A new European report on offensive cybersecurity points to a bigger challenge in cyber policy. Before we compare policies, capabilities, or strategies across countries, we need to make sure everyone is actually using the same terms the same way.

The European Cyber Security Organisation (ECSO) and Cyberhive recently released Framing Offensive Cybersecurity: Definitions, Market Dynamics, and Strategic Questions for Europe. The report covers Europe’s cybersecurity industry, investment landscape, and evolving cyber posture, but it also spends considerable time on a more basic question: what actually counts as “offensive cybersecurity” in the first place?

That’s a harder question than it sounds. Similar to what we explored through the Cyber Operations Policy Coalition (COPC), “offensive cybersecurity” isn’t one neat, clearly bounded category. The ECSO report pulls together activities that can differ significantly in purpose, scope, authorization, and risk. That makes the terminology itself an important part of the policy discussion.

One term, several kinds of activity

ECSO starts by separating the technical capability from the intent behind its use. Many cyber capabilities are dual-use. The same underlying technique can serve very different purposes depending on who is using it, where it is being used, under what authority, and toward what objective.

The report walks through a range of activities that includes vulnerability research, vulnerability assessment, penetration testing, red teaming, active cyber protection, and hack back. Those activities are not the same. Some take place entirely within an organization’s own environment to identify vulnerabilities or test defenses. Others are designed to simulate the behavior of an adversary and see how an organization responds. Active cyber protection, as ECSO describes it, may reach beyond the defender’s own network, while hack back raises a whole  different set of questions about acting against an aggressor.

Yet all of these activities can come up in discussions about a more “offensive” or proactive approach to cybersecurity. That is where the terminology becomes difficult. If the same broad term is being used for activities with different purposes, authorities, and risks, knowing that something has been described as “offensive” only tells us so much.

Europe uses “offensive,” but carefully

ECSO formally keeps Offensive Security, or “OFFSEC,” as one of the twelve categories in its cybersecurity taxonomy. It defines the category around solutions that test and exploit defenses in order to identify weaknesses and validate security controls before an actual adversary can exploit them.

At the same time, the report recognizes that the word “offensive” carries other meanings. In a specific note on terminology, ECSO explains that “offensive cyber capabilities” can suggest the private-sector development or use of cyber weapons in a military context, which is not how the report is using the term. Instead, it frames these capabilities primarily in terms of supporting defense and deterrence.

That distinction is useful because it shows why the term cannot really stand on its own. ECSO can use “Offensive Security” as a category, but it still has to explain what it means by the term, what it does not mean, and how the purpose behind a capability changes how that capability should be understood.

The U.S. conversation uses different language

In the United States, some of these questions have been framed around concepts like  persistent engagement and defend forward. ECSO mentions both in its discussion of the evolution of U.S. cyber strategy and describes them as approaches intended to enable more proactive operations closer to the source of adversary activity. That is different language from ECSO’s use of “Offensive Security,” but the terminology alone does not tell us whether the underlying activity is different or the same.

So comparing a European approach labeled “offensive” and a U.S. approach labeled  as “persistent,” “forward,” or “active” cannot start with the labels. We need to ask what activity is being described, where it takes place, who carries it out, what it is intended to accomplish, and under what authority.

The spectrum matters more than the label

One of the useful things about the ECSO report is that its own taxonomy shows just how much can sit underneath a broad term like “offensive cybersecurity.” Penetration testing is different from red teaming. Red teaming is different from active cyber protection. Active cyber protection is different from hack back. Those differences matter because each activity can involve different actors, authorities, objectives, and risks.

The report also points to the European Union’s Network and Information Security Directive 2, (NIS2), which describes Active Cyber Protection as active prevention, detection, monitoring, analysis, and mitigation using capabilities inside and outside the victim network, while excluding offensive measures.

That is a useful example of how the same general policy discussion can use terms differently. Activity that is described as “active” in one framework might appear within a broader discussion of “offensive cybersecurity” in another. The difference may come from the legal framework being used, which organizations are responsible for the activity, or where a government or organization has decided to draw the boundary around a particular term.

A useful transatlantic signal

The ECSO report does not use exactly the same vocabulary that appears in U.S. cyber policy discussions, and I do not think it should be read as if it does. What it does show is that Europe and the United States are dealing with a similar problem: cyber activity does not fit neatly into a simple defensive-versus-offensive framework.

There is a growing range of activity between purely defensive measures inside an organization’s own network and more consequential operations directed at an adversary. As governments, companies, and researchers consider what activity is appropriate across that range, the words used to describe it matter because those words can carry different assumptions about authority, intent, risk, and where the activity takes place.

That is particularly important when comparing approaches across the Atlantic. Before asking whether Europe and the United States are moving toward similar cyber postures, we should first ask whether they are talking about the same activities.

Different terms may describe similar approaches, just as the same term may mean something different depending on who is using it. Understanding those differences is an important starting point for the policy conversation.

‍