What Is Cyber Warfare?

Cyber warfare is the use of digital attacks by state actors or state-directed groups against the computer networks, information systems, and critical infrastructure of an adversary state, with objectives ranging from intelligence collection and sabotage to physical disruption and the shaping of strategic outcomes. It extends traditional concepts of armed conflict into the cyber domain, applying military and intelligence capabilities through networks rather than through kinetic means. Targets span military command-and-control systems, defense industrial supply chains, national financial infrastructure, and civilian services whose disruption would impose costs on the adversary's economy or population.

The concept emerged in defense and security literature in the 1990s as nation-states began organizing dedicated cyber operations units and investing in both offensive capabilities and defensive hardening. Its legal status under international law, including whether cyber operations constitute acts of war and when they trigger rights of armed response, remains an active area of policy and scholarly debate.

Offensive Cyber Operations

Offensive cyber operations involve the deliberate penetration of adversary computer networks to collect intelligence, pre-position for disruption, or directly damage systems and equipment. CISA's documentation of nation-state cyber actors identifies sustained offensive programs operated by state actors who target critical infrastructure networks with the aim of mapping systems, stealing sensitive data, and creating the capability for future disruptive action.

The technical toolkit of offensive cyber operations includes custom malware engineered to avoid detection, exploitation of zero-day vulnerabilities in widely deployed software and firmware, supply-chain compromises that insert malicious code into software or hardware before it reaches the target, and social engineering campaigns against personnel with privileged access. The 2010 discovery of the Stuxnet worm, which caused physical damage to centrifuges in Iranian nuclear enrichment facilities, demonstrated that software-based attacks could achieve effects previously associated only with kinetic military action.

Defense of Critical Infrastructure

The defensive dimension of cyber warfare focuses on hardening the systems that underpin national security and essential civilian services. Lawrence Livermore National Laboratory research on defending critical infrastructure describes the challenge of protecting industrial control systems that were often designed before network connectivity became standard and that cannot easily be patched or isolated without disrupting the physical processes they govern.

Defensive strategies include network segmentation to isolate operational technology from internet-accessible systems, continuous monitoring for anomalous command sequences in industrial control environments, threat intelligence sharing between government agencies and private operators, and adversary emulation exercises in which defenders simulate how known offensive actors would approach their systems. Cyber warfare doctrine in most NATO member states now treats significant cyber attacks against critical infrastructure as events that may trigger the mutual defense provisions of Article 5, though the threshold for that designation remains deliberately ambiguous.

International Norms and Attribution

Establishing accountability in cyber warfare is complicated by the ease of routing attacks through third-party infrastructure and the difficulty of proving state authorization for an operation. The Tallinn Manual, a nonbinding academic document developed by international law scholars under NATO's Cooperative Cyber Defence Centre of Excellence, represents the most detailed attempt to apply existing laws of armed conflict to cyber operations. CISA's advisories on cyber threats reflect the operational intelligence that informs attribution decisions, identifying infrastructure, malware characteristics, and behavioral patterns associated with specific state actors.

Applications

Cyber warfare capabilities and defensive measures are applied across a range of national security contexts, including:

• Military command-and-control network protection and disruption
• Disruption of adversary logistics, communications, and weapons guidance systems
• Intelligence collection from foreign government and defense contractor networks
• Protection of financial clearing systems and energy grid operations
• Influence operations targeting public information environments