How Will AI Affect Cyber Operations?

Artificial Intelligence and the Risk of Strategic Cyberattack

Expert InsightsPublished Jul 14, 2026

Cyber weapons have long been described as strategic instruments of statecraft. In practice, they have almost always been tactical in their application. Attackers have struggled to predict the effects of their operations with confidence, overcome complex classification structures, and assemble the expert-level capacity required to execute sophisticated cyberattacks at scale. As a result, cyber operations have rarely achieved the kind of broad, sustained strategic effects that theorists, journalists, and U.S. government sources have long anticipated.

In this paper, the author argues that artificial intelligence (AI)—particularly agentic AI, meaning systems capable of pursuing goals with some degree of autonomy—will significantly expand the strategic potential of cyber operations. It will do so primarily by alleviating the constraint on expert-level human capacity that has most limited strategic outcomes to date.

The author first examines the tactical-strategic divide as it applies to tools of statecraft and force. He then reviews why publicly known cyber operations have largely fallen short of strategic expectations, identifying three key characteristics that have confined most cyber activity to tactical uses. Finally, he assesses how current developments in AI are likely to reshape each of these three factors, though not equally, and what that means for the future strategic potential of cyber operations.

This effort was independently initiated and conducted by the Center for the Geopolitics of Artificial General Intelligence within RAND Global and Emerging Risks using income from operations and gifts from RAND supporters.

This publication is part of the RAND expert insights series. The expert insights series presents perspectives on timely policy issues.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

RAND is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.