THE FBI has published its first Cyber Strategy, dated 9 September 2026, outlining how the agency intends to investigate and disrupt cyber threat actors and “impose cost” on those who target the United States. The document frames a shift towards proactive disruption, with operations aimed at dismantling adversary infrastructure, seizing assets such as stolen cryptocurrency, and taking down pervasive ransomware, while emphasising rapid victim notification and joint, cross‑agency efforts.
The strategy is presented as part of a broader US government move towards proactive disruption rather than solely pursuing prosecutions years after incidents. A notable political backdrop referenced in the piece is a memorandum signed in August permitting federal law enforcement to collaborate with private firms on offensive cyber actions against foreign threat actors.
The strategy is organised around four pillars. First, Investigate, Disrupt, and Impose Cost on Cyber Adversaries, which describes threat identification, timely victim alerts, and targeted operations to incapacitate infrastructure and currency flows, employing what the FBI calls a “best athlete” model to recruit the strongest authority for each phase.
Second, Support Victims, emphasising rapid threat‑intelligence sharing and automated indicator exchange to speed containment and recovery, with heightened focus on critical infrastructure and an expanded ICS Coordinator programme. Third, Increase Impact Through Partnerships, signalling stronger coordination with government, allies, and the private sector through programmes such as the CISO Academy, Cyber Executive Summits, and LinCY.
Fourth, Enhance FBI’s Cyber Capabilities, including AI‑enabled tools for data triage, malware analysis, victim notifications, attribution, and ongoing cyber‑talent development via CETU.