White House Cyber Chief Urges Offensive Response to Threats

A top Trump administration cybersecurity official said the United States must destigmatize and normalize offensive cyber as a valid and necessary tool for national security.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Offensive cyber is an essential instrument of deterrence and power projection when used proportionally in response to foreign aggression, said Alexei Bulazel, National Security Council Senior Director for Cyber at The White House. He said the hesitance of prior administrations to use offensive cyber in meaningful ways emboldened adversaries by normalizing U.S. passivity and lack of retaliation to cyber aggression.

“If you continually let the adversary walk all over you and hack you and you do nothing, that in itself is a norm with the adversary that America is not going to respond,” Bulazel told RSAC 2025 Conference attendees Thursday. “That this is fine. That this is acceptable behavior. You need to find some way to communicate that this is not acceptable.”

Bulazel returned to the White House earlier this year after serving in the National Security Council during the end of the first Trump administration. This time around, Bulazel will be tasked by leading efforts to shape national cyber policy, oversee federal cybersecurity initiatives, protect critical infrastructure and counter evolving cyberthreats (see: US Homeland Secretary Kristi Noem Details Cyber Strategy).

Green Lighting a Forceful Private Sector Response

Bulazel is concerned about the inability to private companies to respond to attacks beyond their own network borders, and argued for redefining the boundaries of what the private sector is legally allowed to do in cyberspace. He said government often fails to protect the private sector from advanced threats, adding that pre-positioning in corporate infrastructure should be treated as a national security incident.

“If you had a terrorist organization or a foreign military putting packs of C-4 [explosives] around a company’s buildings or around critical infrastructure, we would very clearly see that as very provocative, as an attack,” he said. “You’d have law enforcement response, military response. When we see the same in cyber, somehow it’s kept as this separate thing, ‘You should have better protection in your company.'”

The cyber regulatory environment has become complex and fragmented, and he said harmonization across sectors – particularly in critical infrastructure – is an urgent need. Rather than layering agency-specific or sector-specific mandates, Bulazel advocated for a baseline of core cybersecurity principles that can apply across critical infrastructure, as well as clearing away duplicative or contradictory rules.

“Maybe a core set of regulations around four things that cannot fail, particularly critical infrastructure, and then keeping that baseline aligned and calibrated and sort of light touch,” Bulazel said. “So I think you’ll continue to see efforts like that.”

Shifting CISA’s Focus Away From Disinformation

Bulazel argued that CISA must remain laser-focused on its original mandate of cybersecurity and infrastructure security and avoid mission creep into areas like disinformation. He said director nominee Sean Plankey brings both technical experience and prior NSC experience, and said CISA’s focus on helping less technically mature federal agencies complement NSC’s role in protecting classified systems.

“It’s got two things in its name that should stay 100% focused on, which are cybersecurity and infrastructure security,” Bulazel said. “Not disinformation, not crazy flights of fancy, not education, not white papers or conferences. Just stay laser-focused on the day-to-day work of cybersecurity, particularly for critical infrastructure and for civilian agencies” (see: White House Proposes $500 Million Cut to CISA).

Bulazel said he supports the concept of a Cyber Safety Review Board but pointed to challenges around conflicts of interest, limited independence and an inappropriate model borrowed from aviation incident review. The Trump administration in January disbanded all Department of Homeland Security advisory committees, including the Cyber Safety Review Board.

“It’s also challenging to bring external experts in and then try to mitigate conflicts of interest, when you’re having them look at competitors or peers in their space – or a company that they used to work at – and giving them very deep access,” Bulazel said.

Bulazel remained neutral on the ongoing debate over whether the National Security Agency and the U.S. Cyber Command should be led by the same person, but acknowledged this structural issue remains unresolved. He referenced upcoming legislative studies that will assess alternative models and affirmed the administration’s willingness to explore new cyber force structures.

“I know Secretary Hegseth said in his confirmation remarks that he would put an end to this debate once and for all and figure out a way forward,” Bulazel said. “There’s no particular position one way or the other, but we are always interested in, ‘How can we best address the cyber challenge we have?’ And ‘How can we best have a workforce and a military force that’s going to meet the operational needs we have?'”