National Interest

by Pat Fallon

    As artificial intelligence rapidly expands the cyber threat frontier, public-private cooperation is needed to defend the digital domain.

    Last week, several components of the US intelligence community and law enforcement apparatus, including the FBI Cyber Division and NSA Cyber team, issued notices that a major cyberattack, referred to as PHP2Shell, exploited a critical vulnerability that puts over 70 percent of websites at risk.

    Nearly every major website of every US industry is under threat, from software companies to large US banks to telecommunications providers and scientific labs. These targets share the same programming language: PHP. This programming language is vulnerable because it has a low barrier to entry, making it easy for inexperienced developers to write code with common, easily exploitable flaws.

    Many companies have reported AI agents, also called agentic superintelligence (SI), attempting to breach their cyber defenses and disrupt customer operations; once inside, these agents can access sensitive private data. While details of last week’s attack are still emerging, two truths are clear: an attack of this scale puts nearly every American at risk and the cybersecurity landscape has changed significantly in the age of agentic SI.

    Mounting threats from agentic SI lay bare the stark reality of our modern digital domain. Both private companies and government agencies must reassess how they defend against cyberattacks. For too long, the US government’s response to cyberattacks such as PHP2Shell has been fragmented because our cyber defenses have been siloed, preventing agencies from sharing timely information with each other and with the public. Our patchwork of redundant, time-consuming measures has led to uninformed responses and reduced visibility into the cyber threat landscape.

    Gaps in government cyber defenses have allowed gangs, cartels, transnational criminal organizations (TCO) and non-state actors to defraud, disrupt and continuously attack the American people and American businesses. Thankfully, the Trump administration is making real progress towards a solution. The National Coordination Center (NCC), outlined in President Donald Trump’s Executive Order 14390 from March of this past year, is a major improvement in how we deter cyber threats from an organizational perspective.

    The NCC is a combined effort between the Department of Justice (DOJ) and the Department of Homeland Security (DHS), with support from the secretaries of state, treasury, defense, the attorney general and the national cyber director. Their mission is to serve as the hub for a dedicated, cyber-focused operational cell that centralizes detection, disruption and deterrence of foreign TCO cyber threats. This brings defense frameworks, information sharing, threat detection and response decisions under one roof, so our entire digital defense apparatus moves with one voice in the same direction.

    I’m proud to support President Trump and the NCC with my new legislation, the National Coordination Center and Commercial Cyber Capabilities Codification Act, which would make the NCC permanent and unleash our commercial cyber sector’s unmatched ability to detect, disrupt and deter a new era of cyber threats.

    But even with the NCC established, we must admit the US government cannot conquer this new era of cyber threats alone. The United States is home to the world’s most successful, innovative and exceptional technology companies. We must leverage the speed and agility of our private-sector partners to secure the digital domain and suppress foreign threats that seek to harm our country.

    In addition to codifying the NCC, my bill also solidifies National Security Presidential Memorandum (NSPM) 15, issued by President Trump this past August. This memo expands on EO 14390 and our national cyber defense industrial base by allowing vetted US private-sector companies to conduct cyber surveillance and offensive disruption operations against foreign cyber-enabled transnational organizations (CE-TCOs).

    This would allow private-sector companies to respond quickly to and confront cyber threats to their firms and customers. These companies have much broader insight into the cyber threat landscape and are on the front lines of cyber defense each day. By removing the latent response and approval process from our current structure, we shift the entire paradigm of the cyber domain.

    Combined with growing private-sector capabilities in superintelligence, cryptography and advanced computing power, the US government and private-sector partners can move beyond reactive cyber defense and take the initiative to identify and target potential threats ahead of time. Bringing our most critical sectors—large financial institutions, healthcare providers, oil and gas producers, critical infrastructure entities and telecommunications and internet providers—into the cyber fight is key to improving our country’s cyber defenses.

    It is time for the US government to rethink and restructure our cyber capabilities and I stand ready to support President Trump and our private-sector partners as we work to secure our digital domain and protect the American people. My message to our cyber adversaries is clear: if you come for the best, you’re going offline like the rest.