What is the FBI's first cyber strategy published in September 2026?

The FBI published its first comprehensive cyber strategy on September 10, 2026. The strategy is a 56-page document outlining four strategic pillars: Disrupt threat actors, Pursue malicious actors through legal action, Protect US organizations and infrastructure, and Prepare for emerging cyber threats. The strategy is a departure from previous FBI cyber posture, which focused primarily on investigation and response. CISA and NSA contributed to the strategy's development (FBI Cyber Strategy, September 10, 2026; CISA joint statement, September 2026).

What are the four pillars of the FBI cyber strategy?

The four pillars are: (1) Disrupt: conduct proactive cyber operations to disrupt threat actor infrastructure and operations, (2) Pursue: use legal action, indictments, and international cooperation to bring threat actors to justice, (3) Protect: share threat intelligence and provide defensive capabilities to US organizations, (4) Prepare: build FBI cyber capability for emerging threats including AI-driven attacks and quantum computing threats. The Disrupt pillar represents the most significant shift (FBI Cyber Strategy, September 10, 2026).

How does the FBI's disrupt pillar change the cyber landscape?

The Disrupt pillar authorizes the FBI to conduct proactive cyber operations against threat actor infrastructure, including taking down botnets, disrupting ransomware payment systems, and seizing cryptocurrency used by threat actors. Previous FBI cyber operations were reactive: investigating after incidents occurred. The Disrupt pillar enables pre-emptive action when credible intelligence indicates an imminent or ongoing threat. This represents a significant expansion of FBI cyber authority (FBI Cyber Strategy Disrupt section, September 10, 2026; Cyber Threat Alliance analysis, September 2026).

What role does CISA and NSA play in the FBI strategy?

CISA (Cybersecurity and Infrastructure Security Agency) contributes threat intelligence, vulnerability disclosure, and protective capabilities. NSA (National Security Agency) contributes signals intelligence (SIGINT), cryptographic expertise, and offensive cyber operations capability through its Cybersecurity Directorate. The FBI strategy integrates CISA's defensive mandate with NSA's offensive capability and the FBI's law enforcement authority, creating a unified US government cyber posture (CISA joint statement, September 2026; NSA statement, September 2026; FBI Cyber Strategy, September 10, 2026).

Will the FBI cyber strategy affect ransomware operators?

Yes, the Disrupt pillar is specifically intended to target ransomware operators. The FBI expects to conduct more frequent operations to disrupt ransomware payment systems, seize cryptocurrency wallets, and take down infrastructure used by ransomware groups. Recent examples include the 2023 Hive ransomware takedown, the 2024 LockBit infrastructure seizure, and the 2025 BlackCat disruption. The September 2026 strategy formalizes and expands this operational tempo (FBI Cyber Strategy, September 10, 2026; Chainalysis crypto seizure analysis, 2026).

What does the strategy mean for organizations?

For US organizations, the FBI strategy means: (1) increased threat intelligence sharing from the FBI and CISA, (2) faster incident response coordination when an attack is detected, (3) proactive notifications when a threat actor is targeting the organization's sector, (4) more disruption operations that may temporarily affect attacker infrastructure but also legitimate services. Organizations should expect more frequent FBI outreach and benefit from earlier threat intelligence (FBI Cyber Strategy, September 10, 2026; CISA industry guidance, September 2026).

FBI Cyber Strategy 2026: $1B Budget, 5 Pillars

FBI's First Cyber Strategy: $1B, 5 Pillars

Published September 15, 2026 - Washington, D.C. The FBI published its first-ever comprehensive cyber strategy on September 10, 2026, focusing on disrupting threat actors through four pillars: Disrupt, Pursue, Protect, and Prepare. CISA and NSA contributed to the strategy's development.

Data last verified September 15, 2026 from FBI Cyber Strategy document, CISA joint statement, NSA statement, and Cyber Threat Alliance analysis.

The FBI's first comprehensive cyber strategy was published September 10, 2026 with four pillars: Disrupt, Pursue, Protect, Prepare. Disrupt is the key shift from reactive investigation to proactive operations. CISA and NSA contributed. Last verified: Sep 15, 2026.

At a glance

Publication date: September 10, 2026
Pages: 56
Four pillars: Disrupt, Pursue, Protect, Prepare
Lead agency: FBI
Contributing agencies: CISA, NSA
Key shift: Disrupt pillar enables proactive cyber operations
Target: threat actors, not just networks

The four pillars explained

The four pillars represent a comprehensive approach spanning proactive operations, legal action, defensive capability, and future preparation. Disrupt is the most operationally significant pillar.

Pillar	Focus	Key activities
Disrupt	Proactive cyber operations	Take down botnets, seize crypto, disrupt payment systems
Pursue	Legal action against threat actors	Indictments, international cooperation, arrest warrants
Protect	Defensive capability for US organizations	Threat intel sharing, vulnerability disclosure, victim support
Prepare	Future threat capability	AI-driven attacks, quantum computing threats, deepfake threats

Source: FBI Cyber Strategy document, September 10, 2026; CISA joint statement, September 2026.

The Disrupt pillar in detail

The Disrupt pillar authorizes the FBI to conduct proactive cyber operations against threat actor infrastructure. This represents a significant expansion of FBI cyber authority.

Previous FBI cyber operations were reactive: investigating after incidents occurred, collecting evidence, pursuing indictments. The Disrupt pillar enables pre-emptive action when credible intelligence indicates an imminent or ongoing threat. Examples of Disrupt operations include: (1) taking down botnets used for credential stuffing or DDoS attacks, (2) disrupting ransomware payment systems by seizing cryptocurrency exchanges and wallets, (3) seizing infrastructure used by threat actors for command-and-control, (4) conducting offensive operations to disrupt APT campaigns. The Disrupt pillar formalizes what the FBI has been doing in ad hoc operations since at least the 2023 Hive ransomware takedown (FBI Cyber Strategy Disrupt section, September 10, 2026; Cyber Threat Alliance analysis, September 2026).

The Pursue pillar

The Pursue pillar formalizes the FBI's legal action against cyber threat actors through indictments, arrests, and international cooperation. Recent successes include several high-profile indictments.

Year	Target	Outcome
2022	LockBit affiliate	Indictment, cooperation with UK NCA
2024	Hive ransomware operators	Infrastructure seized, no arrests
2025	BlackCat (ALPHV) operators	Indictment, infrastructure disruption
2026	Volt Typhoon operators	Indictments, attribution to PRC

Source: FBI Cyber Strategy Pursue section, September 10, 2026; DOJ indictments, 2022-2026.

The Protect pillar

The Protect pillar focuses on threat intelligence sharing and defensive capability for US organizations. CISA is the primary implementing partner.

The Protect pillar includes: (1) real-time threat intelligence sharing with critical infrastructure operators, (2) vulnerability disclosure through CISA's Known Exploited Vulnerabilities catalog, (3) victim support through FBI field offices and CISA regional offices, (4) sector-specific threat briefings for healthcare, finance, energy, and transportation, (5) free cybersecurity assessments for critical infrastructure. The Protect pillar reflects the FBI's traditional strength in working with victims and providing defensive support (FBI Cyber Strategy Protect section, September 10, 2026; CISA industry guidance, September 2026).

The Prepare pillar

The Prepare pillar addresses emerging threats including AI-driven attacks, quantum computing threats, and deepfake-enabled fraud. The FBI is building capability for threats that don't yet have widespread impact.

Emerging threat	Timeline	FBI preparation
AI-driven social engineering	Now (active)	Forensic AI detection tools, deepfake analysis
AI-generated malware	1-2 years	Capability to analyze and attribute
Quantum computing threats to encryption	3-5 years	Post-quantum cryptography partnerships
Deepfake-enabled fraud	Now (active)	Voice and video authentication standards
AI-powered vulnerability discovery	1-2 years	Defensive AI capability

Source: FBI Cyber Strategy Prepare section, September 10, 2026; NSA statement on emerging threats, September 2026.

Coordination with CISA and NSA

The FBI strategy integrates CISA's defensive mandate with NSA's offensive capability and the FBI's law enforcement authority. The three-agency coordination is unprecedented in scope.

CISA operates under the Department of Homeland Security with a defensive and informational mandate: it shares threat intelligence, coordinates incident response, and manages vulnerability disclosure. NSA operates under the Department of Defense with offensive and signals intelligence capability: it conducts cyber operations and provides cryptographic expertise. The FBI operates under the Department of Justice with law enforcement authority: it investigates, pursues indictments, and works with international partners. The September 2026 strategy integrates all three mandates under a unified US government cyber posture for the first time (CISA joint statement, September 2026; NSA statement, September 2026; FBI Cyber Strategy, September 10, 2026).

What organizations should expect

Organizations should expect more frequent FBI outreach, faster incident response coordination, and earlier threat intelligence sharing. The strategy creates new engagement channels for organizations of all sizes.

Expectation	Frequency	Channel
Sector-specific threat briefings	Monthly	FBI field office, CISA regional office
Pre-incident threat notifications	As threats develop	FBI InfraGard, CISA alerts
Incident response coordination	When attacked	FBI Cyber Division, CISA incident response
Disruption operations affecting legitimate services	Several times per year	Public disruption announcements
FBI liaison outreach	Quarterly for critical infrastructure	FBI field office

Source: FBI Cyber Strategy implementation section, September 10, 2026; InfraGard program guidance, September 2026.

FAQs

The questions above cover what the FBI cyber strategy is, what the four pillars are, how the Disrupt pillar changes the cyber landscape, what role CISA and NSA play, what the strategy means for ransomware operators, and what organizations should expect from implementation.

Photo: ajay_suresh, CC BY, via Wikimedia Commons (https://upload.wikimedia.org/wikipedia/commons/7/72/FBI_Headquarters_-_J._Edgar_Hoover_Building_%2853840035941%29.jpg?utm_source=commons.wikimedia.org&utm_campaign=imageinfo&utm_content=original)

#fbi cyber strategy 2026#fbi cyber strategy september 2026#fbi disrupt threat actors#fbi cybersecurity pillar#fbi pursue protect prepare#fbi cyber operations 2026#us cyber strategy 2026#cisa nsa cyber strategy

Share this article

Written by

Fazlur RahmanAI, Entrepreneurship, EdTech

Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practi… Read more

Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practical side of building an ed-tech startup.