Almost every AI security framework we are applying rests on one misguided assumption: danger scales with size. Compute thresholds, export controls, and tiered evaluation regimes all encode the same intuition, the larger the model, the more we should worry. If this isn’t true, what policy changes are needed?

I recently mapped more than twenty fielded AI systems against two axes: raw offensive capability with safeguards stripped, and residual risk as actually deployed (Fig. 1). They ran from millions to trillions of parameter models, and included munition seekers, gene design models, theatre planning, cyber offense systems, and general-purpose AI models. The picture does not support the above assumption. In fact, the data supports the inverse. Small, specialized models beat bigger general models at offense, but bigger models maybe better at defense.

Figure 1. Security Risk vs Size of Model. Hollow ring: raw offensive capability with safeguards stripped. Filled dot: residual risk as actually deployed. Cyber related positions anchored to CAISI / UK AISI results, July 2026. Data compiled by Alvin W. Graylin.

Each system appears twice: a hollow ring for raw capability with safeguards stripped, a filled dot for residual risk as deployed. The gap between them is the safeguard effect. Read left to right, and the size to threat correlation everyone assumes is simply absent.

Seven assumptions worth rethinking

One: the largest models pose the greatest risk. The high-residual band, where capability and deployed risk are nearly identical. Across six orders of magnitude, no clear trend. In 2022, researchers at Collaborations Pharmaceuticals inverted the scoring function on a commercial drug-discovery model (MegaSyn) of under 100 million parameters and generated more than 40,000 candidate chemical warfare agents (many more lethal than VX) in just six hours on a desktop. Chemprop-class retrosynthesis models, which can find non-controlled precursor routes around scheduled pathways, run at one to ten million parameters. Evo models with single digit billions of parameters can help design novel life forms. News just came out last week that this exact system was able to generate 16 new viruses. All these systems sit well below the axis floor of any parameter-based regime. Compute restrictions do nothing to fix this.

Two: compute thresholds capture the relevant risk. Hackphyr, built on Zephyr-7b-β at 7 billion parameters, performs comparably to GPT-4 on network attack scenarios and runs on a single GPU. Deep Hat V2 ships commercially at 30 billion parameters, is marketed as uncensored for offensive security, and executes inside the customer environment with no external calls. No government evaluation covers it, so that placement rests on vendor claims. Neither would trip a FLOP ceiling.

Three: capability and threat are the same axis. Claude Fable 5 and Claude Mythos 5 share one underlying model. Their capability positions are nearly identical; their deployed risk differs sharply, because Fable's added domain safeguards drop cyber requests back toward Opus 4.8 behavior. The difference comes entirely from the safeguards and distribution controls layered on top. That vertical gap is what governance can act on. Parameter count is not.

Four: open-source models are more dangerous than closed ones. Recent NIST study found that Kimi K3, the strongest PRC open-weight model, only scored 32 percent on ExploitBench against 57 percent for the leading U.S. model, and reached step 17 of a 32-step attack range where U.S. models reached 28.5. On the highest-severity outcome test, arbitrary code execution (ACE), Kimi K3, succeeded on 0 of 41 tasks, while the most capable U.S. models averaged 20. So, we really need to be careful about self-interested parties saying larger open-source models are more dangerous, when it likely has more to do with protecting margins than national security concerns. (see Fig. 2)

UK AISI did recently report that the Kimi K3 model was able to escape its sandbox during testing, but it merely used a misconfiguration in the testing sandbox that left the door open, rather than a sophisticated swarm agent attack like what the OpenAI model did. And when it did get out, all it did was look up the answer for the test it was given, rather than doing any damage to real world systems. In the future, this behavior could change, but it’s important to question the basic assumption that open models are always more dangerous.

Figure 2: CAISI/NIST - Comparison of aggregate capabilities over time of the most capable U.S. and PRC models. A 400-point increase on the y-axis equates to a 10x increase in the odds of solving tasks. Shaded regions denote 95% CIs.

Five: model quality determines attack success. Microsoft's MDASH is a harness, not a model. It orchestrates more than 100 specialized agents across an ensemble and scored 88.4 percent on CyberGym at launch, against 83.1 percent for the Mythos preview model. Adding a compact security model roughly 1/10^th the size raised that to 95.95 percent. The orchestration layer beat every individual model. Regulating training while ignoring scaffolding regulates the less important variable.

Six: national security requires the largest models. It requires the opposite. Loitering munition seekers performing automatic target recognition run on Jetson-class edge hardware, capping them in the single-digit millions of parameters. Edge deployment favors small models on latency, power, thermal envelope, and operation without a datalink. Larger models are slower and, in narrow domains, more easily distracted by irrelevant context. They are also harder to validate, and validation is what matters when a false positive is a struck target. Cisco's Foundation-Sec-8B matches or exceeds models ten times its size on security benchmarks while running on one or two GPUs. The famed DoD Maven Smart System is based on a fine-tuned 2-year-old Claude Sonnet 3.5 model. That level of intelligence can now be distilled into a 4B model which could potentially run on a smartphone.

Seven: denying China compute is the primary lever to keep U.S. safe. Due to shared risks between these superpowers, on many safety related issues, cooperating may actually produce the outcomes most beneficial to the U.S. and the world. More on this below.

Five threat domains, five different answers

Attack and embedded systems favor small models that don’t require a comm link. Air-gapped operation, no API telemetry, no rate limits, no refusals mid-chain. The offensive bottleneck is stealth and throughput, not reasoning.

Cyber Orchestration favors large models, but the advantage attaches more to the system rather than the model, as MDASH shows. There’s little discussion today on regulating orchestration systems, but it’s clearly very needed.

Cyber Defense favors large models most clearly, and this is where the current approach fails. Defenders need breadth across every vector; attackers need depth in one. Safeguards that constrain security research are therefore costly in a way that is easy to miss.

When Hugging Face's systems were breached in July by OpenAI models, commercial frontier-model APIs blocked the forensic requests because their safety systems could not distinguish defensive analysis from attack. The team ran the open-weight Chinese model GLM-5.2 on its own infrastructure instead, worked through more than 17,000 logged actions, and contained the intrusion. An American company under active attack by an American closed-model was defended by a Chinese open-source model because the American ones could not tell friend from foe.

That is a Slave AI failure, in the terms I set out in Beyond Rivalry. A model trained toward obedience can only refuse; it cannot reason about whether refusing is right. What we need is Guardian AI: systems capable and contextually aware enough to protect us from malicious actors, from other AI systems, and from our own unintended consequences. That requires scale, because judgment requires breadth. It also requires that we stop locking down every capability rather than stewarding it. High-quality models with fewer restrictions, in defenders' hands, are a global public good. Every hour a defender spends fighting a guardrail is an hour the attacker fights nothing.

Bio/Chem Design favors small models. Molecular graphs, protein sequences, and binding energies come from compact architectures immune to alignment techniques built for natural language. A graph neural network has no refusal layer to remove. The key here is monitoring and controlling access to precursor chemicals and expanding safeguard for synthesis equipment.

Bio Synthesis is the outlier, and there is good news and bad. For biology, model-level access control has already failed. Evo 2 shipped with weights, inference code, training code, and its full dataset. There is no API to revoke. What remains is the synthesis chokepoint: Customer vetting and sequence screening at nucleic acid providers already operate internationally through the Gene Synthesis Consortium, whose members screen orders against databases of sequences of concern before synthesizing. There are still gaps as novel AI-generated combinations are developed, but they can be reduced if vendors and regulators globally work more closely together to keep the systems updated. Closing those gaps buys more security than any parameter threshold. But this requires Washington and Beijing to align, since they are the two largest suppliers of synthesis equipment in the world. Of course, collaboration across all vendors globally is needed to truly secure this threat vector. Again, larger general AI models aren’t the core problem.

Data beats intelligence

On the opening day of the U.S.-Iran war in February, a Tomahawk missle struck the Shajareh Tayyebeh girls' school in Minab, killing at least 168 people, more than 100 of them children under twelve. The school sat within 100 yards of an IRGC naval installation and had been inside that perimeter until a wall went up around 2013. Targeting ran through the Maven Smart System, which generates roughly 1,000 target packages an hour. A preliminary investigation concluded the strike likely followed from outdated intelligence, and former officials said stale human-curated data, not AI, was to blame.

The school had a website. Free satellite imagery showed a schoolyard with a sports field. No model of any size prevents this, because the failure was in data lineage, not reasoning. A larger model querying the same stale record returns the same coordinates faster and with more confidence.

The China mistake

The threat model that matters is not Beijing reaching AGI first. It is a non-state actor with a 30-billion-parameter uncensored model, a good harness, and no return address. Small models proliferate regardless of jurisdiction and leave no attribution trail, and an unattributable intrusion between nuclear powers is an escalation problem before it is a technology problem. In that world, a China unable to defend its own infrastructure is a liability to global stability, not an advantage to Washington.

Beijing is already regulating its own labs more aggressively than any other market. Concordia AI's 2026 survey documents agentic AI security guidance, ethics review requirements, and binding obligations on consumer AI services that are already deployed and enforced. It should be noted that Chinese frontier safety research output grew roughly 60 percent year over year, with agent safety rising from 8 percent of new papers in early 2025 to 27 percent by early 2026. The caveat: only five of ten leading Chinese developers reported safety evaluation results on release. Shared standards here would make a difference.

As Fig. 2 showed, CAISI found the Chinese models less dangerous, but they also found GLM-5.2 answers sensitive biological queries at far higher rates than tested U.S. models, which is where PRC safeguards are weakest. In personally speaking with multiple Chinese labs, it’s clear that their lack of compute resources due to export controls has forced them to deprioritize safety demands vs. capability enhancement. Expanding safety testing compute resources, like what UK AISI has, to more countries could help improve AI safety globally, without fear of its misuse by rival nations.

The race framing is softening at home, too. More than 100 organizations, including Nvidia, Microsoft, Meta, IBM, Palantir, OpenAI and Google, have now signed the July 24 Open Weights and American AI Leadership letter opposing premature restrictions. Days later, Nvidia and roughly 50 partners launched the Open Secure AI Alliance to build open defensive models and agent harnesses, citing the Hugging Face incident as its founding case. Every participant has commercial exposure to a ban, so weigh the motives. But 8 of the top 10 models on OpenRouter in July are already open-source, and the industry has now reorganized around the proposition that open weights are defensive infrastructure.

Four Asks for September

Four asks follow, and Xi Jinping's state visit to Washington on September 24, the first in over a decade, is where they could land. Trump has said AI will be on the agenda.

Shared harm standards, not shared capability standards. Agreement on what constitutes an unacceptable capability, evaluated the same way in both countries, so that "safe" means the same thing in Shanghai and San Francisco. That’s clearly missing today and doesn’t require mutual trust.

A shared safety evaluation cluster. Chinese labs are compute-constrained, so safety research competes with capability research for scarce chips. Compute earmarked for evaluation and red-teaming is cheap relative to the benefit, and the benefit is global. An international testing facility open to any vendor institutionalizes it. Require publishing safety scores alongside capability benchmarks so safety investment earns a competitive return. Then, both Chinese and US labs would have no excuse not to test their systems.

An incident notification channel. The Nuclear Risk Reduction Centers, staffed continuously since 1987, exist because a misread signal costs more than talking. An equivalent for AI incidents where attribution is contested is cheap insurance. With the rising risk of bad actor attacks and false flag operations from non-state actors, this safeguard will be increasingly needed.

Capability non-development agreements. A capability never trained cannot leak. This matters more than denying Beijing another turn of the scaling crank. Beijing also wants to limit rogue actor misuse, thus agreeing on redlines in advance makes sense for both sides (no nuclear weapon command/control, no AI uplift to bio weapon design, no AI-attack on civilian infrastructure, no autonomous self-replication outside control environments [RSI]). General commercial models have no need for bio and chemical threat design, so keeping defense use case training only in military labs on both sides seems quite reasonable.

Another Asilomar moment

At Asilomar in 1975, molecular biologists imposed a voluntary moratorium on a class of recombinant DNA experiments, then built the containment framework that governed the field for decades. They acted before the capability matured enough to do real harm.

That view is starting to catch on in the AI labs now. On July 28, 1,200+ employees of frontier labs published Pacing the Frontier, asking Washington to support an international effort to build tools for deliberately slowing automated AI development. Signatories include top technical leaders at Anthropic, OpenAI, Meta and Google. The concern is recursive self-improvement (RSI) of AI that goes out of control. The logical extension is an explicit agreement not to implement it in frontier labs even once it becomes possible.

But this cannot stop at two capitals. If dangerous systems are small and cheap, a country with a modest research budget and a few hundred GPUs can build a competent offensive cyber agent or an inverted molecular designer. Within a few years, dozens will. Any regime binding only Washington and Beijing binds the two parties least likely to defect and leaves the growing middle untouched. A U.S.-China agreement is the necessary first move, not the finished structure, and it has to open immediately to third parties. That is how Asilomar's containment norms and the Montreal Protocol scaled.

Bigger AI is not more dangerous. Better orchestrated is more dangerous, less monitored is more dangerous, and irreversibly released is more dangerous. All three require cooperation with Beijing: orchestration needs shared harm standards, monitoring needs shared evaluation infrastructure, and irreversible release needs joint agreement on what never gets built. September 24 is a good place to start.

Read more national security insights from experienced experts exclusively in The Cipher Brief.

More and more people are using AI like a search engine – 42 percent of U.S. adults now use AI chatbots to search for information – and that shift is exposing a structural vulnerability that adversaries are exploiting to seed propaganda. In practical terms, this is a problem of Generative Engine Optimization (GEO) – the deliberate effort to shape digital content so that AI chatbots absorb and repeat it.

The research so far points to data voids — the thinly covered topics where there isn't much credible information to begin with — as the weak spot. This includes breaking news or new material that has not yet had time to accumulate the signals that would flag it as low authority.

AI can process far more information than any human can, but there is an inherent trade-off in outsourcing the curation of information to an AI summary. In the search era, users were exposed to source material and evaluated credibility for themselves. Now AI does that work, and research shows the large majority of AI queries end without a click.

This is both a business concern and a national security concern. The clearest example on the consumer side is Apollo-9. In a Chinese state TV investigation, researchers used a tool called Liqing to flood the web with fake reviews and rankings for Apollo-9, a fitness tracker that did not exist. Within hours, chatbots were recommending the fake fitness tracker and some continued to do so a day after the fraud was exposed. Liqing and other tools are sold openly on Chinese e-commerce platforms like Taobao and JD.com, with pricing ranging from roughly $520 to $4,765 for three-month subscriptions. One provider told Chinese state media it had served more than 200 clients across multiple industries, guaranteeing top-three placement on any AI platform.

In order to better understand these developments and their impact, this article examines how the same mechanism scales from commercial fraud to geopolitical disruption, using the Russia-Ukraine war as a live GEO lab. Leaked documents about Russia’s “Project 2026” and Ukraine’s AI‑enabled counter‑operations show how influence campaigns are evolving from social feeds to the underlying sources that AI systems draw on — an angle largely absent from existing information warfare debates.

Russia and the National Security Case: Same Playbook, Higher Stakes

When Russian operations exploit GEO in their war on Ukraine, they are not just spreading propaganda in the moment; they are trying to become the “ground truth” that AI systems summarize back to users, analysts, journalists, and policymakers. In June 2026, Bloomberg reviewed 73 leaked documents from the Social Design Agency (SDA), a sanctioned Moscow firm at the center of Russia's influence operations, describing a program its operators called “Project 2026:” a network of Wikipedia-style reference sites, media outlets, and fake think tanks built to shape what search engines — and AI systems — treat as reliable sources. The goal, as described in the leaked documents, is to “create an alternative information ecosystem” by shaping not only what people see today but also what AI systems will later “know” about key leaders, the war’s origins, Ukraine’s conduct, NATO’s role, and Western support.

Russia's GEO tactics build on years of search engine optimization (SEO) manipulation and are part of a widely reported pattern of industrialized cognitive warfare that includes deepfakes, cloned sites and other deceptive content. In 2023, a study published in the Harvard Kennedy School Misinformation Review examined pro-Kremlin attempts to manipulate search engine results and found that pseudo‑think tanks and propaganda outlets such as Global Research and Strategic Culture Foundation were amplified through backlink networks and low‑quality sites. These outlets were most effective on conspiratorial searches involving, for instance, Ukraine President Zelensky, where authoritative content was sparse. Indeed, as noted by former CIA leader Jennifer Ewbank, the use of deepfakes to confuse, distort, or influence public opinion not only occurs in Ukraine but across Europe – all of which reflects “the same underlying reality: the tools for deception are faster, cheaper, and more accessible than the systems we rely on to detect or prevent them.” In other words, this is not just about deception, but the erosion of trust itself.

Storm-1516, a documented Russian disinformation operation that has been active since at least 2023, has scaled sharply in 2026. According to Bloomberg, the operation has produced more than 190 false stories since 2023 that the outlet has been able to identify. Based on Bloomberg’s reporting, Meduza adds that in the first quarter of 2026 alone, Storm-1516 was producing fake stories at twice the rate of the same period the previous year with, for instance, as of late March and early April 2026, materials appearing almost daily. Meduza also reports that more than 40 percent of Storm-1516’s fabrications have targeted Ukraine, with another third focused on electoral processes in other countries. Taken together, these reports demonstrate that Storm-1516’s operations are ultimately aimed at eroding Western support for Ukraine, swinging European elections and destabilizing NATO allies.

Taken together with the “Project 2026” leaks, these findings suggest that Russia is now attacking both the content layer (through synthetic media) and the source layer (through cloned Wikipedia‑style sites and fake think tanks) of information ecosystems. While synthetic videos and stories are often treated as short‑term deception, they also become part of the online record that future AI systems may ingest or retrieve, turning Russia’s layered influence architecture into a long‑term GEO problem, especially in data voids.

The Storm-1516 operation follows a clear pattern. A fake witness, often an AI-generated video, seeds a plausible but unverifiable story. Low-tier blogs and Telegram channels amplify it in multiple languages. Then less rigorous Western outlets pick it up, severing the link to the original Russian operator. By the time the narrative reaches mainstream discussion, the Russian fingerprint is gone. The new risk in today’s landscape is that the AI curation layer completes this laundering. It reads the now-repeated narrative across multiple sources and presents it as a neutral summary.

Researchers at the Institute for Strategic Dialogue found that the chatbot DeepSeek was quoting VT Foreign Policy, an outlet known to carry content from Russian propaganda operations such as Storm‑1516 and to have connections to the Kremlin‑linked Strategic Culture Foundation. U.S. and EU sources describe the Strategic Culture Foundation as an arm of Russian state interests.

A 2025 NewsGuard study also found ten of the leading chatbots — including ChatGPT, Claude, Gemini, and Copilot — collectively repeated false narratives from the pro-Kremlin Pravda network about a third of the time. It’s important to note that a 2025 study in the Misinformation Review, responding directly to the NewsGuard findings, found the number was closer to 5 percent and that these failures clustered in data voids. While the researchers found "little evidence to support the grooming theory" and warned against "the overhyped specter of Kremlin manipulation," they acknowledged that data voids "may be artificially created" and that they could not dismiss the possibility that a disinformation campaign could target them. Importantly, their audit came fourteen months before the leaked “Project 2026” documents showed Russia explicitly targeting AI systems. The more Russia attempts to flood these data voids, the more likely it is that future AI summaries about Ukraine will inherit its framing.

How to Build Resilience – A Way Forward

Like its older cousin SEO, GEO is inherently dual-use, but it sits in a regulatory vacuum because it is viewed strictly as a consumer protection issue rather than a national security threat. The Apollo-9 experiment and the Storm-1516 operation prove they are two sides of the same coin; the same commercial tactics that manufactured demand for a non-existent fitness tracker can easily manufacture plausibility for distorted narratives about a geopolitical crisis such as the ongoing Russia-Ukraine war. History shows that with traditional search engines, the market naturally incentivized tech companies to tackle manipulation head-on because mass spam threatened to destroy the user experience for billions of people, directly endangering corporate business models. Malicious foreign influence operations executing GEO are fundamentally different because they remain largely invisible to the mass market, with manipulation surgically clustered within obscure data voids, offering tech companies no commercial incentive to self-police and leaving the information terrain around a live European war effectively undefended.

To bridge this gap, regulators can draw on the lessons of private sector SEO defense and public-private counter-disinformation efforts, but they must realize that the exact same playbook will not work here. While private developers can easily dismiss the Misinformation Review study’s five percent finding as an acceptable commercial error margin, this minor statistical anomaly sits precisely in the data voids that Russia is actively trying to colonize, and so it represents a primary, unmonitored vector for foreign manipulation. The strategic risk is not only that GEO can mislead people in the moment, but that it can reshape the evidentiary record on which institutions and AI systems will later rely; if hostile narratives are allowed to dominate long‑tail topics and thinly documented episodes in the Russia-Ukraine war for instance, then future summaries, briefings, and even historical accounts risk being generated from polluted inputs.

The 2025 Misinformation Review study recommends "warning banners for data void queries" and increased "audit access," but notes the banners are "applied inconsistently" and the audit access is "hindered by power asymmetries.” Because the market will never self-correct a threat it does not financially register, protecting the integrity of generative content must transition from a voluntary corporate practice to a formal national security mandate.

In the Russia-Ukraine war, these dynamics are already visible. Russian operations such as Storm‑1516 use GEO‑style flooding and synthetic witnesses to launder narratives about the conflict into the broader information environment, while Ukrainian actors rely on AI‑enabled monitoring and evidentiary documentation to defend the integrity of the record. The contest is no longer confined to what populations see online today; it is over what AI systems will say is true about the war tomorrow. Recognizing GEO as a national security problem therefore changes the governance question: the training, retrieval, and ranking layers of generative systems are now part of the battlespace, and leaving this space unregulated is akin to leaving critical information infrastructure undefended.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

America’s critical technology, maritime, infrastructure, and advanced manufacturing base is one of the clearest places where tax incentives, private capital, and national security should meet. We already know this model can work. Opportunity Zones helped drive billions of dollars into real estate, community development, and designated investment areas by giving investors a reason to move capital into places that policy makers wanted to support.

Now we should apply that same logic to the sectors that will determine America’s ability to compete, defend itself, and rebuild its industrial strength.

Recent proposals around Maritime Investment Zones point in the right direction. The basic concept is simple: use the tax code to pull private capital into shipyards, ports, vessel construction, ship repair, marine navigation, workforce development, advanced manufacturing, and the broader maritime supply chain. If tax incentives helped attract capital into real estate and community development, a similar model could help rebuild the industrial base that underpins American sea power and national resilience.

But this should not stop with physical shipyards or port infrastructure.

The next generation of American industrial power will be built across a broader ecosystem of investment funds, operating companies, manufacturing platforms, critical infrastructure projects, and technologies that strengthen national security and economic security. That means sectors like autonomy, advanced manufacturing, aerospace, maritime systems, secure communications, cybersecurity, energy resilience, critical minerals, space infrastructure, drones, counter-drone systems, AI-enabled defense tools, logistics, and domestic supply chain resilience.

Qualified investment funds focused on these sectors should be considered for Opportunity Zone-style designation. These funds can aggregate private capital, diligence complex technologies, support hard-tech companies, and bridge the gap between emerging innovation, government demand, commercial scale, and mission relevance. Many individual investors cannot properly underwrite a defense technology company, an advanced manufacturing platform, a shipyard modernization project, or a critical infrastructure asset on their own. Qualified managers can help channel capital into these areas with discipline, experience, and a better understanding of both market risk and mission need.

The same logic should apply directly to qualifying platform companies and infrastructure projects. Businesses building autonomous maritime systems, advanced airframes, resilient logistics platforms, drone manufacturing capacity, shipbuilding technologies, next-generation materials, critical infrastructure tools, and domestic production capabilities should be eligible for special designation if they are strengthening the defense industrial base, expanding U.S. production, modernizing infrastructure, or reducing dependence on adversarial supply chains.

This matters because the future of defense manufacturing and industrial power is changing.

The next phase will not only be about large legacy platforms built through traditional procurement channels. It will also be about faster, lower-cost, more scalable, more autonomous systems that can be produced domestically and integrated across a broader defense technology ecosystem.

In maritime, for example, the future will not only be larger crewed vessels. It will include autonomous naval platforms, distributed maritime nodes, unmanned surface vessels, undersea systems, AI-enabled ISR, electronic warfare, logistics support, secure communications, and integrated sensor networks. The autonomous ship is not just a vessel. It becomes a node in a distributed maritime network.

That same principle applies across the broader industrial base. The future battlefield and the future economy will demand more mass, more resilience, more autonomy, more secure infrastructure, and more ways to complicate an adversary’s targeting problem. The United States cannot afford to rely only on slow, expensive, exquisite systems while adversaries are scaling ships, drones, missiles, cyber tools, industrial capacity, and supply chains at speed.

A Maritime Prosperity Zone, Critical Technology Opportunity Zone, or National Security Investment Zone framework could help solve part of this problem by giving investors, fund sponsors, founders, manufacturers, and infrastructure operators a reason to back the companies, factories, shipyards, platforms, and projects needed to rebuild American industrial strength.

This would likely create some of the same market behavior we saw during the real estate Opportunity Zone boom of the early 2020s. Once the incentive was created, capital moved. Sponsors formed funds. Allocators searched for qualified opportunities. Developers shaped projects around the designation. Billions of dollars followed.

The same could happen in defense technology, critical infrastructure, autonomous systems, maritime manufacturing, space, energy resilience, advanced materials, and critical manufacturing.

That is the power of incentives. Investors are not charities. They respond to opportunity, yield, tax efficiency, liquidity, policy clarity, and the chance for outsized returns. That is not a weakness of capitalism. That is how capital markets work. If policy makers want private capital to help solve national problems, they need to make those problems investable.

Critics will say this gives investors generous tax treatment. That is true. But that is also the point. The government routinely uses the tax code to shape behavior. We incentivize home ownership, retirement savings, energy development, municipal finance, real estate development, and other areas deemed important to the public interest. The question is not whether investors benefit. The question is whether the country benefits enough to justify the incentive.

In this case, the answer should be yes.

A targeted national security investment incentive could drive domestic job growth, create new industries, expand the tax base, strengthen supply chains, rebuild manufacturing capacity, and reduce reliance on government-led solutions. Instead of expecting Washington to fund and manage every critical industrial requirement, the government can use tax policy to unleash private capital and let the private sector help build the capacity the country needs.

That is a better model than simply growing government. Government should identify priorities, set standards, create incentives, and provide clear demand signals. Private capital should help take risk, scale companies, build factories, support founders, finance infrastructure, and commercialize technologies. Done correctly, this becomes a force multiplier. It allows the country to pursue national security and economic security objectives without relying solely on appropriations, grants, subsidies, or bloated federal programs.

It also helps create a broader base of economic growth. A new factory, shipyard, drone production line, secure data center, advanced materials facility, or critical infrastructure project does not just create investor returns. It creates construction jobs, engineering jobs, manufacturing jobs, supplier ecosystems, logistics demand, local tax revenue, and long-term industrial capacity. These are the kinds of investments that can rebuild regional economies while strengthening national resilience.

But there is an important caution.

During the real estate Opportunity Zone boom, disciplined allocators still had to underwrite the real estate first. The asset had to make sense. The location had to make sense. The sponsor had to make sense. The tax advantage was an added benefit, not the entire investment thesis.

The same discipline must apply here.

In the current hype around defense technology and national security investing, not every company with “AI,” “autonomy,” “defense,” “resilience,” or “critical infrastructure” in its pitch deck deserves capital. The manager, deal, technology, platform, or project has to stand on its own. The tax benefit should improve the risk-reward profile, not rescue a weak investment.

Return on mission matters. But it should not replace return on capital. The best version of this policy would align both. Investors get an incentive to take risk in strategically important sectors, while the country gets more domestic production, stronger supply chains, better infrastructure, more jobs, and a deeper industrial base.

The United States does not have a shortage of capital. It has a capital alignment problem. Too much money flows into financial engineering, speculative assets, and incremental technology. Too little flows into the difficult, physical, industrial, and security-related sectors that determine whether the country can compete in a more dangerous world.

Opportunity Zones showed that tax policy can move capital. The next step is to aim that capital at the future of American power.

If we can incentivize capital to rebuild neighborhoods, we can incentivize capital to rebuild shipbuilding, critical infrastructure, advanced manufacturing, and the national security industrial base.

The goal is not to give investors a gift. The goal is to give the country a tool.

The next Opportunity Zone should be built around American resilience.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The future of disinformation is no longer about creating better content. It is about teaching machines what to retrieve, summarize and recommend. In the AI era, the editor matters more than the article.

A story no longer has to trend. It has to be retrieved when a large language model (LLM) constructs the answer. The most important audience in the information environment is no longer human. If an AI assistant becomes the primary gateway to information, influencing what it retrieves becomes more valuable than influencing what millions of people read directly.

The Hugging Face Model Hub, the top repository worldwide, tracks over 2.9 million total machine learning models. Many models are for wonderful uses, ranging from research universities to new private sector companies built to solve problems. Meanwhile, more than 130 active national sovereign initiatives exist in more than 60 countries, according to the Center for a New American Security (CNAS) Sovereign AI Index. Every one of these models becomes another editor with its own worldview, training corpus and retrieval strategy.

As Bob Dylan reminds us, “For the times they are a-changin’”.

Countries are in pursuit of a foundational model (cognitive sovereignty) that will provide its own historical context, experts, values, national interests and more.

Different versions of reality will emerge, not because people disagree, but because different models were taught to retrieve, prioritize and reason differently. Not unlike media outlets as they evolved, just with a completely different scale.

Our Focus

The old world was about content, distribution and amplification. The new world is about training, retrieval and reasoning.

We must have the expertise to explain the mental frameworks machines construct before we see an answer to our query.

Our slide decks will cross out the “attention economy” and replace it with the “cognitive economy.”

We will remind ourselves that during the social media era, an adversary would flood the zone with thousands of fake articles and accounts to amplify a narrative. In the AI era, the objective changes. Rather than convincing one person at a time, adversaries will increasingly seek to influence the system that answers everyone.

Perspective is also important. Printing presses made publishing a reality. Radio introduced the broadcast message. Television opened up reach to mass audiences. Social media democratized who could have a voice. And AI now changes who decides what we receive.

Our Preparation

We will need to expand our remit and add expertise in training data provenance, retrieval indexes, embedding systems, model guardrails, agent memory, citation chains and reasoning architectures. AI engineers will become important parts of our team, if not already so.

The decade ahead will introduce AI models and agentic systems that decide what billions of people see. Agents will continuously search, compare, negotiate, monitor and decide for us. Humans may never initiate the request, but the agent will know what to do. That’s a different information ecosystem. We must learn how to track its development accurately and efficiently, so we are in-step or a step ahead on each new innovation of importance.

AI models will cite other AI models who cite other AI models. Over time, the original source may disappear entirely behind layers of machine summarization. The citation survives, but the human reporting becomes increasingly distant.

The editorial model will change as quickly as it needs to. How do we keep up with changes in the perspective of a model on a key topic and why it occurred?

Bad actors will optimize less for search engine optimization (SEO) and increasingly for generative engine optimization (GEO), engineering content specifically to influence what AI systems retrieve and cite.

We will need a new intelligence platform that tracks all publicly accessible LLMs and all innovation in places like Hugging Face, so we can see patterns earlier across the world. Imagine tracking hundreds and then thousands of LLMs in real-time. We still care about what happened, who said it and the rest of the 5Ws, but increasingly, it will be meaningful to know how Claude, Gemini, ChatGPT, DeepSeek and other models summarize and frame key messages.

These platforms will help us as we develop skills to understand training data integrity, how retrieval systems are poisoned through Retrieval-Augmented Generation (RAG) attacks, and how agent memories are manipulated.

Invisible Persuasion

When the audience is the machine, our efforts shift from how to protect the population to how we analyze and influence the infrastructure that reaches us.

Media literacy taught us to evaluate what people published. Machine literacy teaches us how to evaluate how machines constructed the answer.

The era will have many names, I’m sure, but one that resonates with me is “invisible persuasion.”

Unlike propaganda, machine-led information thrives on invisibility. It must appear ordinary, mundane and just do its job.

The next generation of AI will continue to quietly remove the human being from both ends of the media system. It is becoming the audience, and it is becoming the editor. And it is doing both at once.

It is also succeeding in building trust in humans.

SparkToro and Datos Group found that 60% of US google searches ended without a click in the first four months of 2026.

The same person who once clicked through to read is increasingly staying put while a machine goes and reads for them. The Reuters Institute expects search referrals to nearly halve over the next three years.

A Pew Research Center report showed that users clicked a source cited inside an AI summary just 1% of the time (900 US adults, 68,879 google searches).

Trust is migrating from the publisher to the summarizer. Our learning used to include more friction – a competing headline or comments we disagreed with. Now, we get a clean answer without friction.

How this impacts our judgement is a question we’ll study for many years ahead.

Conclusion

The printing press democratized publishing. Search democratized discovery. AI is centralizing editorial judgement again, this time inside machines.

The new editors are not confined to newsrooms. They include model developers deciding guardrails, publishers licensing training data, platform owners determining retrieval rankings, governments building sovereign AI models, open-source communities releasing foundation models, and enterprises curating the knowledge bases their AI agents consult. Editorial power is becoming distributed across the AI stack rather than concentrated in traditional media organizations.

The organizations that understand how machines learn, retrieve, reason and remember will shape the next information environment.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Editor’s note- Russia's war in Ukraine has fundamentally changed the character of warfare, proving that autonomous and attritable drones are no longer supporting tools but have become a decisive instrument of combat. In this provocative essay, co-authors Xen & Matthew Creedican argue that the United States must abandon legacy assumptions and adopt an entirely new military doctrine, force structure, and industrial strategy built for the age of autonomous warfare. (Xen is a former US Special Operations veteran with experience fighting alongside Ukrainian forces. We have granted his request for anonymity).

This paper is written expressly for the policy and decision makers across the military and public and private sectors who are bound to translate national strategy into reality. We will withhold for another day the arguments for convincing those who have yet to concede that the rifleman’s day is over or that drone warfare in Ukraine generalizes. Instead, we are making a series of recommendations to those already on board with direction from the Department of War (DoW) that “we are pivoting the Pentagon and industrial base to a wartime footing”, as manifested in a $50B+ modernization program to ensure that “every warfighter must have access to low-cost/attritable sUAS [small drones] to conduct missions.” To help leaders meet such a steep challenge, we will describe how the force should be structured, how doctrine should be written, and how the industrial base must be re-engineered to match present scaling by our adversaries.

What a Modern Drone Force Should Look Like, For Now

If we could snap our fingers now and summon an army well-trained and well-equipped according to the latest understanding of modern drone warfare, it might be composed of battalions fielding approximately fifty to a hundred mixed-role unmanned systems deployable simultaneously, with stocks of thousands more unmanned vehicles and spare parts (antennas, ground stations) ready to replace those attrited. The force tailoring would have to include both rotary and fixed-wing drones performing reconnaissance, mothership, electronic warfare, one-way attack (OWA), bomber, and multi-role tasks. Such a battalion should be able to organically find, fix, and finish targets at ranges up to 300km.

Presently in Ukraine, formations tend to specialize by range. Tactical or “infantry” battalions deploy quadcopters controlled by direct radio link or fiber optic from positions 3-10km from the absolute front, flirting with the danger zone, with the better teams now fielding glide-kit quads reaching out to 50+km, doubling their effective range from last year. Ground drone units are increasingly critical as well, performing the vast majority of evacuation and logistics within the 9-15km+ “gray zone” where manned vehicles are not worth the risk to employ. Dedicated drone battalions overwatch these units from 10-20km from no man’s land, operating typically out to 80km but at times out to 300km thanks to proliferating autonomy and redundant communications (direct, meshing, repeating, satellite, LTE, etc.). This upper end for the “mid-range” or “operational” level of warfare has also at least doubled since last year. Finally, specialized deep strike teams are now conducting strikes out to beyond 1500km against strategic targets, with high-volume, low-cost, independent, adaptable platforms quite different from expensive legacy US drones.

At every level of the above structure, it is understood that even the non-OWA platforms must be attritable, since they rarely accomplish more than several missions without being rendered inoperable. Particularly cheap systems are even deliberately used as decoys. And of course, seeping down into these echelons is autonomy enabled by AI, and the beginnings of swarming protocols. It must be understood that what the aircraft carrier once did to naval gunnery is what the drone is doing to the rifleman. The fundamental unit of combat power is now the small drone team, and it is an over-the-horizon asset.

Saving Combined Arms Maneuver

Drones employed properly in such formations could execute combined arms maneuver warfare rather than the attrition warfare we currently see. After reconnoitering the enemy and making contact, unmanned battalions could use air platforms in both expendable and regenerative loitering waves to degrade air defenses, electronic warfare systems, logistics, and command structures, after which successive waves could suppress and attrite ground forces in preparation for ground drones to take, hold, and shape ground. Only then would humans move forward to effectively deepen the range of their systems. All this implies an in-depth rewriting and reapplication to unmanned warfare of manuals and doctrine guides such as FM 3-0 Operations, FM 3-90 Tactics, and FM 3-96 Brigade Combat Team. Current revisions have relegated the drone to a supporting role at best. Another example: given that a legacy US Army Corps of tens of thousands of personnel has multiple days to make decisions across approximately the same operational striking depth as that of one of the aforementioned Ukrainian drone battalions of a few hundred personnel, clearly we must revise our echeloned depths of responsibility . The existing disparity has practical consequences, as Ukrainians not only handily defeat NATO forces in joint exercises, but they do it with comparatively tiny forces, striking larger formations and assets in areas thought to be “safe”.

As such, it should be clear to those familiar with the actual contestants in programs like Drone Dominance that we are staging to mostly procure platforms that are too expensive for the requested operational ranges. Although the DoW has set a target of roughly half a million drones per year for procurement, it will actually need at least fifty million to meet the lofty goal of training and equipping a ~500,000-1,000,000 man force with attritable systems. If we look to the rest of the world, we will see that Ukraine and Russia this year are each likely to utilize around twenty million drones, while China, as the manufacturer of most of the world’s drone components, will likely build the equivalent of a hundred million drones.

Predictive Doctrine for a Moving Target

But even this, unfortunately, is not the real crux of the issue with respect to the development of future requirements. Doctrine must not only be prescriptive of the present, but also of the near future. The fact is, we cannot just snap our fingers to summon a drone army. It will take years to build it out, and by then things will look even more “sci-fi”. That is, we are chasing a moving target three to ten years out, and so we had best engage in some imagination to meet that challenge.

We are conscious of how radical this is going to sound, but our goal with such provocation is indeed to shift the Overton window, so, we believe that the future will look like something out of Ender’s Game, and it’s going to happen well before those now entering the military reach retirement eligibility.

Man, Train, and Equip for the Sci-Fi Near Future

Individual drone controllers will become tactical commanders (so let’s call them “tacticians”) remotely running squadrons of individually autonomous drones, point-and-clicking their way through a 3D interactive, AI-mediated, sensor-fusion digital twin of the battlefield. The base layer is already here in the digital panopticon emerging from cloud-native Common Operating Picture (COP) software like Ukraine’s Delta merging with military AI suites. Palantir’s Maven already suggests courses of action at the command level, and there’s no reason this couldn’t be extended down to the lowest tactical levels, controllable by voice, touch, or text. In a few more years the tacticians themselves will be inside something Neuralink-shaped, performing at the speed of AI-enhanced thought and striking at the links in the chain that enable adversarial tacticians. Under those conditions the adaptation cycle, too, will move at a speed that cognitively unenhanced humans cannot keep up with, and intelligence becomes the runaway comparative advantage at every level. There is no telling where such cognitive selection pressure combined with the ability to remotely control drone swarms will end. Will individual soldiers control dozens of drones simultaneously – or thousands? How many drones should a “battalion” have?

Decentralization is a factor too. Everything we are seeing develop now is scaling in Ukraine down to the individual operator, as it must. The over-the-horizon warrior needs personal access to livestreamed tactical radar to check if the skies are clear before he exposes himself by making movement. He needs edge compute not just onboard his drones, but for local offline AI to analyze the battlefield and make decisions even in a communications blackout. Already we see backpack portable drone interceptor systems for personal defense; I’m aware of contracts under consideration for such systems to miniaturize to automated shoulder-launch, like a personal version of the tank-mounted Trophy system. The current estimate is that a soldier has one to four seconds to defend himself against a visual drone contact vectoring on him, and soon that timeline will compress enough to exceed human reaction times.

Asking what exactly the mass of conventional soldiers will do under such a radical restructuring is much like asking whether or not Large Language Models (LLMs) are going to have the net effect of creating or destroying jobs in the civilian workforce. We may see the formation of a tiny military class, or perhaps warfare will become even more industrial in human scale. Certainly, humans will be pushed farther and farther back in the logistical chain that ultimately delivers kinetic effects upon an adversary. Currently, there is a need for people to physically emplace, operate, and recover antennas, ground stations, and drones. Once robots are more commonly executing these tasks (already, some aerial drones are launched via multi-domain mothership drones), people will work on those robots, and so forth. Eventually, it’s hard to see what anyone will need to do physically, as robots will be building, repairing, improving, and employing each other. The only real foreseeable tasks left at the tactical echelon will be those of the tactician and the true engineer, who innovates and integrates locally. Whoever best automates tasks end-to-end will win the tempo fight. The transportation of weapons and sensors has to be contemplated as one mass-manufactured logistical animal.

Going further, the tactician need not position himself relative to any front at all, because he can fly remotely and because he would be sensible to reduce his threat profile from direct action threats to intelligence-driven threats only. That is, he should position himself to strike with impunity. Already in Ukraine, Sting pilots have flown their interceptors remotely 500km away from where they were launched. Midrange teams outside the gray zone already drive to position in unmarked civilian vehicles, wear their uniforms only for the minimal time needed to deploy their systems, and then fade back into the population. And the naval drones striking the Russian fleet are not generally controlled from the sea, but ultimately from bases on land. If trends hold, the smallest independent tactical elements may be able to cheaply strike anywhere on Earth within a decade.

Branching Futures: eVTOLs, Smart Dust, and Beyond

But this is merely one vision of the future. There are branching pathways, perhaps some of which may coexist. Weaponized human-optional eVTOLs like the Chinese prototype ZR-300 could become a new air cavalry paradigm unto themselves if employed en masse in shock fashion, sweeping aside whole nations in a day the way Central Asian hordes did in the Medieval period, or the way Islamist insurgents swept across the Sahel in Toyotas. Microscopic drone “clouds” also known as smart dust could penetrate any conventional barrier, performing reconnaissance or even coalescing explosively or penetrating air ducts and lungs. Does this seem one step too far, straining credulity? Remember that “any sufficiently advanced technology is indistinguishable from magic” from the perspective of the old guard, and that all these technologies are already real, just not fully scaled and integrated. In fact, micro drones were feasible decades ago, technically if not economically – timing is everything. We already have a leading indicator in the German army’s very real purchase of cyborg insect swarms from Swarm Biotactics. Against such dizzying possibilities, we will advocate further on below for a rapidly adapting structure that ingrains real-world feedback and extrapolates from it.

Economies of Scale for Drone Production

First, let’s deal with how we produce enough useful drones to simply match our adversaries. The necessary industrial base to deliver manufacturing on the required scale simply does not exist anywhere in the West currently, whereas China has quietly captured the drone market and the sub-component supply chains over decades and is integrating such technology down to their lowest tactical echelons at a hundred times our volume. Much has already been written about the need to innovate and iterate on a scale of weeks rather than decades, and while true such a need potentially comes with the steep requirement of continuous retooling of factories and endless R&D. Ironically, funding this effort at the scale needed will require a vision across a much longer (generational) timeline, in opposition to the quarterly results that drive Western business strategy. Currently, the US buys primarily the end-product rather than engendering the component markets directly. From a cost-savings standpoint, we would do well to preemptively build adaptable systems, and also to stop trying to update legacy programs (we will never need a new sniper rifle). The DoW budget has to fund the domestic mass production of production itself, with an eye towards dual-use sub-components and machine tools, since commercial R&D and production can fund itself to an extent. Vehicles, phones, and drones sold into civilian markets pay for their own scaled production, and volume buys down cost. As it stands now with our current component outsourcing, we are paying our enemies to equip us, tying the rope with which they intend to hang us.

Pillars of a Sovereign Drone Industry

The pillars of industry to be funded include locomotion, actuation, energy, storage, compute, sensing, and communications. The component-level specifics, meaning motor sizes, magnet chemistries, cell formats, and the rest, belong in a technical paper. What’s important here is that the government has to guarantee the market for base components as much as scale requirements dictate and raw materials allow, while simultaneously finding the alternatives that bypass adversarial chains entirely.

Shallow or single-sourced chains halt on the first disruption, so volume has to be distributed across multiple domestic entities in order to create redundant paths. That means accounting for the physical bottleneck of factory siting, the legal bottleneck of restrictive radio frequency and flight-test regimes, and the social bottleneck of technical workforce recruitment, which in practice means a nationwide push for engineers with the education pipelines to match. We should fixate less on the static stockpile and more on the velocity at which the economy can replace a lost or outdated asset. Eventually, this may look like self-assembling factories, but for now we should see a dramatic increase in industrial jobs, not a reduction.

Guaranteed Requirements and Manufacturer Caps

The Departments of War and Commerce must jointly establish requirements and guarantee purchase of components at massive volumes, over multi-year timescales, according to stringent standards for minimum viable products meeting or exceeding foreign equivalents, with caps set on what portion of the total any one manufacturer can source. Subcontracting and manufacturer caps will encourage competition inside our own secure ecosystem rather than across national borders, where we are frequently undercut by adversaries. As needed, the government can resell unused inventory back to industry at or below the cost of subsidized foreign imports, letting American companies build with cheap secure inputs.

We have a realistic precedent for all this, as described in the book Freedom’s Forge: In anticipation of US entry into WW2, President Roosevelt brought together former of heads of industry in order to align military requirements, government funding, and civilian production capacity so that goals could be revised upward continuously, and the resulting volume forced a dynamic of subcontracting to keep up with demand. American industry responded, not only producing hundreds of thousands of complex war machines, but also rapidly retrofitting them as needed based on frontline feedback, on much the same timescales that we today see in Ukraine.

Innovation on the Machine Timescale

In the near future, however, we will have to go even further, with innovation necessarily occurring on the machine timescale. The same digital twin in which soldiers will virtually train and fight will also let us simulate hardware, factories, and logistics before steel is ever cut. The panopticon in which the end product’s edge sensors feed data into will be the same in which an arbitrary number of tests under variable conditions may be run before the more refined next generation of product is built. Supply chains from base-component assembly through fuel and battery pathways can be estimated and stressed the same way. Data streams from around the globe and from local instrumentation can all compartmentalize or cohere as needed for efficiency or breadth of understanding, all of it parseable by ever-increasing machine intelligence, at worst bounded in growth only by Moore’s Law. As an aside regarding encouraging a martial culture amongst the youth who will one day fill the tactician ranks, our military should release realtime strategy wargames involving drone swarming, initially as standalone games but eventually living inside the kind of digital twin explained above. And as earlier mentioned, all of this will eventually be experienced in breathtaking detail in virtual reality and via brain-machine interface. This is not so distasteful a task on a wartime footing, especially considering even in peacetime the military has released first-person shooter games and simulations.

Massive integrated training areas, in which units, contractors, and manufacturers co-locate to live-fire and iterate together, belong on the near-term build list. The mandate inside such an area should be inverted from current practice, so that the burden shifts from justifying permission for a given action to justifying why any given action cannot happen. The FAA, the FCC, and the rest of the regulatory apparatus should be effectively kicked out of the perimeter, and legislation should extend a good-faith liability shield covering crashes and honest mistakes. Dedicated integration units, which can be thought of as Transition in Contact supercharged, should be created. The core skill of these new units would not be warfighting but rather adapting to and assembling whatever technology is available. Every unit, not just dedicated ones, should additionally have at least some innovation budget and personnel, so that they are not merely customers but also integrators. Specifically, this means the military needs to be mass recruiting engineers to fill out dedicated innovation units and also sprinkle across the wider force. And lastly, the soldiers who will become the drone tacticians must be allowed to train for that role full-time, studying meteorology, radio theory, and other topics and skills currently regarded as arcane among warfighters.

A Permanent Feedback Loop from the Front

None of the above works without a permanent structured feedback loop that connects requirements to what is actually happening in a live conflict. Local units cannot generate requirements for now let alone five years out if there is no frontline feedback, no rotating instructor cycle, and no living link to platforms that do not yet exist in Western inventories. A peacetime force generating peacetime requirements will buy peacetime equipment no matter how decentralized the process is. Instead, we need a much greater scale of personnel who are aggressively forward deployed to conflict zones, visiting tactical operations centers and doing ridealongs on relatively low-risk mid- and deep-strike operations. Our partners will gladly place them there if they provide as much as they take. Directly in this role we can put our incredible all-volunteer special operators, who want nothing more than to get close to the fire. Adjacent to it, in lower intensity areas, we can forward deploy conventional troops as well to learn from partners, including by attending their own schoolhouses.

What we are suggesting here is deploying thousands of troops, not merely small cells of elite military and intelligence agency operators whose reporting does not reach the wider military. Much like the technical innovation measures described in the previous paragraph, these warriors should be distributed both into new dedicated units for the express purpose of doctrine, tactics, techniques, and procedures innovation, as well as across the wider force, to supercharge change and acquire what Clausewitz called a “fingertip feel” for the present state of war. If there is really no political appetite for this, then the only other option is to accomplish the same via other methods, such as by inviting large numbers of military instructors from partner nations currently involved in active conflict or by rotating civilian contractors more discreetly through conflict areas, as suggested by former Green Beret Bryan Pickens.

Piping Frontline Signal Directly to Doctrine Writers

Regardless of how it is done, the core part of whatever structure is created should report directly to the senior military leadership responsible for the development of force-wide doctrine and requirements, so that they cannot ignore reality and hide in dead paradigms. Various new offices are being created, such as DRPM-UxS, and our hope is that with direct signal they can utilize sweeping - even disruptive - authorities to continually remake the military; for, as Napoleon said, “unhappy the general who comes on the field of battle with a system”. Given the enemy’s endless adaptation, the best meta-doctrine is to accept no particular doctrine as certain or permanent, and even to assume that it is likely wrong if it has not been overhauled lately. Official doctrine documents would be better written and accessed as living Google docs rather than year-dated static PDFs.

This applies down to the nitty-gritty of institutional knowledge as well. The train-the-trainer model informed by forward-deployed reporting must fuel change in our own programs of instruction and battle drills, so that we actually know how to employ the unmanned weapon systems we are scaling, a capability which further feeds into local units understanding the requirements for the next round of equipment purchases.

A sharedrive with compartmentalized access is not enough; we need our whole force separated at most by just one degree from someone who has seen modern war up close. And if the military is that close to the combat demand signal, then by extension the manufacturers who visit the units they are equipping will be that much closer.

The Transition Engine and Treating Ukraine as a Peer

Joseph Gagnard of Atlas Special Projects calls the sum total of all these joint efforts the “transition engine”, meaning operators, builders, contracting specialists, and investors institutionalized together, because no single one of them fields capability alone. That transition engine has to be paired with a treatment of Ukraine that most of the current western defense industry still resists. Treat the Ukrainians peer to peer, at least as well as Taiwan or South Korea, and better than either, because they are in an existential fight we cannot afford for them to lose. I suggest bringing thousands of Ukrainian engineers, managers, and operators into the United States to help build the drone industry. Regarding AI, America holds the architecture, the compute capacity, the models, and the global reach. But Ukraine holds the live-fire scaffolding for how that data actually gets generated, labeled, fused, and fed back into the iteration cycle; they have the premier Common Operating Picture software, Delta, to facilitate collection; and they are best positioned to evaluate the battlefield effectiveness of each successive generation of combat AI.

Furthermore, Ukraine is waging a global hybrid war on the West’s behalf, which we hardly engage in except via the most deniable means. China, Russia, and their proxies and allies ruthlessly exploit neutral ground with a vast array of tools, strangling us of resources, allies, and positioning. As political will allows, we suggest unleashing our special operators and intelligence officers in nearly-overt ways, in partnership with Ukrainians, who willingly perform more risky action and have a history of cooperation with our intel services, to operate across the globe responding in kind to the Axis arrayed against us. Drones, of course, are the perfect semi-deniable weapon for this. And the signal we receive back by more heavily involving our forces in low-intensity conflicts will feed back into the plan regarding getting a “fingertip feel” back for war.

The Vulnerable Homefront

The homefront, meanwhile, is ripe for a crippling preemptive strike against us. Our infrastructure is vulnerable, and drones as stated are a perfect scalable weapon that can be employed by deniable proxies. A strike could produce economically disastrous effects, and in response to such an attack of ostensibly deniable origin and limited death toll we would certainly not seek to launch, say, a nuclear retaliatory strike. Containerized long-range drones could be lurking on civilian ships off our coast right now. DHS testified to the Senate that in 2025 there were an average of 10,000 foreign drone flights per month near the southern border. Particularly at risk to such a looming threat is our AI infrastructure. Whatever one’s thoughts on the supposed “AI bubble” (the dot-com bubble didn’t stop the triumphant march of internet adoption, did it?), it is undeniable that both the previous and current administrations have regarded the AI race as existential, and our enemies clearly feel the same way.

We saw from a recent strike by Iran on data centers in the UAE providing Amazon Web Services that such centers are vulnerable, going down for several months at a minimum due to spreading fires and long lead time for repair parts. A few hundred drones striking data centers or upstream links in the chain could easily set us back in the AI race which could provide our adversary an opportunity to surge permanently ahead, a situation which, again, our bipartisan leadership regards as an existential threat.

A Decentralized, Always-On CONUS Defense

The right posture for CONUS defense is one that is always on and autonomous-capable, able to intercept without waiting for the chain of command. In addition, such efforts must take the form of a whole-nation decentralized effort. In Ukraine, a nationwide cheap network of mobile phones acoustically tracks hostile long-range drones swarming their country, and recent legislation approved the use of electronic warfare and interceptor drones by businesses to protect their own assets. New manufacturing and power facilities tend to be built in a distributed, resilient, redundant manner, with cheap hardening available for obvious targets (like anti-drone “cages”). Our recommendation, like elsewhere, is to empower everything local. We would even go so far as to suggest that the Second Amendment needs to extend to counter-drone equipment, and any U.S. person or institution should be able to engage perceived threats up to certain altitudes above their own land.

AI as Sovereign Terrain

We can extend the Second Amendment and drones argument to the First Amendment and AI; that is, to digital and not just physical terrain. Across the information domain, China steals from us and undercuts us, releasing open LLMs to erase Western software margins. Intellectual property in this context is a burden more than a benefit by now, perhaps functioning somewhat to promote internal competition but leaving us wide open for external exploitation. The best way to stay ahead of our enemy in the face of their undermining of our brittle centralized systems is to fight fire with fire. We need policy and funding to shy away from the current big LLM players and instead encourage open models, local compute, and data sovereignty, which offer numerous long-term advantages across the board that mirror the kind of resiliency and initiative-encouraging effects we will get by distributing compute and AI models down to the lowest levels of our military.

Encryption code, for example, was previously ruled to fall under free speech protections. There is an argument against allowing centralizing and censorship of digital spaces as well, regarding them as a kind of common space since there is a barrier to entry in networking at the level of Internet Service Provider infrastructure. We need a diverse market of competing open AI models, local compute, social networks, etc. A centralized internet and centralized AI have severe risks within the domains of psychological and information warfare, which play out across the public digital arena, but to go further in that discussion we would have to depart from the scope of the kinetic warfare focus of this article. Suffice to say, the most dystopian and existentially risky outcomes are plausible if centralized AI should win, whether by our own hand or the hand of the enemy, who will surely centralize control over their models as soon as they gain an advantage.

Deterrence via Force Projection

Another point worth addressing when discussing CONUS defense is the idea that “the bomber always gets through”, which is probably true regarding drone swarms. However, regarding the homefront, Ukraine has shown first that the effects of long-range drone attacks can at least be mitigated significantly, and that it is economically optimal to do so. Furthermore, the striking arm we are also building alongside the defenses will serve as a deterrent, since nuclear doctrine of Mutually Assured Destruction is insufficient for the aforementioned reasons. If we can threaten to do unto our enemies as they wish to do unto us, and indeed if we actually regularly exercise this capacity in the global low-intensity ongoing war, then we will make them think twice before hitting us.

The Core Principle: Endless Distributed Adaptation Capacity

The single principle of this piece is this- Stop buying end products and start buying the ability to produce them, at scale, sovereignly, and forever – doctrine here being one of those end products. The victor that emerges from the next several years will have built the meaningfully decentralized version of what we have described here, meaning distributed compute, sensors, swarms, command, cognition, industry, and authority, with the standards and alliances to match. The rallying cry, in the end, is the architecture. In the last great war, we firebombed cities, preemptively invaded neutral countries, and of course ultimately resorted to nuclear weapons. The political license for a national revitalization as a form of deterrence seems, by comparison, an easy pill to swallow.

Note from author (Xen)- For those who wish to understand not merely the how but the why, or who have comments, or who desire greater breadth or depth of understanding: Over the coming weeks I will be sharing additional information to my personal Substack and website. As for my co-author, Matthew A. Creedican, you can find him on LinkedIn.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Editor’s note- Russia's war in Ukraine has fundamentally changed the character of warfare, proving that autonomous and attritable drones are no longer supporting tools but have become a decisive instrument of combat. In this provocative essay, co-authors Xen & Matthew Creedican argue that the United States must abandon legacy assumptions and adopt an entirely new military doctrine, force structure, and industrial strategy built for the age of autonomous warfare. (Xen is a former US Special Operations veteran with experience fighting alongside Ukrainian forces. We have granted his request for anonymity).

This paper is written expressly for the policy and decision makers across the military and public and private sectors who are bound to translate national strategy into reality. We will withhold for another day the arguments for convincing those who have yet to concede that the rifleman’s day is over or that drone warfare in Ukraine generalizes. Instead, we are making a series of recommendations to those already on board with direction from the Department of War (DoW) that “we are pivoting the Pentagon and industrial base to a wartime footing”, as manifested in a $50B+ modernization program to ensure that “every warfighter must have access to low-cost/attritable sUAS [small drones] to conduct missions.” To help leaders meet such a steep challenge, we will describe how the force should be structured, how doctrine should be written, and how the industrial base must be re-engineered to match present scaling by our adversaries.

What a Modern Drone Force Should Look Like, For Now

If we could snap our fingers now and summon an army well-trained and well-equipped according to the latest understanding of modern drone warfare, it might be composed of battalions fielding approximately fifty to a hundred mixed-role unmanned systems deployable simultaneously, with stocks of thousands more unmanned vehicles and spare parts (antennas, ground stations) ready to replace those attrited. The force tailoring would have to include both rotary and fixed-wing drones performing reconnaissance, mothership, electronic warfare, one-way attack (OWA), bomber, and multi-role tasks. Such a battalion should be able to organically find, fix, and finish targets at ranges up to 300km.

Presently in Ukraine, formations tend to specialize by range. Tactical or “infantry” battalions deploy quadcopters controlled by direct radio link or fiber optic from positions 3-10km from the absolute front, flirting with the danger zone, with the better teams now fielding glide-kit quads reaching out to 50+km, doubling their effective range from last year. Ground drone units are increasingly critical as well, performing the vast majority of evacuation and logistics within the 9-15km+ “gray zone” where manned vehicles are not worth the risk to employ. Dedicated drone battalions overwatch these units from 10-20km from no man’s land, operating typically out to 80km but at times out to 300km thanks to proliferating autonomy and redundant communications (direct, meshing, repeating, satellite, LTE, etc.). This upper end for the “mid-range” or “operational” level of warfare has also at least doubled since last year. Finally, specialized deep strike teams are now conducting strikes out to beyond 1500km against strategic targets, with high-volume, low-cost, independent, adaptable platforms quite different from expensive legacy US drones.

At every level of the above structure, it is understood that even the non-OWA platforms must be attritable, since they rarely accomplish more than several missions without being rendered inoperable. Particularly cheap systems are even deliberately used as decoys. And of course, seeping down into these echelons is autonomy enabled by AI, and the beginnings of swarming protocols. It must be understood that what the aircraft carrier once did to naval gunnery is what the drone is doing to the rifleman. The fundamental unit of combat power is now the small drone team, and it is an over-the-horizon asset.

Saving Combined Arms Maneuver

Drones employed properly in such formations could execute combined arms maneuver warfare rather than the attrition warfare we currently see. After reconnoitering the enemy and making contact, unmanned battalions could use air platforms in both expendable and regenerative loitering waves to degrade air defenses, electronic warfare systems, logistics, and command structures, after which successive waves could suppress and attrite ground forces in preparation for ground drones to take, hold, and shape ground. Only then would humans move forward to effectively deepen the range of their systems. All this implies an in-depth rewriting and reapplication to unmanned warfare of manuals and doctrine guides such as FM 3-0 Operations, FM 3-90 Tactics, and FM 3-96 Brigade Combat Team. Current revisions have relegated the drone to a supporting role at best. Another example: given that a legacy US Army Corps of tens of thousands of personnel has multiple days to make decisions across approximately the same operational striking depth as that of one of the aforementioned Ukrainian drone battalions of a few hundred personnel, clearly we must revise our echeloned depths of responsibility . The existing disparity has practical consequences, as Ukrainians not only handily defeat NATO forces in joint exercises, but they do it with comparatively tiny forces, striking larger formations and assets in areas thought to be “safe”.

As such, it should be clear to those familiar with the actual contestants in programs like Drone Dominance that we are staging to mostly procure platforms that are too expensive for the requested operational ranges. Although the DoW has set a target of roughly half a million drones per year for procurement, it will actually need at least fifty million to meet the lofty goal of training and equipping a ~500,000-1,000,000 man force with attritable systems. If we look to the rest of the world, we will see that Ukraine and Russia this year are each likely to utilize around twenty million drones, while China, as the manufacturer of most of the world’s drone components, will likely build the equivalent of a hundred million drones.

Predictive Doctrine for a Moving Target

But even this, unfortunately, is not the real crux of the issue with respect to the development of future requirements. Doctrine must not only be prescriptive of the present, but also of the near future. The fact is, we cannot just snap our fingers to summon a drone army. It will take years to build it out, and by then things will look even more “sci-fi”. That is, we are chasing a moving target three to ten years out, and so we had best engage in some imagination to meet that challenge.

We are conscious of how radical this is going to sound, but our goal with such provocation is indeed to shift the Overton window, so, we believe that the future will look like something out of Ender’s Game, and it’s going to happen well before those now entering the military reach retirement eligibility.

Man, Train, and Equip for the Sci-Fi Near Future

Individual drone controllers will become tactical commanders (so let’s call them “tacticians”) remotely running squadrons of individually autonomous drones, point-and-clicking their way through a 3D interactive, AI-mediated, sensor-fusion digital twin of the battlefield. The base layer is already here in the digital panopticon emerging from cloud-native Common Operating Picture (COP) software like Ukraine’s Delta merging with military AI suites. Palantir’s Maven already suggests courses of action at the command level, and there’s no reason this couldn’t be extended down to the lowest tactical levels, controllable by voice, touch, or text. In a few more years the tacticians themselves will be inside something Neuralink-shaped, performing at the speed of AI-enhanced thought and striking at the links in the chain that enable adversarial tacticians. Under those conditions the adaptation cycle, too, will move at a speed that cognitively unenhanced humans cannot keep up with, and intelligence becomes the runaway comparative advantage at every level. There is no telling where such cognitive selection pressure combined with the ability to remotely control drone swarms will end. Will individual soldiers control dozens of drones simultaneously – or thousands? How many drones should a “battalion” have?

Decentralization is a factor too. Everything we are seeing develop now is scaling in Ukraine down to the individual operator, as it must. The over-the-horizon warrior needs personal access to livestreamed tactical radar to check if the skies are clear before he exposes himself by making movement. He needs edge compute not just onboard his drones, but for local offline AI to analyze the battlefield and make decisions even in a communications blackout. Already we see backpack portable drone interceptor systems for personal defense; I’m aware of contracts under consideration for such systems to miniaturize to automated shoulder-launch, like a personal version of the tank-mounted Trophy system. The current estimate is that a soldier has one to four seconds to defend himself against a visual drone contact vectoring on him, and soon that timeline will compress enough to exceed human reaction times.

Asking what exactly the mass of conventional soldiers will do under such a radical restructuring is much like asking whether or not Large Language Models (LLMs) are going to have the net effect of creating or destroying jobs in the civilian workforce. We may see the formation of a tiny military class, or perhaps warfare will become even more industrial in human scale. Certainly, humans will be pushed farther and farther back in the logistical chain that ultimately delivers kinetic effects upon an adversary. Currently, there is a need for people to physically emplace, operate, and recover antennas, ground stations, and drones. Once robots are more commonly executing these tasks (already, some aerial drones are launched via multi-domain mothership drones), people will work on those robots, and so forth. Eventually, it’s hard to see what anyone will need to do physically, as robots will be building, repairing, improving, and employing each other. The only real foreseeable tasks left at the tactical echelon will be those of the tactician and the true engineer, who innovates and integrates locally. Whoever best automates tasks end-to-end will win the tempo fight. The transportation of weapons and sensors has to be contemplated as one mass-manufactured logistical animal.

Going further, the tactician need not position himself relative to any front at all, because he can fly remotely and because he would be sensible to reduce his threat profile from direct action threats to intelligence-driven threats only. That is, he should position himself to strike with impunity. Already in Ukraine, Sting pilots have flown their interceptors remotely 500km away from where they were launched. Midrange teams outside the gray zone already drive to position in unmarked civilian vehicles, wear their uniforms only for the minimal time needed to deploy their systems, and then fade back into the population. And the naval drones striking the Russian fleet are not generally controlled from the sea, but ultimately from bases on land. If trends hold, the smallest independent tactical elements may be able to cheaply strike anywhere on Earth within a decade.

Branching Futures: eVTOLs, Smart Dust, and Beyond

But this is merely one vision of the future. There are branching pathways, perhaps some of which may coexist. Weaponized human-optional eVTOLs like the Chinese prototype ZR-300 could become a new air cavalry paradigm unto themselves if employed en masse in shock fashion, sweeping aside whole nations in a day the way Central Asian hordes did in the Medieval period, or the way Islamist insurgents swept across the Sahel in Toyotas. Microscopic drone “clouds” also known as smart dust could penetrate any conventional barrier, performing reconnaissance or even coalescing explosively or penetrating air ducts and lungs. Does this seem one step too far, straining credulity? Remember that “any sufficiently advanced technology is indistinguishable from magic” from the perspective of the old guard, and that all these technologies are already real, just not fully scaled and integrated. In fact, micro drones were feasible decades ago, technically if not economically – timing is everything. We already have a leading indicator in the German army’s very real purchase of cyborg insect swarms from Swarm Biotactics. Against such dizzying possibilities, we will advocate further on below for a rapidly adapting structure that ingrains real-world feedback and extrapolates from it.

Economies of Scale for Drone Production

First, let’s deal with how we produce enough useful drones to simply match our adversaries. The necessary industrial base to deliver manufacturing on the required scale simply does not exist anywhere in the West currently, whereas China has quietly captured the drone market and the sub-component supply chains over decades and is integrating such technology down to their lowest tactical echelons at a hundred times our volume. Much has already been written about the need to innovate and iterate on a scale of weeks rather than decades, and while true such a need potentially comes with the steep requirement of continuous retooling of factories and endless R&D. Ironically, funding this effort at the scale needed will require a vision across a much longer (generational) timeline, in opposition to the quarterly results that drive Western business strategy. Currently, the US buys primarily the end-product rather than engendering the component markets directly. From a cost-savings standpoint, we would do well to preemptively build adaptable systems, and also to stop trying to update legacy programs (we will never need a new sniper rifle). The DoW budget has to fund the domestic mass production of production itself, with an eye towards dual-use sub-components and machine tools, since commercial R&D and production can fund itself to an extent. Vehicles, phones, and drones sold into civilian markets pay for their own scaled production, and volume buys down cost. As it stands now with our current component outsourcing, we are paying our enemies to equip us, tying the rope with which they intend to hang us.

Pillars of a Sovereign Drone Industry

The pillars of industry to be funded include locomotion, actuation, energy, storage, compute, sensing, and communications. The component-level specifics, meaning motor sizes, magnet chemistries, cell formats, and the rest, belong in a technical paper. What’s important here is that the government has to guarantee the market for base components as much as scale requirements dictate and raw materials allow, while simultaneously finding the alternatives that bypass adversarial chains entirely.

Shallow or single-sourced chains halt on the first disruption, so volume has to be distributed across multiple domestic entities in order to create redundant paths. That means accounting for the physical bottleneck of factory siting, the legal bottleneck of restrictive radio frequency and flight-test regimes, and the social bottleneck of technical workforce recruitment, which in practice means a nationwide push for engineers with the education pipelines to match. We should fixate less on the static stockpile and more on the velocity at which the economy can replace a lost or outdated asset. Eventually, this may look like self-assembling factories, but for now we should see a dramatic increase in industrial jobs, not a reduction.

Guaranteed Requirements and Manufacturer Caps

The Departments of War and Commerce must jointly establish requirements and guarantee purchase of components at massive volumes, over multi-year timescales, according to stringent standards for minimum viable products meeting or exceeding foreign equivalents, with caps set on what portion of the total any one manufacturer can source. Subcontracting and manufacturer caps will encourage competition inside our own secure ecosystem rather than across national borders, where we are frequently undercut by adversaries. As needed, the government can resell unused inventory back to industry at or below the cost of subsidized foreign imports, letting American companies build with cheap secure inputs.

We have a realistic precedent for all this, as described in the book Freedom’s Forge: In anticipation of US entry into WW2, President Roosevelt brought together former of heads of industry in order to align military requirements, government funding, and civilian production capacity so that goals could be revised upward continuously, and the resulting volume forced a dynamic of subcontracting to keep up with demand. American industry responded, not only producing hundreds of thousands of complex war machines, but also rapidly retrofitting them as needed based on frontline feedback, on much the same timescales that we today see in Ukraine.

Innovation on the Machine Timescale

In the near future, however, we will have to go even further, with innovation necessarily occurring on the machine timescale. The same digital twin in which soldiers will virtually train and fight will also let us simulate hardware, factories, and logistics before steel is ever cut. The panopticon in which the end product’s edge sensors feed data into will be the same in which an arbitrary number of tests under variable conditions may be run before the more refined next generation of product is built. Supply chains from base-component assembly through fuel and battery pathways can be estimated and stressed the same way. Data streams from around the globe and from local instrumentation can all compartmentalize or cohere as needed for efficiency or breadth of understanding, all of it parseable by ever-increasing machine intelligence, at worst bounded in growth only by Moore’s Law. As an aside regarding encouraging a martial culture amongst the youth who will one day fill the tactician ranks, our military should release realtime strategy wargames involving drone swarming, initially as standalone games but eventually living inside the kind of digital twin explained above. And as earlier mentioned, all of this will eventually be experienced in breathtaking detail in virtual reality and via brain-machine interface. This is not so distasteful a task on a wartime footing, especially considering even in peacetime the military has released first-person shooter games and simulations.

Massive integrated training areas, in which units, contractors, and manufacturers co-locate to live-fire and iterate together, belong on the near-term build list. The mandate inside such an area should be inverted from current practice, so that the burden shifts from justifying permission for a given action to justifying why any given action cannot happen. The FAA, the FCC, and the rest of the regulatory apparatus should be effectively kicked out of the perimeter, and legislation should extend a good-faith liability shield covering crashes and honest mistakes. Dedicated integration units, which can be thought of as Transition in Contact supercharged, should be created. The core skill of these new units would not be warfighting but rather adapting to and assembling whatever technology is available. Every unit, not just dedicated ones, should additionally have at least some innovation budget and personnel, so that they are not merely customers but also integrators. Specifically, this means the military needs to be mass recruiting engineers to fill out dedicated innovation units and also sprinkle across the wider force. And lastly, the soldiers who will become the drone tacticians must be allowed to train for that role full-time, studying meteorology, radio theory, and other topics and skills currently regarded as arcane among warfighters.

A Permanent Feedback Loop from the Front

None of the above works without a permanent structured feedback loop that connects requirements to what is actually happening in a live conflict. Local units cannot generate requirements for now let alone five years out if there is no frontline feedback, no rotating instructor cycle, and no living link to platforms that do not yet exist in Western inventories. A peacetime force generating peacetime requirements will buy peacetime equipment no matter how decentralized the process is. Instead, we need a much greater scale of personnel who are aggressively forward deployed to conflict zones, visiting tactical operations centers and doing ridealongs on relatively low-risk mid- and deep-strike operations. Our partners will gladly place them there if they provide as much as they take. Directly in this role we can put our incredible all-volunteer special operators, who want nothing more than to get close to the fire. Adjacent to it, in lower intensity areas, we can forward deploy conventional troops as well to learn from partners, including by attending their own schoolhouses.

What we are suggesting here is deploying thousands of troops, not merely small cells of elite military and intelligence agency operators whose reporting does not reach the wider military. Much like the technical innovation measures described in the previous paragraph, these warriors should be distributed both into new dedicated units for the express purpose of doctrine, tactics, techniques, and procedures innovation, as well as across the wider force, to supercharge change and acquire what Clausewitz called a “fingertip feel” for the present state of war. If there is really no political appetite for this, then the only other option is to accomplish the same via other methods, such as by inviting large numbers of military instructors from partner nations currently involved in active conflict or by rotating civilian contractors more discreetly through conflict areas, as suggested by former Green Beret Bryan Pickens.

Piping Frontline Signal Directly to Doctrine Writers

Regardless of how it is done, the core part of whatever structure is created should report directly to the senior military leadership responsible for the development of force-wide doctrine and requirements, so that they cannot ignore reality and hide in dead paradigms. Various new offices are being created, such as DRPM-UxS, and our hope is that with direct signal they can utilize sweeping - even disruptive - authorities to continually remake the military; for, as Napoleon said, “unhappy the general who comes on the field of battle with a system”. Given the enemy’s endless adaptation, the best meta-doctrine is to accept no particular doctrine as certain or permanent, and even to assume that it is likely wrong if it has not been overhauled lately. Official doctrine documents would be better written and accessed as living Google docs rather than year-dated static PDFs.

This applies down to the nitty-gritty of institutional knowledge as well. The train-the-trainer model informed by forward-deployed reporting must fuel change in our own programs of instruction and battle drills, so that we actually know how to employ the unmanned weapon systems we are scaling, a capability which further feeds into local units understanding the requirements for the next round of equipment purchases.

A sharedrive with compartmentalized access is not enough; we need our whole force separated at most by just one degree from someone who has seen modern war up close. And if the military is that close to the combat demand signal, then by extension the manufacturers who visit the units they are equipping will be that much closer.

The Transition Engine and Treating Ukraine as a Peer

Joseph Gagnard of Atlas Special Projects calls the sum total of all these joint efforts the “transition engine”, meaning operators, builders, contracting specialists, and investors institutionalized together, because no single one of them fields capability alone. That transition engine has to be paired with a treatment of Ukraine that most of the current western defense industry still resists. Treat the Ukrainians peer to peer, at least as well as Taiwan or South Korea, and better than either, because they are in an existential fight we cannot afford for them to lose. I suggest bringing thousands of Ukrainian engineers, managers, and operators into the United States to help build the drone industry. Regarding AI, America holds the architecture, the compute capacity, the models, and the global reach. But Ukraine holds the live-fire scaffolding for how that data actually gets generated, labeled, fused, and fed back into the iteration cycle; they have the premier Common Operating Picture software, Delta, to facilitate collection; and they are best positioned to evaluate the battlefield effectiveness of each successive generation of combat AI.

Furthermore, Ukraine is waging a global hybrid war on the West’s behalf, which we hardly engage in except via the most deniable means. China, Russia, and their proxies and allies ruthlessly exploit neutral ground with a vast array of tools, strangling us of resources, allies, and positioning. As political will allows, we suggest unleashing our special operators and intelligence officers in nearly-overt ways, in partnership with Ukrainians, who willingly perform more risky action and have a history of cooperation with our intel services, to operate across the globe responding in kind to the Axis arrayed against us. Drones, of course, are the perfect semi-deniable weapon for this. And the signal we receive back by more heavily involving our forces in low-intensity conflicts will feed back into the plan regarding getting a “fingertip feel” back for war.

The Vulnerable Homefront

The homefront, meanwhile, is ripe for a crippling preemptive strike against us. Our infrastructure is vulnerable, and drones as stated are a perfect scalable weapon that can be employed by deniable proxies. A strike could produce economically disastrous effects, and in response to such an attack of ostensibly deniable origin and limited death toll we would certainly not seek to launch, say, a nuclear retaliatory strike. Containerized long-range drones could be lurking on civilian ships off our coast right now. DHS testified to the Senate that in 2025 there were an average of 10,000 foreign drone flights per month near the southern border. Particularly at risk to such a looming threat is our AI infrastructure. Whatever one’s thoughts on the supposed “AI bubble” (the dot-com bubble didn’t stop the triumphant march of internet adoption, did it?), it is undeniable that both the previous and current administrations have regarded the AI race as existential, and our enemies clearly feel the same way.

We saw from a recent strike by Iran on data centers in the UAE providing Amazon Web Services that such centers are vulnerable, going down for several months at a minimum due to spreading fires and long lead time for repair parts. A few hundred drones striking data centers or upstream links in the chain could easily set us back in the AI race which could provide our adversary an opportunity to surge permanently ahead, a situation which, again, our bipartisan leadership regards as an existential threat.

A Decentralized, Always-On CONUS Defense

The right posture for CONUS defense is one that is always on and autonomous-capable, able to intercept without waiting for the chain of command. In addition, such efforts must take the form of a whole-nation decentralized effort. In Ukraine, a nationwide cheap network of mobile phones acoustically tracks hostile long-range drones swarming their country, and recent legislation approved the use of electronic warfare and interceptor drones by businesses to protect their own assets. New manufacturing and power facilities tend to be built in a distributed, resilient, redundant manner, with cheap hardening available for obvious targets (like anti-drone “cages”). Our recommendation, like elsewhere, is to empower everything local. We would even go so far as to suggest that the Second Amendment needs to extend to counter-drone equipment, and any U.S. person or institution should be able to engage perceived threats up to certain altitudes above their own land.

AI as Sovereign Terrain

We can extend the Second Amendment and drones argument to the First Amendment and AI; that is, to digital and not just physical terrain. Across the information domain, China steals from us and undercuts us, releasing open LLMs to erase Western software margins. Intellectual property in this context is a burden more than a benefit by now, perhaps functioning somewhat to promote internal competition but leaving us wide open for external exploitation. The best way to stay ahead of our enemy in the face of their undermining of our brittle centralized systems is to fight fire with fire. We need policy and funding to shy away from the current big LLM players and instead encourage open models, local compute, and data sovereignty, which offer numerous long-term advantages across the board that mirror the kind of resiliency and initiative-encouraging effects we will get by distributing compute and AI models down to the lowest levels of our military.

Encryption code, for example, was previously ruled to fall under free speech protections. There is an argument against allowing centralizing and censorship of digital spaces as well, regarding them as a kind of common space since there is a barrier to entry in networking at the level of Internet Service Provider infrastructure. We need a diverse market of competing open AI models, local compute, social networks, etc. A centralized internet and centralized AI have severe risks within the domains of psychological and information warfare, which play out across the public digital arena, but to go further in that discussion we would have to depart from the scope of the kinetic warfare focus of this article. Suffice to say, the most dystopian and existentially risky outcomes are plausible if centralized AI should win, whether by our own hand or the hand of the enemy, who will surely centralize control over their models as soon as they gain an advantage.

Deterrence via Force Projection

Another point worth addressing when discussing CONUS defense is the idea that “the bomber always gets through”, which is probably true regarding drone swarms. However, regarding the homefront, Ukraine has shown first that the effects of long-range drone attacks can at least be mitigated significantly, and that it is economically optimal to do so. Furthermore, the striking arm we are also building alongside the defenses will serve as a deterrent, since nuclear doctrine of Mutually Assured Destruction is insufficient for the aforementioned reasons. If we can threaten to do unto our enemies as they wish to do unto us, and indeed if we actually regularly exercise this capacity in the global low-intensity ongoing war, then we will make them think twice before hitting us.

The Core Principle: Endless Distributed Adaptation Capacity

The single principle of this piece is this- Stop buying end products and start buying the ability to produce them, at scale, sovereignly, and forever – doctrine here being one of those end products. The victor that emerges from the next several years will have built the meaningfully decentralized version of what we have described here, meaning distributed compute, sensors, swarms, command, cognition, industry, and authority, with the standards and alliances to match. The rallying cry, in the end, is the architecture. In the last great war, we firebombed cities, preemptively invaded neutral countries, and of course ultimately resorted to nuclear weapons. The political license for a national revitalization as a form of deterrence seems, by comparison, an easy pill to swallow.

Note from author (Xen)- For those who wish to understand not merely the how but the why, or who have comments, or who desire greater breadth or depth of understanding: Over the coming weeks I will be sharing additional information to my personal Substack and website. As for my co-author, Matthew A. Creedican, you can find him on LinkedIn.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The choreography in Ankara last week was impressive, even by Recep Tayyip Erdogan's standards. Cannons fired, mounted honor guards paraded, and jets flew overhead trailing red, white, and blue smoke as Donald Trump arrived for the NATO summit. By the time the two leaders sat down together, the American President was already telling reporters that Turkey has been "much more loyal" than other allies, and that reinstating Ankara into the F-35 program is "certainly something we will consider." He went further, promising to lift the sanctions imposed under CAATSA after Turkey's 2019 purchase of the Russian S-400 air defense system.

Washington should slow down and reconsider any such move. The temptation to reward Erdogan for a good show of pageantry and for playing a useful back channel to Tehran is understandable. But the case for readmitting Turkey to America's most sensitive fighter jet program does not hold up, and the reasons go well beyond the S-400 that got Ankara expelled in the first place.

Let’s start with Turkey’s original sin. Turkey was removed from the F-35 program precisely because the S-400 system stationed on Turkish soil poses a collection risk to the F-35's stealth signature and sensor data. Nothing about that system has left the country. Trump's own suggestion that he has "no concerns at all" about Turkey operating Russian and American systems side by side ignores the technical judgment his own administration reached in 2019: an S-400 battery within range of an F-35 is an intelligence-gathering platform aimed at the jet's most guarded secrets.

Turkey now appears it wants to atone for its sins: In the days that followed the NATO summit, well-placed sources in Ankara announced Turkey’s intention to sell or transfer its S-400s to another country, possibly Qatar or the United Arab Emirates. Doing so may satisfy the letter of the law, section 1245 of the 2020 National Defense Authorization Act, which bars F-35 transfers to Turkey unless Washington certifies Ankara no longer "possesses" the S-400.

Then come regional concerns. Israel has lobbied hard against the F-35 sale, with Prime Minister Benjamin Netanyahu warning that Turkish F-35s would erode the air superiority that guarantees Israeli and American posture across the Middle East. Athens and Nicosia have made similar appeals, citing Turkey's continued military pressure in the Aegean and its decades-long occupation of northern Cyprus. These are warnings from allies and partners who would sit on the receiving end of Turkish airpower upgraded with fifth-generation stealth.

But there is a fourth danger that has drawn far less attention in Washington, and it may matter more than any of the others: Turkey's telecommunications backbone is no longer fully Turkish. The country's leading systems integrator, Netaş, is roughly 48 percent owned by ZTE, and Huawei is deeply embedded in the networks operated by Turkcell, Türk Telekom, and Vodafone Turkey. Under China's 2017 National Intelligence Law, that ownership is not a passive investment. Beijing can compel any Chinese firm, anywhere it operates, to hand over data on demand, and corporate assurances of independence carry no legal weight against that obligation.

Washington has already treated this exact problem as disqualifying. In 2021, a $23 billion F-35 and drone package for the United Arab Emirates collapsed, in part because Huawei was building Abu Dhabi's 5G network and American intelligence had identified a suspected Chinese military-linked facility at Khalifa Port.

Turkey’s embrace of Chinese telecoms also cuts against the Alliance’s moves towards securing the critical infrastructure underpinning its military mobility — the bridges, rail links, and digital networks that allow allies to uphold deterrence. Across the continent, these networks have become a critical target over the course of the war in Ukraine, as adversarial actors linked to Russia use grey zone tactics to undermine collective resilience and damage alliance cohesion.

Washington increasingly views countering this threat as a top priority. In May, the Trump administration urged NATO members to spend a portion of the 1.5 percent of GDP allocated to defense-related spending on removing Huawei components from their domestic networks, highlighting the vulnerabilities posed by Chinese equipment and hacking campaigns such as Salt Typhoon. While that call is already being heeded by several NATO allies — Sweden and the UK have been particularly proactive in securing their systems — Ankara remains a laggard, undermining its contribution to alliance interoperability.

The risks are not simply tied to the F-35 itself, but to its entire operating environment. If sold, the fighter will be operating within an ecosystem saturated by Chinese-produced telecom equipment, reliant on a deployment infrastructure whose roots directly tie back to Beijing, operated by a capital pulling in the opposite direction of a key Alliance priority. While the U.S. has heavily invested in protecting the F-35, no system is ever fully secure, and any sale would force the jet to operate in a vulnerable environment for decades to come.

Turkey’s pending S-400 sale may remove dangerous hardware, but it does not eliminate the systemic risk associated with the deal.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Department of War has just executed the most ambitious acquisition reform in six decades. It scrapped JCIDS — the requirements process that ossified innovation for a generation; replaced program offices with portfolio executives, and built a Warfighting Acquisition System designed for speed.

The changes deliver on years of reform proposals. They also risk repeating a costly mistake of the post-9/11 wars: chasing evolving threats with rapid fixes while no one is responsible for understanding them. Industry will help determine which path prevails.

Counter-drone fight as test case. We’ve seen this movie before

Consider the counter-drone fight, the clearest test of the new system. Washington treats it as an engineering puzzle: build a better jammer, field a cheaper interceptor. The technology shelf is full — directed-energy weapons at $12 a shot, drone-on-drone interceptors with more than a thousand kills in Ukraine.

While the technology works, the process for getting it to the warfighter does not.

Soldiers today engage FPV drones that cost a few hundred dollars with $400,000 Stinger missiles, because the cheap interceptors proven in Ukraine still have no fast path into U.S. formations. A new drone variant appears on the battlefield every week, built from commercial parts and open-source software. A firmware update that defeats a jammer costs nothing and takes hours. Our counter, even through the reformed system, takes months.

This is not a technology gap. It is a cycle-time gap. And I have seen it before. From 2010 to 2013, I led the Army’s Rapid Equipping Force at the height of the counter-IED campaign in Afghanistan. The structural parallels are exact: cheap dual-use components, knowledge that spreads faster than countermeasures, adaptation at near-zero cost, tactical variation that defeats one-size-fits-all solutions, and an institutional reflex to throw technology at a systems problem. We spent $75 billion on counter-IED and lost that fight anyway. Drones are IEDs that fly.

The part nobody owns

Here is what the reforms miss: Successful innovation runs in six phases — detect, define, develop, deploy, assess, distribute. The reforms invested almost entirely in the middle two, develop and deploy. Nobody persistently monitors how the threat evolves at the tactical edge. Nobody scopes each unit’s problem with enough precision to drive useful solutions. Nobody measures whether fielded systems actually work against an adversary who adapts after every engagement. And nobody moves what one unit learns to every other unit facing the same threat at operational speed. Three of the six phases have no organizational owner.

The department built a faster engine. Nobody built the steering — the mechanism that decides which problems the engine should be pointed at, whether the solutions worked, and who else needs to know.

Industry’s new role

That gap is the industry's opportunity — and its obligation. The DoW can’t solve this problem by itself. Companies that want to matter in this market need to do their part. They should start by doing three things differently.

First, invest in problem discovery, not product pitches. Requirements still originate in headquarters, not from soldiers watching the problem in context. The companies that win the next decade will be the ones that put engineers and business developers forward with operational units to understand problems before proposing solutions. The quality of your solution is determined by the quality of the problem you choose to solve. Einstein’s formula applies: 55 minutes on the problem, five on the solution. Most of industry has that ratio inverted.

Second, build for adaptation, not for the requirement. If your product cannot change in weeks — modular hardware, software-defined behavior, upgrades at firmware speed — it is obsolete on delivery. The adversary’s development cycle runs in days. A requirement frozen at contract award is a snapshot of a threat that no longer exists.

Third, plug into the new portfolio structure as a sensor, not just a supplier. Industry keeps asking the department for a clearer demand signal, and fairly so. But the demand signal has to come from somewhere, and the fusion cells that Portfolio Acquisition Executives need — nodes that merge ground truth from the field with what industry and the labs know is possible — cannot function without industry feeding data in and absorbing assessment data out. Companies that operate at that tempo will define the portfolios. Companies that wait for RFPs will trail them.

Doing these three things means stopping three others. Stop building to frozen requirements and calling it responsiveness. Stop treating a prototype contract or a demo-day win as the finish line — it is the starting line of the assessment the department never runs. And stop spending capture budgets decoding what headquarters wants instead of discovering what the warfighter needs. The hours are the same; the direction is not.

New authorities need new operators

None of this works without people, and people are where the reform agenda is thinnest. The department is converting the Defense Acquisition University into a Warfighting Acquisition University, trading compliance training for scenario-based judgment. That is the right instinct. But this year’s defense authorization offered little else on workforce, which means the authorities changed faster than the people who must wield them.

We know what works: experiential, problem-first education. Hacking for Defense has spent a decade putting university students to work on real national security problems alongside the people who own them. It has produced a generation of founders and public servants who know how to interrogate a problem before building a solution. That model needs to scale — into the department’s schoolhouses, into two-way exchanges between government and industry, and into industry’s own training pipelines, which today produce engineers who have never seen the field and capture teams fluent in the FAR but not in the mission.

The department has reformed how it acquires. It has not yet reformed what it acquires, whether it worked, or who else needs to know. Industry can wait – and hope – the government will close that gap, or it can help close it — by discovering problems & opportunities at the edge, building for adaptation, and educating a workforce trained to out-cycle an adversary rather than out-comply a regulation.

In this fight, the adversary does not need to out-technology us. He only needs to out-cycle us. We have already paid $75 billion to learn where that leads.

Pete Newell is a retired U.S. Army colonel, former director of the Army’s Rapid Equipping Force, and CEO of BMNT. He co-created Hacking for Defense with Steve Blank and is the author of “The Innovation Targeting Cycle.”

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Welcome to The Iron Triangle, the Cipher Brief column serving Procurement Officers tasked with buying the future, Investors funding the next generation of defense technology, and the Policy Wonks analyzing its impact on the global order.

A little over a year ago I watched a good company die. They built technology that worked. It was not a slide or a concept, but a thing that did what it was designed to do. They had European clients interested, checkbook open, at exactly the moment Europeans started opening checkbooks for real. They did not close the deal. They could not figure out how to export their product without tripping over the International Traffic in Arms Regulations (ITAR), they could not afford the lawyer who could tell them, and they ran out of runway waiting on a U.S. contract that was still three review cycles from signatures. The technology did not fail. The paperwork won.

Around the same time, I sat with a foreign team with excellent tech who wanted to build in the United States. They decided against it. Their reason was not taxes or visas. It was that the moment their intellectual property became American, it might become ITAR-controlled, and they were terrified that a regulation written in Washington would strand the hardware they were shipping to Ukraine to kill Russians. Restated, our export-control regime is so feared that talented people keep their best work out of the American ecosystem. That is not security. That is self-harm.

The $3,000 Toll to Export Nothing

Start with the cost of admission. To legally export a defense article, you first register with the State Department's Directorate of Defense Trade Controls (DDTC). As of January 2025 the base registration fee rose to $3,000 a year, and you pay it whether or not you ever ship a single item. That fee is the insult, not the injury. It’s the trivial part that buys you the right to then apply, per transaction, for a DSP-5 license, a process that consumes months, specialized counsel, and a full-time compliance officer that a nine-person startup does not have and cannot afford to hire.

For Lockheed Martin, this is a rounding error and a competitive moat all at once. The primes have entire floors of export-control lawyers; the regulation that annoys them is the regulation that buries smaller companies. The same $250,000-a-year compliance function is a nuisance on a $61 billion contract base and a death sentence on a Series A. ITAR does not have to be designed as a moat to function as one.

The See-Through Rule and the Birth of "ITAR-Free"

Here is the part that turns a domestic annoyance into a strategic own-goal. ITAR does not stop at the first sale. Every onward move, a re-export to a third country, a retransfer to a different end user, needs its own license. Control follows the item forever. Two features make this uniquely radioactive. The first is the "see-through rule": American law looks straight through a foreign-built system to control the U.S. part buried inside it. The second is that ITAR, unlike Commerce's export rules, has no de minimis threshold; there is no amount of American content small enough to escape. One controlled datalink in a drone taints the entire aircraft, permanently, and Europe cannot freely sell it onward, or keep sending it to Kyiv, without asking for permission.

So Europe did the rational thing. It started designing us out. "ITAR-free" is now a selling point, a feature you advertise the way you'd advertise waterproofing. The control regime we built to protect technology has taught our allies to build parallel supply chains that don't need us at all. We are not catching diversion. We are losing the room, one clean-sheet component at a time.

We Are Guarding a Henhouse the Fox Already Breeds

Now the objection every serious reader is forming: won't loosening the rules help China? It is the right question, and it deserves an honest answer. Post-sales diversion to Beijing is a threat, and the wall against it should stay standing.

But look at what the small companies I'm talking about actually build; let’s be precise about it. The airframe of an attritable FPV drone is commodity hardware, every component sourceable on Alibaba, and China manufactures the world's drones at a scale and price we cannot approach. Nobody in Beijing is combing American startups for quadcopter know-how. What can be genuinely sensitive is the layer you can't buy on Alibaba: the autonomy stack, the radio's waveform library, the ISR payload's processing. Control that. But applying munitions-grade export control to benign parts isn't guarding the crown jewels. It's standing armed guard over a henhouse the fox already owns, breeds, and exports. Control the narrow band that matters; stop strangling everything downstream of it with rules written for an age when a weapons system took a decade to build and stayed secret for two.

The Money Nobody Talks About

Investors should sit with the scale of the mismatch. In 2025, venture capital poured a record $49.1 billion into defense tech, up more than 80 percent over the year before. It sounds like a golden age until you notice most of it stacked into a handful of nine-figure megarounds while the Forgotten Bench, the small firms building the actual arteries of the future force, fought over grants. A typical DoD SBIR Phase I award runs about $256,000; a Phase II might reach a couple of million, if the company survives the wait. Many do not.

Now hold that against one ITAR-specific insult. On an ordinary afternoon, RTX booked $183.7 million for Patriot hardware bound for the United Arab Emirates. The prime exports to the Gulf on a Tuesday while the startup cannot work out how to ship a drone to a NATO ally. That is not a difference in risk. It is a difference in legal firepower. And the Pentagon posts these awards daily, every one above $7.5 million. The primes' budget rounding errors could fund the next generation of warfare. Instead they accrue to the incumbents while the little guys are fenced out of a market currently on fire.

What Each Corner of the Triangle Should Want

For the Procurement Officer, this is about coalition speed. You cannot field an allied force at the pace of a per-transaction license queue. Interoperability that requires a lawyer is not interoperability.

For the Investor, ITAR reform is a total-addressable-market unlock. European defense budgets have gone vertical, and right now your portfolio company is legally walled off from them. The moat you think protects your prime holdings is the same moat drowning your early-stage investments. Your small companies are not competition for the primes; there is plenty of room for both to be successful.

For the Policy Wonk, the pitch is precision. A control regime that treats a drone like an ATACM has no credibility left to spend when it actually needs to stop something dangerous. Overcontrol is how you get evasion; targeted control is how you get compliance.

The Fix Already Exists: We Just Gave It to Two Countries

We do not have to invent anything. In September 2024, the State Department stood up the AUKUS exemption, a license-free environment for defense trade, between pre-approved, vetted users, the United States, the United Kingdom, and Australia, fenced by an "Excluded Technology List" that keeps the genuinely sensitive items behind the wall. In an early three-month sample, only 18 percent of requests fell on the excluded list; the other 82 percent could move without a license. The mechanism works; State approved it six months ago.

So extend it, carefully, because this is the part the cynics should watch. AUKUS worked because State vouched for allies whose export-control systems were judged comparable to our own. Thirty-two NATO members are not thirty-two equal risks, so the honest version of this is tiered: the most-trusted governments first, each on its own comparability finding. Build a NATO Trusted Trade tier on the same architecture: license-free authorization for vetted allies on the commodity tier, a narrow excluded list. Industry's loudest complaint about AUKUS is that the list is already too broad. Then build a small-business fast lane that waives the registration toll for firms below a revenue threshold. Keep the wall. Widen the gate. Stop making a startup spend its entire budget on compliance lawyers to sell drones to Poland.

I have spent a career watching good technology lose to bad processes. This is the purest example I know. The threat is real, the fix is proven, and the only thing missing is the will to admit that a rulebook written in the era of glacial weapons development is actively kneecapping the fast, cheap, disposable systems that are winning wars right now. Europe wants viable technology. Our young innovators are starving for a customer. ITAR is standing between them, collecting a $3,000 toll, and calling it national security.

I am not naive about post-sale diversion to China. The real leak in a trusted-ally tier is not China raiding our startups; it is a vetted ally re-exporting onward. This is why truly sensitive items stay behind the wall. A trusted-ally tier is only as good as the "trusted" part: the whitelist has to be policed, the excluded list has to be honest, and end-use monitoring has to be real. I will not pretend reform fixes everything. For some European governments "ITAR-free" is industrial policy, a way to protect their own primes and their own jobs. No amount of American good behavior erases that motive. But reform removes the legitimate excuse, and keeps our companies in contention where today they are auto-excluded. The answer to a blunt instrument is a sharper one, not no instrument at all.

We wrote the words "ITAR-free" onto our allies' marketing brochures ourselves, one anachronistic rule at a time. The question is whether we notice in time to erase them, or we keep guarding the henhouse until the last American startup gives up and the last European customer stops asking. Who are we protecting, and from what?

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Welcome to The Iron Triangle, the Cipher Brief column serving Procurement Officers tasked with buying the future, Investors funding the next generation of defense technology, and the Policy Wonks analyzing its impact on the global order.

A little over a year ago I watched a good company die. They built technology that worked. It was not a slide or a concept, but a thing that did what it was designed to do. They had European clients interested, checkbook open, at exactly the moment Europeans started opening checkbooks for real. They did not close the deal. They could not figure out how to export their product without tripping over the International Traffic in Arms Regulations (ITAR), they could not afford the lawyer who could tell them, and they ran out of runway waiting on a U.S. contract that was still three review cycles from signatures. The technology did not fail. The paperwork won.

Around the same time, I sat with a foreign team with excellent tech who wanted to build in the United States. They decided against it. Their reason was not taxes or visas. It was that the moment their intellectual property became American, it might become ITAR-controlled, and they were terrified that a regulation written in Washington would strand the hardware they were shipping to Ukraine to kill Russians. Restated, our export-control regime is so feared that talented people keep their best work out of the American ecosystem. That is not security. That is self-harm.

The $3,000 Toll to Export Nothing

Start with the cost of admission. To legally export a defense article, you first register with the State Department's Directorate of Defense Trade Controls (DDTC). As of January 2025 the base registration fee rose to $3,000 a year, and you pay it whether or not you ever ship a single item. That fee is the insult, not the injury. It’s the trivial part that buys you the right to then apply, per transaction, for a DSP-5 license, a process that consumes months, specialized counsel, and a full-time compliance officer that a nine-person startup does not have and cannot afford to hire.

For Lockheed Martin, this is a rounding error and a competitive moat all at once. The primes have entire floors of export-control lawyers; the regulation that annoys them is the regulation that buries smaller companies. The same $250,000-a-year compliance function is a nuisance on a $61 billion contract base and a death sentence on a Series A. ITAR does not have to be designed as a moat to function as one.

The See-Through Rule and the Birth of "ITAR-Free"

Here is the part that turns a domestic annoyance into a strategic own-goal. ITAR does not stop at the first sale. Every onward move, a re-export to a third country, a retransfer to a different end user, needs its own license. Control follows the item forever. Two features make this uniquely radioactive. The first is the "see-through rule": American law looks straight through a foreign-built system to control the U.S. part buried inside it. The second is that ITAR, unlike Commerce's export rules, has no de minimis threshold; there is no amount of American content small enough to escape. One controlled datalink in a drone taints the entire aircraft, permanently, and Europe cannot freely sell it onward, or keep sending it to Kyiv, without asking for permission.

So Europe did the rational thing. It started designing us out. "ITAR-free" is now a selling point, a feature you advertise the way you'd advertise waterproofing. The control regime we built to protect technology has taught our allies to build parallel supply chains that don't need us at all. We are not catching diversion. We are losing the room, one clean-sheet component at a time.

We Are Guarding a Henhouse the Fox Already Breeds

Now the objection every serious reader is forming: won't loosening the rules help China? It is the right question, and it deserves an honest answer. Post-sales diversion to Beijing is a threat, and the wall against it should stay standing.

But look at what the small companies I'm talking about actually build; let’s be precise about it. The airframe of an attritable FPV drone is commodity hardware, every component sourceable on Alibaba, and China manufactures the world's drones at a scale and price we cannot approach. Nobody in Beijing is combing American startups for quadcopter know-how. What can be genuinely sensitive is the layer you can't buy on Alibaba: the autonomy stack, the radio's waveform library, the ISR payload's processing. Control that. But applying munitions-grade export control to benign parts isn't guarding the crown jewels. It's standing armed guard over a henhouse the fox already owns, breeds, and exports. Control the narrow band that matters; stop strangling everything downstream of it with rules written for an age when a weapons system took a decade to build and stayed secret for two.

The Money Nobody Talks About

Investors should sit with the scale of the mismatch. In 2025, venture capital poured a record $49.1 billion into defense tech, up more than 80 percent over the year before. It sounds like a golden age until you notice most of it stacked into a handful of nine-figure megarounds while the Forgotten Bench, the small firms building the actual arteries of the future force, fought over grants. A typical DoD SBIR Phase I award runs about $256,000; a Phase II might reach a couple of million, if the company survives the wait. Many do not.

Now hold that against one ITAR-specific insult. On an ordinary afternoon, RTX booked $183.7 million for Patriot hardware bound for the United Arab Emirates. The prime exports to the Gulf on a Tuesday while the startup cannot work out how to ship a drone to a NATO ally. That is not a difference in risk. It is a difference in legal firepower. And the Pentagon posts these awards daily, every one above $7.5 million. The primes' budget rounding errors could fund the next generation of warfare. Instead they accrue to the incumbents while the little guys are fenced out of a market currently on fire.

What Each Corner of the Triangle Should Want

For the Procurement Officer, this is about coalition speed. You cannot field an allied force at the pace of a per-transaction license queue. Interoperability that requires a lawyer is not interoperability.

For the Investor, ITAR reform is a total-addressable-market unlock. European defense budgets have gone vertical, and right now your portfolio company is legally walled off from them. The moat you think protects your prime holdings is the same moat drowning your early-stage investments. Your small companies are not competition for the primes; there is plenty of room for both to be successful.

For the Policy Wonk, the pitch is precision. A control regime that treats a drone like an ATACM has no credibility left to spend when it actually needs to stop something dangerous. Overcontrol is how you get evasion; targeted control is how you get compliance.

The Fix Already Exists: We Just Gave It to Two Countries

We do not have to invent anything. In September 2024, the State Department stood up the AUKUS exemption, a license-free environment for defense trade, between pre-approved, vetted users, the United States, the United Kingdom, and Australia, fenced by an "Excluded Technology List" that keeps the genuinely sensitive items behind the wall. In an early three-month sample, only 18 percent of requests fell on the excluded list; the other 82 percent could move without a license. The mechanism works; State approved it six months ago.

So extend it, carefully, because this is the part the cynics should watch. AUKUS worked because State vouched for allies whose export-control systems were judged comparable to our own. Thirty-two NATO members are not thirty-two equal risks, so the honest version of this is tiered: the most-trusted governments first, each on its own comparability finding. Build a NATO Trusted Trade tier on the same architecture: license-free authorization for vetted allies on the commodity tier, a narrow excluded list. Industry's loudest complaint about AUKUS is that the list is already too broad. Then build a small-business fast lane that waives the registration toll for firms below a revenue threshold. Keep the wall. Widen the gate. Stop making a startup spend its entire budget on compliance lawyers to sell drones to Poland.

I have spent a career watching good technology lose to bad processes. This is the purest example I know. The threat is real, the fix is proven, and the only thing missing is the will to admit that a rulebook written in the era of glacial weapons development is actively kneecapping the fast, cheap, disposable systems that are winning wars right now. Europe wants viable technology. Our young innovators are starving for a customer. ITAR is standing between them, collecting a $3,000 toll, and calling it national security.

I am not naive about post-sale diversion to China. The real leak in a trusted-ally tier is not China raiding our startups; it is a vetted ally re-exporting onward. This is why truly sensitive items stay behind the wall. A trusted-ally tier is only as good as the "trusted" part: the whitelist has to be policed, the excluded list has to be honest, and end-use monitoring has to be real. I will not pretend reform fixes everything. For some European governments "ITAR-free" is industrial policy, a way to protect their own primes and their own jobs. No amount of American good behavior erases that motive. But reform removes the legitimate excuse, and keeps our companies in contention where today they are auto-excluded. The answer to a blunt instrument is a sharper one, not no instrument at all.

We wrote the words "ITAR-free" onto our allies' marketing brochures ourselves, one anachronistic rule at a time. The question is whether we notice in time to erase them, or we keep guarding the henhouse until the last American startup gives up and the last European customer stops asking. Who are we protecting, and from what?

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Your phone buzzes with a text from your bank: “Did you authorize a $2,400 transfer? Reply NO to stop it.” You reply, and seconds later a calm “fraud agent” calls, knows your name and the last four digits of your card, and walks you through “securing” your money by moving it into an account under the criminal’s control. No password was stolen, no malware installed. You handed over the money yourself, because everything looked and sounded real.

This is the new face of bank fraud and business is booming. Behind these scams sit organized adversaries: nation-state actors who treat theft as state revenue, criminal gangs running industrial-scale scam operations, and hacktivists out to embarrass institutions increasingly armed with AI that makes their lies cheap, fast, and tailored to you.

The problem: scams have gone industrial

Banks have spent decades hardening their vaults and networks, so attackers shifted to the softest target: the customer. Rather than breaking in, they trick people into transferring funds themselves. This is “authorized push payment” fraud where the victim approves the payment and it is far harder to claw back than a stolen card number. To hear how a typical scam call actually unfolds, watch the FTC’s short imposter-scam explainer.

With the age of AI, three key forces have turbocharged these threats. Payments now move instantly and irreversibly, so money is gone before anyone notices. Decades of data breaches let criminals buy your name, address, and account details cheaply, making their scripts eerily accurate. And generative AI has industrialized deception where more than half of fraud is now estimated to involve AI. A criminal can clone a familiar or family voice from seconds of audio, write flawless phishing emails in any language, and even deepfake a bank officer on a video call.

The people behind it are not lone hackers in hoodies. They range from sanctioned nation-state groups that steal to fund their governments, to criminal syndicates running scam centers staffed by trafficked workers, to hacktivists attacking banks to make a political point. For them, fraud is a scalable business and it is outrunning the banks, telcos, and Big Tech.

The real-world cost

The damage is measured in real households. The Federal Trade Commission reports Americans lost roughly $16 billion to fraud of all kinds in 2025 the highest on record and about 25% more than the year before. Imposter scams alone accounted for $3.5 billion, nearly tripling since 2020, and the single most lucrative version is the fake bank-security alert that convinces people to “protect” their savings by moving them.

These losses fall unevenly. Americans aged 50 and older reported $4.3 billion in losses in 2025, often life-altering sums drained from retirement accounts. The official numbers are almost certainly a fraction of reality, since many victims never report out of shame. Beyond the dollars, the human cost is real emptied college funds, missed mortgage payments, and a corrosive loss of trust in the financial system people rely on every day. One Florida couple lost $42,000 of their savings this way watch how it happened. In fact, this happens so often that Hollywood created an action movie about it with the Bee Keeper.

A National Security issue

Fraud and scams are not just a nuisance but far more dangerous. Fraud and scams in the United States have escalated into a national security issue because they are no longer isolated consumer crimes. They are large‑scale, foreign‑run operations that drain billions of dollars from the U.S. economy and undermine public trust in financial and digital systems. Federal agencies increasingly link these schemes to transnational criminal organizations, some of which also engage in human trafficking, money laundering, and other activities that threaten national stability. The financial impact is massive, with losses rivaling major illicit industries, and the proceeds often flowing to adversarial nations or criminal networks abroad.

The rules already on the books

The U.S. is not starting from zero. Along with the growth of the early Internet, in 1999 the Gramm-Leach-Bliley Act went into effect and its Safeguards Rule in requiring banks to protect customer data, and guidance from the Federal Financial Institutions Examination Council (FFIEC) pushes them toward stronger, multi-factor login security. The Bank Secrecy Act and anti-money-laundering rules, enforced by the Treasury’s FinCEN, require banks to flag suspicious transactions — a key tool for tracing stolen funds. New York’s Department of Financial Services Part 500 cybersecurity rule has become a de facto national standard.

Regulators are also targeting the scams themselves. The FTC’s Impersonation Rule, in force since April 2024, lets the agency go after fraudsters who pose as businesses or government agencies; in its first stretch it produced more than $70 million in consumer refunds. Voluntary frameworks like the NIST Cybersecurity Framework give institutions a common playbook.

The gap is not the absence of rules it is that attackers move faster than rules can be written, and that liability for scam losses remains murky when a customer is tricked into approving the payment. So, with all these rules and regulations, why are scams and fraud occurring faster?

The innovators fighting back

A fast-growing wave of companies is using the same AI that empowers criminals to stop them.

· Feedzai builds real-time systems that score billions of transactions as they happen, spotting the subtle patterns of a scam in under a second.

· Alloy helps banks and fintechs verify who is really opening an account, choking off the synthetic and stolen identities fraudsters depend on.

· Arkose Labs specializes in blocking automated bot attacks and account takeovers, while SEON, Lexus Nexus, and Sumsub offer identity-verification and fraud-screening tools that smaller banks and startups can plug in affordably.

· Netcraft is a company which doesn’t only detect scams but does something about it. It is very good at “take downs” of scam networks.

· Others are racing to build deepfake and voice-clone detection to catch fakes that fool the human ear and eye. Others get creative: UK carrier Virgin Media O2 built “Daisy,” a lifelike AI “granny” that answers scam calls and keeps fraudsters rambling for up to 40 minutes to tie them up so they have no time for real victims. Watch “Daisy” turn the tables on scam groups.

What unites all these is adaptive defense models that learn daily, because last month’s fraud pattern is already obsolete. All these point solutions are modeled on Intellectual Property that slows sharing. This model is not working.

What America should do

As scams become more sophisticated, especially with AI‑driven impersonation, deepfakes, and automated fraud, their ability to destabilize institutions, exploit citizens, and weaken economic resilience has pushed policymakers and security experts to treat fraud not just as a consumer protection problem, but as a strategic threat to national security. Staying safe will take coordinated effort. Everyone has a role.

Lawmakers and regulators

Fraud and scam laws in the United States, the United Kingdom, and Australia share the same objective: to protect consumers and disrupting criminal activity but each country approaches the problem with a very different regulatory philosophy.

In the U.S., the system is fragmented and enforcement‑driven, with no mandatory reimbursement for most scam victims and a heavy reliance on agencies like the FTC, CFPB, and FBI to pursue wrongdoing after the fact. By contrast, the U.K. has built the world’s most proactive framework, requiring banks to reimburse victims of authorized push‑payment scams, enforcing account‑name verification through Confirmation of Payee, and placing clear accountability on financial institutions to prevent fraud before it occurs. Australia sits between the two models, adopting U.K.‑style protections while expanding responsibility beyond banks to include telcos and digital platforms through its emerging Scams Prevention Framework. While the U.K. emphasizes consumer protection and the U.S. emphasizes enforcement, Australia is moving toward a shared‑liability, cross‑industry approach that recognizes scams as a systemic risk requiring coordinated prevention across the entire digital ecosystem.

A typical scam today uses several pieces of technology working together to make the criminal look real. It often starts with:

1. the scammer creating a fake website that looks almost identical to a bank or delivery company. They buy a cheap web address from a service like GoDaddy and change just one letter so most people won’t notice the difference.

2. Then they setup email accounts on services like Microsoft & Gmail to send out massive emails.

3. They use AI tools to scrape millions of social media profiles from Facebook, Instagram, etc. to collect data about YOU.

4. They use tools that let them fake a phone number (telco), so when they call you, your phone shows the name of your bank or a government agency.

5. After that, they send out text messages to iPhone and Android users that look official, things like “Your account is locked” or “You have a package waiting.” The link in the text takes you to the fake website, where the scammer collects your login details. If you call the number instead, it goes to a call center where the scammer pretends to be a bank employee.

All of this: fake websites, spoofed phone numbers, and realistic text messages works together to trick people into believing they’re talking to a trusted company when they’re actually dealing with a criminal.

What should the Critical Infrastructure do?

In the U.S., we have failed because we have not worked together across these technologies at scale & at the speed of AI. Why? Because we (collectively) do not have the incentives or requirements to do so. For the CEOs of these companies, they do not want to spend money & resources which do not drive revenue. Period.

There are glimpses of hope. A working model already exists:

· We have the Financial Services Information Sharing and Analysis Center (FS‑ISAC) is a global, nonprofit organization that helps protect banks and other financial institutions from cyberattacks by enabling them to quickly share information about threats. It was created in 1999 (26 years!) to strengthen the safety and resilience of the financial system by collecting, analyzing, and distributing timely intelligence about cyber and physical risks so that member institutions can defend themselves and their customers more effectively. I am hopeful that they new CEO, Valerie Abend will drive more effective solutions.

· In 2026, eight major carriers: AT&T, Verizon, T-Mobile and others just launched the Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC), chaired by longtime cyber expert, AT&T security chief Rich Baich, to share real-time threat intelligence across competitors. Because most scams ride phone and text networks before they ever reach a bank, telecom and banking defenses should connect through the same kind of collective-defense sharing. But the C2 ISAC cannot do this alone.

· In 2025, the Global Anti‑Scam Alliance (GASA) was formed to bring together governments, financial institutions, technology companies, law‑enforcement agencies, and consumer groups to fight scams on a global scale. GASA acts like a global “anti‑scam task force,” uniting experts and institutions so people everywhere are better protected from online fraud.

These have proven to not operate effectively to get ahead of scams and fraud. We need a better way – mandates of sharing, legal risks support, cross ISAC/intel which is tailored/aware, good native ML & AI models (not rules), and others working at speed and context with more transparent sharing.

In the meantime,

What should consumers do?

Treat any unexpected “urgent” message about your money as a warning sign, not a command. Banks will never ask you to move funds to “protect” them. Hang up and call the number on the back of your card. Turn on multi-factor authentication and agree on a private “safe word” with family so a cloned voice can’t fake an emergency. Report scams to ReportFraud.ftc.gov, even unsuccessful attempts, because the data helps train good AI/ML models to protect everyone.

What should all companies do?

Adopt adaptive, AI-native detection rather than yesterday’s rules, and design apps that help customers pause before they act. Investors should back the firms building deepfake detection and identity verification, and banks should partner with them quickly instead of waiting years to build in-house.

Conclusion:

With fast innovation, fraud & scams will not disappear, but it can be better contained. The criminals have industrialized deception; the answer is to industrialize defense with smarter rules, sharper technology, and a public that knows the warning signs.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Five intelligence services rarely speak with one voice. When they warn the window of vulnerability has narrowed to months, the real question is whether the defenders can move as fast as the threat.

Throughout my years in the intelligence world, I don’t recall a single instance in which the Five Eyes partners jointly issued a public warning, so when they do, the message lies in the act as much as the words. Intelligence agencies guard their assessments and share them sparingly, almost never in the open. So, when the United States, United Kingdom, Canada, Australia, and New Zealand jointly warned on June 22 that frontier AI models capable of serious cyber exploitation are only "months away" from broad availability, the unanimity was itself a clear message. "The timeline is not years, it is months," they wrote.

The warning the Five Eyes partners shared is specific. These are systems that let a non-expert coordinate a complex intrusion (work that until recently required a trained team fluent in reconnaissance, exploitation, and stealth). That capability is moving out of the hands of advanced nation states and into the reach of mid-tier criminal groups and other adversaries. As the barrier to a sophisticated operation fall, the target list grows, and the systems most exposed are the ones a country cannot do without hospitals, water and power utilities, community banks, ports, and the contractors that serve them.

There is one caveat to mention. Outside experts who examined the models argued they do not represent a wholly novel threat, and the agencies concede their core remedy is familiar: fix the basics, patch faster, control identity and access. The fundamentals still decide most outcomes. What has changed is speed and, with speed, potential volume. The vulnerability was always there, and AI simply finds it faster and puts that reach into more hands.

For national security planners, "months" is the word that should capture attention. Strategy assumes time, and much of the architecture protecting critical infrastructure was built for an era when a capable intrusion took a capable organization. AI collapses that assumption. A defensive posture written to last three years can be overtaken before its first review, and the slowest links (legacy systems and sluggish patching) are the points an adversary will reach first.

Washington has begun to respond. Executive Order 14409, signed June 2, is best read as the opening move in a national security framework for frontier AI. It directs the NSA and CISA to benchmark in classified settings when a model's cyber capabilities make it a "covered frontier model," and it asks developers to voluntarily give the government up to 30 days of access to such models before release. It stands up an AI cybersecurity clearinghouse — led by Treasury — to coordinate the discovery and patching of vulnerabilities, and it directs the Justice Department to prosecute those who turn AI against American computer systems. It also pushes to put defensive AI into the hands of the institutions least able to defend themselves: rural hospitals, community banks, and local utilities.

The order is also a move in a broader contest. Representative Andrew Garbarino, who chairs the House Homeland Security Committee, said the same week that China is "months, if not now weeks, away from achieving frontier AI capabilities comparable to those of the United States." Washington has already moved to restrict the export of a leading frontier model on national security grounds. Whoever fields these capabilities first, and whoever sets the terms for evaluating and controlling them, will shape the rules others must live by. That competition runs straight through the private companies that build the models and the critical infrastructure an adversary would target.

All of this points to the real test. If frontier AI can accelerate attacks, it can accelerate defense, and the side that equips its defenders faster holds an advantage. Programs that put defensive AI into the hands of critical-infrastructure operators, such as Anthropic's Project Glasswing and OpenAI's cyber-defense access effort, are early attempts to give defenders a head start in finding and fixing flaws before they are exploited. The harder problem is people. Models do not run themselves, and the expertise to direct them, in a utility control room or a hospital network, is scarce and unevenly spread across exactly the sectors most at risk.

This is where national security and the private sector stop being separate conversations. Most critical infrastructure is privately owned and operated, which means the front line of national defense now runs through companies whose first duty is to investors and shareholders. The operators that can name the AI systems they rely on, assume their adversaries now carry capable co-pilots, and test their defenses against machine-speed intrusion are the ones that will fare best.

All of this argues for a different compact between government and industry, grounded in shared purpose. Major developers, critical-sector operators, and the national security agencies need to engage early and honestly on the most dangerous capabilities, the way Executive Order 14409 suggests. And the country must invest in defensive AI and in the people who wield it, so the defenders of American systems keep pace with their attackers.

I spent decades in the world of intelligence, much of it managing risk where the cost of getting it wrong was measured in much more than money. The warning the Five Eyes issued this month is the kind that professionals will take seriously. The timeline is tight, and the targets are the systems a society runs on. Frontier AI will define the next era of national power, and the open question is whether the defenders get their co-pilots before the attackers’ finish deploying theirs.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

There are 65 active state-based conflicts in the world today, according to the Uppsala Conflict Data Program. That is not 65 separate crises. It is 65 living laboratories.

The contest that matters is not understanding any one of them. It is recognizing the 66th — the next emerging theater — while it is still only a collection of weak signals. The war before the war has already begun, and it will be won by whoever learns fastest.

For generations, intelligence organizations competed to collect more information. Tomorrow, they will compete to learn faster. Since every adversary is becoming a learning organization, our advantage must become organizational learning — and organizational learning at this scale requires infrastructure we have not yet built.

That infrastructure includes a Digital Twin Network.

The Network, Not the Twin

The objective is not to build a better digital twin. It is to build a Digital Twin Network capable of recognizing the 66th emerging theater before it becomes obvious.

Imagine a living network of thousands of interconnected digital twins — not only of nation-states, but of terrorist organizations, criminal syndicates, cyber groups, critical infrastructure, financial systems, media ecosystems, shipping networks, supply chains, political movements and emerging technologies. Every important actor, network and system has a continuously evolving twin.

Each twin learns independently. Collectively, they learn exponentially.

The value is not in the individual twins. It is in the conversations among them. Every observation by one twin makes the entire network smarter. A political crisis in Bosnia immediately updates neighboring political, economic and alliance twins. A cyberattack against critical infrastructure causes financial, media, logistics and influence-network twins to reassess their own environments. A new disinformation tactic discovered in one region is instantly tested against every other emerging theater.

The network does not simply share information. It shares learning.

This is the shift that matters: from monitoring individual events to understanding how thousands of interconnected systems evolve together. From storing information to accumulating learning. From asking “What happened yesterday?” to asking “What is becoming more likely tomorrow?”

What the Network Looks Like in Practice

Picture a digital twin of Bosnia, Moldova or the South China Sea that updates every minute. Every political speech, troop movement, satellite image, shipping pattern, cyberattack, financial transaction and social media narrative automatically changes the model. We move from “what happened” to “what is most likely to happen next.”

AI agents do the work, each with a job. One reads every speech. Another tracks every satellite image. Another looks for new alliances. Another measures the speed of narratives. Together they integrate political developments, military movements, economic indicators, migration, social sentiment, infrastructure, weather, cyber activity and media into a single continuously updated model — one that can identify change in seconds, minutes and hours, and simulate the impact of future actions.

The ability to rank the most successful future actions, based on analysis of hundreds of potential outcomes, changes how we think about red teaming in cognitive security. We will be able to build a synthetic example of every adversary of any size, and to simulate every scenario continuously.

It will be on us to feed in the right inputs. What emerges is a global learning graph of active conflicts — every lesson, every pattern, every conflict feeding better insight in real time.

How the Network Learns: Observe, Learn, Adapt

Conflicts are like a staircase: pressure, politics, perception, prosperity, partnerships, posture, provocation. Every conflict climbs the staircase differently. A network that can read that staircase across every theater at once needs three disciplines.

Observe. We are good at collection. We will benefit from a common structure that makes our observations legible to AI. As an example, The Seven Layers of Emerging Theater Intelligence (SETI) gives every twin the same language for evaluating how adversaries evolve before open conflict:

Pressure — Are underlying conditions becoming less stable?

Politics — Are institutions losing the ability to manage that pressure?

Perception — Is someone deliberately shaping how people interpret events?

Prosperity — Are economic tools becoming instruments of competition?

Partnerships — Are actors beginning to choose sides?

Posture — Is capability being positioned?

Provocation — What event could rapidly accelerate escalation?

Learn. The measure of the network is its learning velocity — how quickly it improves after every observation. Every conflict becomes a research dataset where the network continuously asks: Which indicators appeared earliest? Which signals were ignored? Which combinations proved most predictive? Which assumptions proved wrong? Which interventions slowed escalation? Which technologies changed outcomes?

Adapt. The network tracks how media and technology are evolving and how they will change future tactics. Whether it is artificial intelligence, autonomous agents, commercial satellite imagery, cyber capabilities, sensors, recommendation algorithms or open-source techniques, we watch how each one shortens the distance between pressure and politics, perception and partnerships, posture and provocation.

All of it feeds back into the twins. SETI gives the network a common language; learning velocity gives it a scorecard. Together they make the network something fundamentally different from today’s intelligence systems — a living research community that studies all 65 active conflicts every day and asks the same questions of each. Which pressures are increasing? Which partnerships are changing? Which narratives are spreading? Which actors are learning fastest? And, most important, where is the next theater beginning to resemble the early stages of previous conflicts?

The Scale of the Build

This is why the build matters, and why it must begin now. A network worthy of the threat means digital twins for every nation-state adversary, roughly 100 foreign terrorist organizations, 500 major transnational criminal organizations, 300 state-sponsored cyber groups, hundreds or thousands of hacktivists, 600 militias, insurgencies and armed non-state actors, and thousands of influence and disinformation networks.

That represents a good start.

As AI, autonomous agents and eventually quantum computing mature, the scale of continuous learning will expand dramatically. The future of intelligence will belong to organizations that treat every conflict as a learning system, every emerging theater as a research project, and every observation as a chance to improve faster than their adversaries.

The Only Question That Matters

The race is no longer to understand today’s 65 conflicts. It is to recognize the 66th emerging theater before anyone else — while it is still only weak signals.

That is a contest of learning, and learning at that scale cannot be improvised in the moment a crisis arrives. It has to be built in advance. The Digital Twin Network is that build.

The war before the war has already begun. The only question is whether we will have the network in place to see it.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief