ABSTRACT: The assumption that the United States homeland is a sanctuary from attack no longer holds. Americans now depend so deeply on cyber-enabled IT and OT systems that rivals—whether strong or weak—can reach directly into the infrastructures that support U.S. military power and social stability. What once appeared to be distant “away-game” contests now routinely materialize at home: within the systems of military installations, logistics networks that sustain readiness, and civilian systems on which mobilization depends. These intrusions do not resemble declared hostilities. Instead, they unfold as hybrid campaigns marked by ambiguity: state-directed actors working through criminal proxies, covert exploitation disguised as routine network activity, and operations deliberately crafted to obscure attribution and intent

ABSTRACT: Cyberattacks are often framed as discrete emergencies—events requiring swift, pre-planned recovery. Yet the geostrategic cyber threat is emergent and deeply embedded in the civilian infrastructure that underpins U.S. military operations. This paper argues for a dynamic conception of cyber resilience—not merely withstanding disruption, but fighting through it, adapting in contact, and sustaining initiative in a contested environment. Cyber resilience is a shared military-civilian challenge that often requires extending capacity from already degraded conditions (graceful extensibility) and adapting across multiple cycles of stress (sustained adaptability). Prevailing definitions, including the widely referenced National Institute of Standards and Technology (NIST) standard, treat resilience as a static, information technology (IT)-centric function focused on rebound and robustness. These commercial paradigms fall short in conflict conditions, where disruption is sustained, deliberate, and often combined with informational and/or kinetic effects. Drawing on the cases of China’s Volt Typhoon campaign, Ukraine’s cyber defense, and the Jack Voltaic exercises, this paper explores the operational stakes and the socio-technical character of cyber resilience. It critiques institutional fragmentation and outdated assumptions that undermine integrated defense at the civil-military seam. In light of persistent threats, cyber resilience is not a state, but a practice and a core operational capability—planned, exercised, and sustained.

Click here for the full article.

ABSTRACT: Resilience – thriving through adversity – has become a central theme in discussions about energy and other critical infrastructure sectors. Now that energy systems are controlled, automated and networked through information and communications technologies, the definition of energy sector resilience has expanded to include cyber resilience. This focus commonly emphasizes technology and technological solutions aimed at preventing, mitigating or rebounding from crises. For instance, the most prominent United States definition of cyber resilience (from the Department of Commerce) is largely reactive – “withstand, recover from, and adapt” – and technology-centric, “to compromises on systems that use or are enabled by cyber resources.” 

The terms “cyber” and “resilience” are both words that mean different things to different people. For some, cyber is purely technical, while for others cyber refers to cyber-enabled disinformation. Resilience might refer to the reliability of a single system, or “the ability to continue to function, perhaps in a degraded state, when that system is unavailable.” [1] 

This paper advocates for a broader concept of energy sector cyber resilience for NATO allies and partners. A concept of energy sector cyber resilience that encompasses social-technical and operational dimensions is needed to better addresses the complex and interdependent nature of these systems, and the potential context of hostilities.

Download the full report here.

The United States and China are competing over who will develop and deploy the best artificial intelligence capabilities. This "race," as Washington refers to it, isn't just about whose technology is better; it's also about whose technology captures global market share. The dilemma for policymakers and conscientious AI companies, however, is that the unchecked spread of increasingly powerful AI technologies could enable countries like China to repurpose them for military, intelligence, or repressive purposes.

Continue at darkreading.com.

Introduction:

Artificial intelligence (AI), particularly machine learning (ML), has transformed computing, offering potential benefits in the nuclear enterprise, which encompasses weapons, delivery systems, platforms, and command and control infrastructure. While AI can enhance efficiency in areas like predictive maintenance and operational planning, its integration into the nuclear enterprise poses significant risks, some of which are inherent in the nature of ML. Five principles should guide AI’s responsible application in a nuclear weapons context: maintaining meaningful human control in nuclear decision-making processes; evaluating AI risks within a nation’s broader nuclear posture; recognizing the challenges of verifying international agreements on AI restrictions; managing risks through self-imposed limitations; and leveraging AI to enhance human oversight. While AI offers opportunities to improve nuclear surety and operational efficiency in areas like planning and predictive maintenance, its deployment must prioritize minimizing catastrophic risks and preserving human judgment in critical decision-making processes.

Read the article at tnsr.org

Abstract:

AI models are increasingly prevalent in high-stakes environments, necessitating thorough assessment of their capabilities and risks. Benchmarks are popular for measuring these attributes and for comparing model performance, tracking progress, and identifying weaknesses in foundation and non-foundation models. They can inform model selection for downstream tasks and influence policy initiatives. However, not all benchmarks are the same: their quality depends on their design and usability. In this paper, we develop an assessment framework considering 40 best practices across a benchmark's life cycle and evaluate 25 AI benchmarks against it. We find that there exist large quality differences and that commonly used benchmarks suffer from significant issues. We further find that most benchmarks do not report statistical significance of their results nor can results be easily replicated. To support benchmark developers in aligning with best practices, we provide a checklist for minimum quality assurance based on our assessment. We also develop a living repository of benchmark assessments to support benchmark comparability.

Find the full article here