Cybersecurity policy has focused on improving information sharing, strengthening resilience, and expanding coordination between government and industry.

Those efforts remain essential. But as cyber threats become increasingly intertwined with geopolitical competition, economic coercion, terrorism, and nation-state conflict, security outcomes increasingly require action, coordination, and operational collaboration, not just information sharing.

That challenge led to the creation of the Cyber Operations Policy Coalition, which launched in Washington on June 4. Bringing together leaders from government, industry, academia, legal practice, and civil society, the Coalition seeks to advance responsible approaches to active cyber defense and developing policy frameworks for collective cyber defense.

Why a Cyber Operations Policy Coalition?

The Cyber Operations Policy Coalition was created to address different challenges than other cybersecurity coalitions in existence. As cyber threats increasingly unfold as sustained campaigns rather than isolated incidents, government and industry must move beyond simply understanding threats and toward coordinating action against them.

While many organizations focus on information sharing, awareness, or policy development, the Cyber Operations Policy Coalition is focused on the operational dimension of cybersecurity policy: the authorities, governance frameworks, and public-private relationships needed to achieve shared security outcomes.

That evolution has also exposed the need for greater clarity around the language used to describe cyber defense, active cyber defense, and cyber operations, topics explored in the Coalition's earlier discussion of the cyber defense lexicon. 

The Coalition exists to help advance those conversations and identify the policy frameworks needed to support effective collective cyber defense.

Cyber Operations Are Now a Core National Security Issue

In her keynote remarks, Morgan Adamski, PwC Principal for U.S. Cyber, Data & Technology Risk, described how cyber operations increasingly intersect with intelligence, economic security, military planning, and national resilience. Cybersecurity influences nearly every dimension of national power. Participants throughout the event discussed several challenges that will shape the next phase of cyber policy, including:

• Coordinating across sectors during large-scale cyber campaigns.
• Building trusted mechanisms for operational collaboration.
• Balancing agility with resilience.
• Developing governance frameworks that can keep pace with advances in artificial intelligence.
• Strengthening collective security while preserving privacy, transparency, and civil liberties.

A recurring concern throughout the discussion was fragmentation. As threats become more interconnected, responses must become more integrated. Effective cyber defense increasingly depends on the ability of organizations across government and industry to operate as part of a broader ecosystem rather than as independent actors.

Measuring Outcomes, Not Activities

Another theme that surfaced repeatedly was the need to focus on outcomes rather than activities.

During a conversation between Katie Sutton, Assistant Secretary of War for Cyber Policy and Principal Cyber Advisor to the Secretary of War, and Rob Joyce, Owner of Joyce Cyber LLC, the discussion centered on how the cyber domain has evolved and how organizations should measure success.

For years, cyber programs have been evaluated based on activities performed or information exchanged. Increasingly, however, policymakers are asking a different question: what outcomes are those activities producing?

Whether the goal is disrupting adversaries, strengthening resilience, supporting military operations, or protecting critical infrastructure, success depends on delivering operational outcomes. That shift has important implications for public-private collaboration. 

Industry possesses unique visibility, expertise, and operational capabilities across much of the infrastructure that underpins the cyber domain, while the government brings authorities, intelligence, and broader national security responsibilities. Achieving meaningful outcomes requires mechanisms that allow those complementary strengths to be applied more effectively in pursuit of shared objectives.

Participants highlighted the need to:

• Continue evolving from a "need to know" culture toward a "need to share" approach.
• Align acquisition and partnership models with mission outcomes.
• Clarify authorities, responsibilities, and accountability.
• Adapt organizational structures and workforces to emerging technologies, including artificial intelligence.

The discussion reinforced a broader point: future success will depend as much on institutional adaptation as technological innovation.

The Evolution of Industry's Role

Perhaps the strongest theme to emerge from the launch was the changing role of the private sector in cybersecurity.

Much of the infrastructure, visibility, and operational capability relevant to cyber defense resides outside government. As a result, traditional models that treat industry primarily as a source of products, services, or information are becoming increasingly inadequate.

Participants repeatedly emphasized the need to view industry as an operational partner in achieving shared security outcomes.

That shift reflects a broader evolution in cyber policy. Information sharing remains essential, but information sharing alone does not disrupt adversaries, defend critical infrastructure, or coordinate responses to ongoing cyber campaigns.

Achieving those outcomes requires deeper collaboration and greater operational integration between government and industry.

Discussions focused on the need for:

• Better alignment of incentives.
• Faster mechanisms for coordination during active cyber campaigns.
• Clearer authorities and responsibilities.
• Shared understanding of acceptable and responsible cyber actions.
• Stronger operational relationships built on trust and familiarity.

A discussion between Matthew Springer, Deputy Associate Director of the Joint Cyber Defense Collaborative and Bryan Ware, Founder of GraySpace Technology, reinforced this point. Looking toward the future of collective cyber defense, they highlighted the importance of developing more proactive approaches to counter advanced persistent threats, improving campaign planning and coordination, strengthening critical infrastructure resilience, and expanding operational communities organized around shared missions.

This movement from information sharing toward operational collaboration represents one of the most significant developments in contemporary cyber policy and is central to the Coalition's mission.

Building the Governance Frameworks for Collective Defense

As collaboration becomes more operational, governance becomes more important.

Throughout the event, participants emphasized that effective collective defense requires frameworks that clearly define responsibilities, authorities, accountability, and acceptable conduct.

Discussions focused on the need for:

• Clear legal and policy frameworks.
• Better-defined operational authorities.
• Greater clarity around acceptable cyber activities.
• Shared principles for responsible cyber action.

As cyber operations become increasingly relevant to national security and collective defense, policymakers will need legal and strategic frameworks that enable action while maintaining accountability, legitimacy, and public trust. Questions surrounding active cyber defense are often reduced to debates over "hack back" authorities. In reality, the policy challenge is considerably broader, encompassing the legal, operational, and governance questions that shape collective cyber defense.

Participants consistently stressed that effective action and responsible action must go hand in hand. The goal is not simply to enable greater activity in cyberspace, but to ensure that collaboration strengthens security while preserving trust, accountability, and core democratic values.

In many ways, this represents the next stage of cyber policy development: building governance structures capable of supporting operational collaboration at scale.

Looking Ahead

The launch of the Cyber Operations Policy Coalition reflects a growing recognition that cybersecurity is entering a new phase.

The cybersecurity community has largely reached consensus on the importance of public-private cooperation. The challenge now is operationalizing that cooperation through authorities, governance frameworks, trusted relationships, and shared missions.

That is the purpose of the Cyber Operations Policy Coalition. The conversation is no longer whether collaboration matters. The question is how to make collaboration operational.

To learn more about the Cyber Operations Policy Coalition and its work advancing policy frameworks for collective cyber defense, visit our website.

‍