FBI Launches First Cyber Strategy Focused on Proactive Disruption

The Federal Bureau of Investigation (FBI) has published its first formal Cyber Strategy, marking a strategic pivot towards the proactive disruption of cyber threat actors. The new framework moves the agency beyond traditional investigation and prosecution, focusing instead on actively dismantling the capabilities of adversaries.

The document, released on 9 September 2026, targets both state-sponsored actors and financially motivated cybercriminals. The strategy specifically addresses threats that often operate from jurisdictions that place them beyond the immediate reach of US law enforcement.

A Shift Toward Operational Disruption

The new strategy signals a fundamental change in how the agency measures success. Historically, effectiveness in cybercrime enforcement was often measured by arrests that could take years to achieve. The FBI’s roadmap prioritises operational wins, such as taking adversary infrastructure offline, seizing stolen cryptocurrency, and “burning” attacker access to force adversaries to rebuild their tools.

This shift follows a memorandum signed by President Trump in August, which authorised federal law enforcement to collaborate with private firms to conduct offensive cyber strikes against foreign threat actors targeting the United States.

The Four Pillars of the FBI Cyber Strategy

The agency’s approach is structured around four primary objectives:

• Investigate, Disrupt, and Impose Cost on Cyber Adversaries: The FBI aims to identify threats early and launch operations to dismantle ransomware variants and nation-state intrusion campaigns. The agency will utilise a “best athlete” model, where the most capable entity—determined by authority, access, or technical capability—leads relevant phases of an operation.
• Support Victims: The strategy emphasises rapid recovery through automated indicator-sharing mechanisms and faster intelligence distribution. To protect critical infrastructure, the FBI is expanding its Industrial Control Systems (ICS) Coordinator program, with dedicated personnel assigned to every field office.
• Increase Impact Through Partnerships: The agency intends to deepen ties with international allies and the private sector. Engagement will be driven through specific initiatives, including the CISO Academy, Cyber Executive Summits, and the Leadership in Cyber (LinCY) programme.
• Enhance FBI Cyber Capabilities: The FBI plans to recruit top talent and invest in new technical tools. This includes the deployment of AI-enabled technologies to assist in triaging large datasets, accelerating malware analysis, and mapping adversary infrastructure.

AI Integration and Technical Evolution

A central component of the FBI’s technical roadmap is the integration of artificial intelligence to support attribution and prioritise victim notifications. By using AI to accelerate the analysis of malware and large-scale datasets, the agency seeks to improve its ability to respond to increasingly automated methods used by modern threat actors.

The agency also intends to provide technical and operational training across its entire cyber workforce through its Cyber Education and Training Unit (CETU).