tundra Targets Legacy Cisco Flaw News 21 August 2025

Russian Espionage Group Static Tundra Targets Legacy Cisco Flaw

2016 : Two Steps Forward, Three Steps Back Editorial 27 December 2016

2016 : Two Steps Forward, Three Steps Back

Destination Boston! The Journey so Far Blog 31 August 2017

Destination Boston! The Journey so Far

FBI Warns of Deepfake Videos Impersonating IC3 Leadership News 21 July 2026

FBI Warns of Deepfake Videos Impersonating IC3 Leadership

What’s Hot on Infosecurity Magazine?

Researcher Publishes CrowdStrike Privilege Escalation Zero Day

BigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials

AI Coding Tools Now a Prime Target for Threat Actors, Google Warns

Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

NCSC Warns Shadow AI Creates New Security Risks

CREST Onboards First Cohort for AI-Enabled Pentesting Accreditation

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

New CREST AI Standards to Deliver AI-Enabled Pentesting Accreditation

NCSC Warns Shadow AI Creates New Security Risks

FBI Probes Possible Breach of 153 Million Driver’s Licenses

Rhysida Publishes Berlin Government Data After €2m Extortion Demand Refused

Understanding Frontier AI Defense: What Cyber and IT Leads Need to Know

Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology

Financial Services Cyber Resilience: Stress Testing Third Parties Before Attackers Do

Same Front Door, New Visitors: Securing Humans and AI Agents at the Browser

Why Resilience‑Focused Cloud Design Is Your Best Defense Against Modern Attacks

How to Manage Enterprise Cyber Resilience in the Age of AI

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Researchers Claim First Fully Agentic Ransomware: JadePuffer

AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?

Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses

How World Cup Password Trends Can Increase Active Directory Risk

New CISA Guide Helps Agencies Adopt SASE For Zero Trust