NRO Official Details New Cyber Office With $250M Budget; White House Warns of AI-Speed Attacks

RESTON, Va. — The new Cyber Protection Office at the National Reconnaissance Office (NRO), the secretive agency that builds and operates the nation’s spy satellites, has a staff of 600-plus and an annual budget of $250 million, NRO’s Lt. Col. Luke Shibilski told CyberSat attendees on Tuesday.

Noting that the initial stand-up of the CPO was announced at last year’s CyberSat, Shibilski shared new details about the work of the office and the underlying the decision to stand it up.

“For too long,” he said, “our operations and security policies were managed separately …What we learned is straightforward: threats do not respect organizational boundaries. Adversaries look for seams; they look for gaps between policy and operations, between responsibility and execution, and between one team and another.”

NRO leadership realized “A fundamental change in how we organize for cyber protection,” was needed, he added, and so “took steps to integrate our cyber operations and security functions into a single cyber protection office, one team, one mission, and one standard.”

That was important, Shibilski said, “Because when our warfighters and partners need support, guidance, or a decision, they should not have to navigate organizational seams.”

CPO is “a round-the-clock mission organization,” with military personnel, civilian government employees, and contractors all working side-by-side, he added. In addition to Space Force’s Delta 26 unit, which Shibilski commands, there are military personnel from the Air Force, Army, and Navy. Shibilski noted it’s not just cyber operators on the team, but engineers, acquirers, IT specialists, and intelligence professionals as well.

CPO provides more than 38 cyber services, including continuous cyber defense, incident response, security engineering, risk management, and mission support, Shibilski said.

Over the past year, as the tempo of operations in the Middle East and elsewhere has increased, CPO has expanded its operational cyber support to combatant commands around the world, he added.

Prioritized IT and cyber assets from the combatant commands will gradually be onboarded for centralized protection by the CPO, he added.

In addition to expanding its geographical reach, CPO is extending its ability to monitor Department of Defense (DoD) networks, including legacy systems like Operational Technology. “We are expanding cyber visibility across mission environments. That includes improving how we bring operationally relevant data into enterprise defense workflows, so we can detect, understand, and respond more effectively,” he said.

ONCD Intelligence Lead Warns of AI Accelerating Cyber Attacks

Also extending its work is the Office of the National Cyber Director, part of the Executive Office of the President. In a keynote fireside chat, William Loucks, ONCD’s senior director for Intelligence, told the audience of space and satellite executives, cyber engineers and space force officers that therean urgent need for the federal government and the country at large to up its cyber game. The acceleration in the speed and scale of cyber attacks that is likely to follow the widespread adoption of AI technologies by threat actors, make the traditional cadence of cyber defense no longer viable.

“Historically, we relied on observing threat activity in the wild, gathering static indicators of compromise, folding signature-based detections into defensive resources, and hoping that the threat is mitigated,” Loucks said.

Such approaches always had their limitations, he acknowledged, but now they are basically ineffective. “A strictly reactive approach to cybersecurity is inadequate, and that’s especially true today because the threats we face now are distinctly different from the threats we faced only a few years ago” Loucks argued.

The biggest change is the growing adoption of AI. “If it isn’t already, I think it will soon be impossible to discuss cyber activities without discussing super intelligence or SI,” Louks said, using President Trump’s preferred nomenclature to refer to AI. “Whether SI is used at the front end of operations to enhance target reconnaissance, social engineering, vulnerability research, or tool development, or SI is used to accelerate live operations, it may soon be the case that SI, in some capacity, in some way, is used in almost the vast majority of cyber operations,” he said.

The advantages attackers could get by using AI “are just too valuable for threat actors not to abuse,” he added. “The distinguishing characteristic of SI-enabled cyber operations is speed.”

That speed means that the timeline of the overall cyber operations lifecycle is collapsing, he said. The gaps that defenders had generally been able to rely on, between when patches are released and when the first exploits appear, or between initial access and the pivot to more sensitive resources, is shrinking fast. “From the defender’s perspective, the pace of SI-enabled cyber operations … has the potential to outrun previously acceptable timelines associated with patching, detection, and remediation.”

In addition, he predicted, AI will “democratize access to advanced capabilities, lower barriers for cyber criminals, and raise ceilings for more sophisticated actors.”