A practitioner’s view of the Trump administration’s new cyber policy

COMMENTARY: When I read the recently released U.S. cyber strategy from the Trump administration, my first reaction was mixed.

On the surface, the document signals strength. It emphasizes deterrence, a willingness to impose costs on adversaries, and a broader national security posture in cyberspace. Those are important signals in today’s geopolitical environment.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

But as someone who works on cybersecurity strategy and operations, I found myself asking a different question.

Where’s the operational strategy?

The document reads more like a national security messaging framework than a practical cyber defense roadmap. The central theme revolves around escalation.

The administration signals that significant cyberattacks may trigger responses beyond the cyber domain. This aligns with the long-standing concept of deterrence through cost imposition and the “defend forward” doctrine introduced by U.S. Cyber Command in 2018.

That’s not a new approach.

For years, U.S. cyber doctrine has emphasized disrupting adversaries before attacks reach American networks. The strategy reinforces that position, but it does not meaningfully expand it. Instead, it reiterates familiar language about imposing consequences on malicious actors.

While it's important to have deterrence, in and of itself, deterrence does not represent a cyber strategy.

The document also outlines several pillars: shaping adversary behavior, protecting critical infrastructure, and strengthening the cyber workforce. These are valid priorities. However, they are presented at such a high level that they lack operational value.

Effective cyber strategies answer practical questions:

These questions remain largely unanswered.

It’s a particularly problematic gap because the vast majority of critical infrastructure in the United States remains in private hands. Any realistic cyber defense strategy must therefore define how government and industry collaborate during incidents. Today, that collaboration remains fragmented across organizations such as CISA, sector-specific agencies, intelligence bodies, and private infrastructure operators.

Without a clear operational governance model, coordination during a national cyber crisis will remain difficult.

The strategy also feels familiar in its reliance on existing initiatives. The document highlights zero-trust architecture, cloud modernization, and protection of critical infrastructure. Yet these efforts are already embedded in previous policies, including the 2021 federal cybersecurity executive order.

Even the discussion around artificial intelligence in cybersecurity reflects a broader industry trend rather than a defined national capability.

Acknowledging AI is not a strategy. We need to build an operational AI-driven defense infrastructure – that’s a strategy.

More broadly, the document largely focuses on deterrence and resilience rather than addressing some of the structural weaknesses that continue to drive cyber risk across the ecosystem.

For example, the software supply chain remains one of the largest systemic vulnerabilities in modern digital infrastructure. The SolarWinds and Log4j incidents demonstrated how a single vulnerability can cascade across thousands of organizations. Yet, the strategy does not clearly address software accountability, vendor liability, or secure software development enforcement at a national level.

Similarly, vulnerability remediation remains one of the least mature areas of cybersecurity operations across both government and industry.

Organizations have become very good at discovering vulnerabilities. They are far less effective at fixing them. Security teams are overwhelmed with alerts, patch cycles are slow, and remediation often remains manual and fragmented. A national cyber strategy that does not address vulnerability remediation at scale misses one of the most important operational problems in cybersecurity today.

A truly modern cyber strategy would treat vulnerability management and remediation as national infrastructure challenges. It would encourage automated remediation capabilities, establish vulnerability transparency requirements, and promote coordinated national remediation programs across sectors.

The cyber policy document also falls short on breach transparency.

Today, many cyber incidents remain undisclosed or are reported long after the damage has occurred. Faster and more transparent breach reporting would significantly improve national situational awareness and collective defense. Yet, the strategy does not meaningfully advance this conversation.

And, most important, the document does not clearly define offensive cyber thresholds. If cyberattacks may trigger responses beyond cyberspace, what scale or type of attack crosses that line? Without clear thresholds, deterrence messaging risks becoming ambiguous rather than credible.

None of these gaps invalidate the document entirely. It does succeed in signaling intent. It communicates that the United States will take a more assertive posture in cyberspace and treat cyber threats as core national security issues.

That signal matters.

But strategy ultimately gets measured by implementation.

Real cyber resilience will not come from policy language alone. It will come from operational integration between government and industry, software accountability across the supply chain, national scale vulnerability remediation programs, and clearly-defined cyber deterrence thresholds.

Until those elements are addressed in detail, documents like this risk repeating a familiar pattern: strong messaging, ambitious goals, and limited operational change.

Cybersecurity has evolved dramatically over the past decade. National cyber strategies must evolve with it. Otherwise, they risk becoming exercises in posture rather than instruments of real defense.

Sagy Kratu, principal cybersecurity strategist, Vicarius

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.