GoKawiilRSAC 2026 CONFERENCE – San Francisco – When it comes to cyberattacks, what crosses the "red line" and justifies a kinetic response?
That was one of the major questions posed to four former National Security Agency (NSA) directors and US Cyber Command leaders, who weighed in on the US government's offensive cybersecurity strategy as part of a keynote panel at RSAC 2026 Conference on Tuesday.
The keynote, titled "Inside Offensive Cyber: Lessons from Four NSA Directors" featured Tim Haugh, Paul Nakasone, Mike Rogers, and Keith Alexander. Alexander was appointed by former President Barack Obama to establish and lead the US Cyber Command, and was succeeded in the post by Rogers, Nakasone, and Haugh, respectively.
The panel followed the release of President Donald Trump's cyber strategy earlier this month, which prioritized offense and deterrence. Offensive cyber in a military context covers a wide range of activity. It can include taking down threat actor infrastructure and conducting surveillance against adversaries (as the US has been repeatedly accused of doing against China and others). It also includes attacks like Stuxnet, which caused major damage to Iran's nuclear program and has been attributed to US and Israel, though neither government has formally confirmed involvement.
Related:Why a 'Near Miss' Database Is Key to Improving Information Sharing
The 50-minute discussion, moderated by venture capitalist Ted Schlein, covered a wide range of topics, such as how the US's view toward offensive cyber has evolved over time from a more secretive concept to something public facing. The panelists also discussed how the NSA became the basis of US military cyberwarfare, the evolving (and increasing) role of the private sector, and the idea that offensive capabilities are necessary to defend the country.
Alexander said early detractors of the US's move into offensive cyber argued against the internet becoming a place for warfare. "It already is," he said. "Because it is, we have to be the best at it because our nation is the most digitized nation in the world."
While much of the conversation was generally in support of offensive cyber actions, two of the most interesting questions involved whether the US government still cares about cyber, and what the so-called "red line" is where a cyberattack may be met with kinetic military force (something the Obama administration reserved the right to do back in 2011).
The Red Line of Offensive Cyber
During the discussion, Schlein asked about how government officials determine where the red line is for cyberattacks that reach a certain level of severity.
... continue reading