Recent cyber strategies from the White House, the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Department of War, the Federal Bureau of Investigation (FBI), and the U.S. Department of Energy (DOE) share a common direction. The U.S. is increasingly emphasizing anticipation, prioritization, disruption, resilience, and — in certain missions — offensive cyber operations.
The message is becoming clear: we cannot simply wait for an adversary to attack and then respond. We have to see the threat earlier.
From Passive Defense to Anticipatory Cybersecurity
CISA’s new CISA 2030: Defend, Harden, Prevail strategy may provide the clearest articulation of this shift. CISA notes it will move “from passive defense to an aggressive, anticipatory stance” and work to eliminate adversarial footholds in defense-critical infrastructure before they can be weaponized. That is an important evolution.
“From passive defense to an aggressive, anticipatory stance.”
CISA also urges government and industry to integrate their cyber defense capabilities, gain better visibility into their assets, strengthen operational technology (OT) security, and deepen their understanding of threat activity.
The White House’s 2026 Cyber Strategy for America similarly emphasizes shaping adversary behavior, protecting critical infrastructure, strengthening public-private cooperation, and using the government’s defensive and offensive cyber capabilities.
The Department of War’s cyber strategy embraces concepts such as Defend Forward and disrupting or degrading malicious cyber activity. The FBI’s cyber strategy focuses heavily on disrupting adversaries, dismantling infrastructure, supporting victims, strengthening partnerships, and imposing costs.
The DOE’s Cybersecurity, Energy Security, and Emergency Response (CESER) strategy approaches the problem from another direction: hardening energy infrastructure, improving situational awareness, strengthening resilience, and ensuring the energy sector has timely and actionable information.
The missions and legal authorities of these organizations are very different. But taken together, their strategies point toward a common operational reality: Cybersecurity is becoming more proactive.
You Cannot Disrupt What You Cannot See
Moving from reactive defense to anticipatory cybersecurity creates another challenge: Visibility.
Before the government can prioritize, defend, disrupt, or harden infrastructure, decision-makers need to understand the environment they are trying to protect.
CISA’s strategy recognizes this directly. It calls for integrating intelligence across critical infrastructure security operations and using modern tools and technologies to enable real-time decision-making and accelerate operational response. It also calls for maintaining and analyzing infrastructure data so risks can be prioritized. That matters because the U.S. digital environment is enormous.
Critical infrastructure organizations depend on thousands of vendors, cloud providers, software platforms, managed service providers, telecommunications networks, and other third parties. A vulnerability in one organization can quickly become a risk to many. And adversaries do not view those organizations individually. They look for the weakest point in the ecosystem. The government needs the ability to do the same.
Seeing Risk at Scale
An anticipatory cyber strategy requires anticipatory visibility.
That means continuously understanding:
- What internet-facing infrastructure is exposed?
- Where are the most consequential vulnerabilities?
- Which organizations share common technology or third-party dependencies?
- Where is cyber risk concentrated across a sector?
- Which exposures present the greatest potential consequences?
- Where should limited government and industry resources be focused first?
This represents an important change in how we think about cyber situational awareness.
Instead of assessing organizations one at a time, we increasingly need the ability to understand entire ecosystems: energy, water, healthcare, transportation, financial services, government contractors, and the supply chains supporting them. CISA’s strategy explicitly embraces this type of consequence-based approach, calling for resources and operational efforts to focus on infrastructure whose disruption would have the greatest impact on public health and safety, economic continuity, and national security.
Turning Visibility Into Action
The emerging model can be thought of simply:
Identify → Map → Validate → Prioritize → Act → Measure
- Identify: Find every internet-facing asset tied to an organization or sector, including domains, IP addresses, cloud services, and exposed devices. You can’t protect infrastructure you haven’t found.
- Map: Connect those assets to their owners, physical locations, and shared vendors. This shows how one weak supplier can reach dozens of hospitals, utilities, or water systems.
- Validate: Confirm that each exposure is real, current, and attributed to the right organization. Accurate data keeps teams from chasing false positives or alerting the wrong owner.
- Prioritize: Rank exposures by potential consequence, not by raw severity score. A moderate flaw at a regional power provider may outweigh a critical flaw at a low-impact site.
- Act: Route findings to whoever can fix them, whether that’s an asset owner, a Sector Risk Management Agency, or law enforcement. Each organization acts within its own authorities.
- Measure: Track whether fixes closed the exposure and reduced risk across the ecosystem. Continuous measurement shows leaders which interventions worked and where to focus next.
Technology can help the government move through the first four stages much faster.
Project Meridian is SecurityScorecard’s solution. It maps cyber risk by location, using only what any malicious attacker on the internet can see. Project Meridian combines cyber evidence, physical assets, vendor dependencies, live hazards, and blast-radius modeling across all 16 CISA critical infrastructure sectors. This allows leaders to determine where risk is concentrated and which fixes reach furthest across systems that depend on one another. By continuously gathering outside-in intelligence, we can assess cyber exposure across large populations of organizations, critical infrastructure, and the third-party ecosystems that connect them.
The objective is not simply to generate another security score. It is to help answer a much more important question: Where is risk concentrated, and what deserves attention first?
That type of visibility can support many different government missions. A regulator may use it differently than a Sector Risk Management Agency. A law enforcement organization may have different priorities than a defense organization.
But they all benefit from a better understanding of the environment before making decisions.
The Next Phase of Cybersecurity
After 25 years in federal law enforcement and national security, I learned that the earlier you understand a threat, the more options you have to address it.
Cybersecurity is no different. The federal strategies emerging today recognize that waiting for an incident is increasingly unacceptable, particularly when the systems at risk support hospitals, water, energy, transportation, communications, financial services, and national defense.
The U.S. cyber posture is evolving:
- From reacting to anticipating.
- From individual organizations to interconnected ecosystems.
- From treating every vulnerability equally to prioritizing consequences.
- From passive defense toward active disruption where authorities permit it.
That evolution will require new capabilities, stronger government-industry partnerships, and better intelligence. Most importantly, it will require visibility. Because the United States cannot effectively defend, or disrupt, what it cannot see.
See your risk the way adversaries do. Contact SecurityScorecard to learn how Project Meridian can support your mission.
About the Author
Michael Centrella — Head of Public Policy at SecurityScorecard. He is a former Assistant Director of the U.S. Secret Service with more than 25 years of experience in federal law enforcement and national security.
