Taking the Fight to the Enemy: How Cyber Persistence Is Redefining Global Security
Cyberattacks and digital espionage have become the new weapons of global conflict, compelling governments and organizations to rethink their approach to security. For decades, cyber deterrence—the notion that fear of retaliation would prevent hostile acts—dominated strategic thinking. But this model has proven insufficient for fast-evolving threats, prompting a shift toward cyber persistence: actively hunting down adversaries before they can strike.
From Deterrence to Persistence: A Strategic Evolution
Traditional deterrence theory functions on a promise of retaliation—essentially “If you hack me, I’ll hack you back.” But in a domain where attacks can be automated, masked by layers of obfuscation, and launched from across the world, waiting to respond is often too late.
Recognizing these limitations, the U.S. Department of Defense took a bold step with its 2023 Cyber Strategy, emphasizing a “Defend Forward” doctrine. Rather than waiting on the sidelines, U.S. cyber forces now move proactively, looking for vulnerabilities and actively disrupting adversarial operations before threats materialize.
Other nations have followed suit. The UK’s National Cyber Strategy advocates “persistent engagement,” while countries like Japan, Canada, and the Netherlands have begun to embed proactive hunting operations into their security frameworks. This concerted approach is a stark departure from the past, where nations primarily invested in walls and shields; now, they are also wielding figurative spears.
“Cyberspace is contested at all times,” explains the 2022 NATO Strategic Concept, which goes so far as to say that a sufficiently harmful cyberattack could trigger a collective defense response under Article 5. It’s a powerful nod to the necessity of cyber persistence as part of national—and international—defense.
How Persistent Engagement Works
Persistent engagement is about more than flexing high-tech muscles; it involves:
- Proactive Threat Hunting
Security analysts and government cyber units continuously scan and monitor digital environments, looking for signs of infiltration or malicious activity. - Operational Disruption
Once a threat is identified, forces move swiftly to dismantle attacker infrastructure—be that command-and-control servers or compromised devices. - Allied Collaboration
In many instances, a target’s network may be located in another country. Successful operations require multi-national cooperation, inviting allied cyber teams in for joint defense. - Ongoing Intelligence Gathering
Every attack or infiltration attempt offers valuable intelligence. By studying adversary tactics, defenders can better predict and prevent the next breach.
By keeping adversaries on the back foot, defenders reduce the chance of large-scale cyber incidents and make it more difficult for bad actors—whether state-sponsored or criminal—to exploit vulnerabilities.
LockBit Ransomware Takedown: A Case Study in Persistence
A prime example of cyber persistence in action is the Operation Cronos takedown of the LockBit ransomware group in February 2024. LockBit was among the most prolific ransomware-as-a-service outfits, implicated in roughly a quarter of all ransomware incidents in 2023, including attacks on hospitals during the COVID-19 pandemic.
- Coordinated International Effort: Multiple law enforcement agencies synchronized their intelligence, seizing servers, arresting key players, and intercepting financial networks tied to LockBit.
- Psychological and Operational Disruption: By exposing internal communications, investigators sowed distrust among LockBit’s affiliates, crippling its recruitment.
- Lasting Effects: Though the group’s alleged ringleader, “LockBitSupp,” attempted a comeback, the damage to LockBit’s infrastructure and reputation made resurgence difficult.
“By hitting them fast and hitting them deep, we’ve prevented further attacks,” said one official involved in the operation. “This strategy is about more than one-off takedowns—it’s about sustained pressure.”
Digital Solidarity vs. Digital Sovereignty
Underpinning these proactive cyber campaigns is the broader question of how nations collaborate—or choose not to—in cyberspace. The U.S. Department of State’s 2024 International Cyberspace and Digital Policy Strategy champions digital solidarity, urging nations to share intelligence and align cybersecurity frameworks in a unified front against malicious actors.
- Digital Solidarity: Stresses open data flows, shared resources, and cooperative defense measures, rooted in the belief that a more interconnected global internet is also a more secure one.
- Digital Sovereignty: Prioritizes national control, with strict rules on data localization and technology imports. Supporters argue it prevents dependence on foreign tech, while critics caution it could fragment global defenses.
The tension between these two philosophies is evident as countries grapple with balancing privacy, economic interests, and national security concerns. But from a cyber-persistence standpoint, many experts argue that collaboration is the lynchpin. Malicious actors rarely respect borders, so governments that don’t share data risk leaving critical blind spots.
A Glimpse into the Future
With high-profile takedowns like LockBit, more nations embracing “Defend Forward,” and alliances such as NATO officially recognizing the importance of cyber persistence, it’s clear this proactive stance is here to stay. Key trends to watch include:
- Expanding Interagency Cooperation: Intelligence agencies, military cyber commands, and private sector companies will increasingly join forces to neutralize threats before they escalate.
- Evolving Legal Frameworks: As nations adopt more offensive cyber measures, international law and treaties will need to clarify what constitutes self-defense in the digital realm.
- Greater Transparency: Countries may share anonymized threat intelligence more openly to cultivate trust among allies and partners.
- Targeted Adversary Disruption: Expect more instances where major threat groups are dismantled through coordinated, persistent engagement—mirroring the LockBit scenario.
In short, the era of passively waiting behind firewalls is ending. Cyber persistence—continuous engagement, rapid disruption, and global cooperation—is redefining how we think about and conduct cyber warfare. As threats evolve, so too must the strategies designed to contain them. For governments, industries, and everyday citizens, one thing is clear: the best defense in cyberspace increasingly requires taking the fight to the enemy—before they ever get a chance to strike.