Lawmakers Urged to Let US Take on ‘Offensive’ Cyber Role

China and other foreign adversaries are launching persistent, large-scale campaigns against U.S. critical infrastructure with little cost or consequence, cyber policy analysts warned lawmakers Tuesday.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

A panel urged the House Homeland Security subcommittee on cybersecurity and infrastructure protection to overhaul authorities and accelerate offensive cyber operations, arguing that Beijing and other major threat actors view persistent access to sensitive U.S. networks as a low-risk, high-reward component to their geopolitical strategies.

Panelists said the gap has allowed foreign actors to gain footholds across critical infrastructure networks while preparing for potential future conflict with the United States in a move that could hinder an effective counter response.

“The United States is not postured to deter or defeat its adversaries in cyberspace,” said Joe Lin, CEO of the venture-backed cyber warfare start-up Twenty. “By contrast, our response is unnecessarily constrained, particularly in the use of offensive cyber.”

Panelists pointed to recent cyberattacks targeting U.S. water systems – as well as China’s Volt Typhoon campaign – as evidence that cyber operations pose direct risks to civilian safety. The analysts also called for improved interagency coordination around combatting and deterring offensive cyber operations, noting how adversaries are exploiting major gaps between military, intelligence, law enforcement and civilian agencies (see: Report: US Cyber Defense Declines, First Time in 5 Years).

“U.S. cyber policy must move beyond reactive, episodic responses and toward a durable posture capable of operating effectively in an era of continuous foreign intrusion,” said Frank Cilluffo, director of the McCrary Institute for Cyber and Critical Infrastructure Security. He called on Congress to clarify interagency roles and responsibilities while “improving mechanisms for information sharing with trusted private-sector partners.”

“We should not rely on authorities and assumptions built for a different era,” he added. “Strategic competition in cyberspace demands sustained engagement, clearer governance and a realistic appreciation of how offensive and defensive actions interact to shape adversary behavior.”

The warnings come as the White House and Capitol Hill grapple with how cyber operations fit into broader concepts of geopolitical deterrence tactics, escalation and retaliatory measures and homeland security. Washington has largely treated offensive cyber capabilities as a tightly controlled and often reserved tool rather than a component of sustained campaigns against adversaries, according to the analysts (see: US Must Go on Offense in Cyberspace, Report Warns).

Several witnesses said a shift toward “defend forward” and expanded authorities for Cyber Command marked an important step toward more proactive operations. But they also said those changes have not fully translated into a coherent, whole-of-government approach to deterrence.

“Nation states are relentless,” said Drew Bagley, vice president and counsel for privacy and cyber policy of CrowdStrike. Bagley urged the public-private cybersecurity community to “radically increase the operational tempo of malicious infrastructure disruptions and takedowns.”

The White House has signaled plans over the past year to lean into a more offensive cyber posture. The administration is also reportedly considering expanded partnerships with private industry to help launch offensive cyber campaigns against foreign targets – a significant shift from purely defensive approaches, analysts said (see: China, AI and a Federal Retreat Set Cyber Agenda for 2026).