U.S. Cyber Command

The busiest year on record — and a stand-down order

In April 2026, the new head of U.S. Cyber Command told Congress his command had conducted more than 8,000 missions in 2025 — a 25 percent jump over 2024 — and expected the pace to keep rising. Gen. Josh Rudd, testifying before the House Armed Services Committee, named two of them: Operation Absolute Resolve, tied to the ouster of Venezuelan leader Nicolás Maduro, and Operation Epic Fury, tied to the military campaign against Iran (Nextgov/FCW). No standard reference profile disputes the number. What they leave out is that the same command, in March 2025, was reportedly ordered to stand down its offensive cyber operations against Russia.

The Associated Press reported the pause on March 4, 2025: Defense Secretary Pete Hegseth had halted CYBERCOM’s offensive operations against Russia, a decision confirmed by an anonymous U.S. official and first reported by The Record (Defense News (Associated Press)). The order did not touch CIA or Cybersecurity and Infrastructure Security Agency operations, but it landed alongside a broader rollback — the disbanding of an FBI foreign-influence task force and the sidelining of election-security staff at CISA (Defense News (Associated Press)). That is the tension at the heart of the command right now: an operational tempo at an all-time high, in a political environment that can switch the offense off.

The dual-hat command born inside the NSA

CYBERCOM was created on June 23, 2009, when Secretary of Defense Robert Gates directed its establishment as a subordinate unified command under U.S. Strategic Command. It absorbed two existing task forces — one defensive, one offensive — and drew its first personnel, equipment, and resources from the National Security Agency, reaching full operational capability in 2010 (Congressional Research Service). Congress authorized its elevation to a full unified combatant command in the FY2017 defense authorization act, and the first Trump administration directed the elevation in 2017 (Congressional Research Service).

From birth, the command’s leader has worn two hats: the CYBERCOM commander simultaneously serves as Director of the National Security Agency, the two organizations co-located at Fort George G. Meade, Maryland (Congressional Research Service). The arrangement has been contested for years — Congress ordered annual briefings on the relationship in 2022 — but a joint Pentagon and intelligence review that year concluded that splitting the leadership “would be more costly and less decisive,” and the dual-hat survived (Congressional Research Service). Rudd himself was confirmed into the dual-hatted role (Nextgov/FCW).

The command’s stated mission is to “direct, synchronize, and coordinate cyberspace planning and operations — to defend and advance national interests — in collaboration with domestic and international partners.” Its four assigned missions: defend U.S. critical infrastructure and democratic processes from malicious cyber actors; defend DOD information networks; integrate cyber options into combatant command campaigns; and build DOD cyber effectiveness with allies and partners (Congressional Research Service). It draws forces from four service components — Army Cyber Command, the Navy’s Fleet Cyber Command, Marine Forces Cyberspace Command, and Air Forces Cyber/16th Air Force — and runs two subordinate unified commands, the Cyber National Mission Force and the DOD Cyber Defense Command (Congressional Research Service). The Army provides the command’s logistical and administrative backbone (Congressional Research Service).

The Coast Guard connection: Task Force Port

One relationship the reference profiles skip is the Coast Guard’s. The U.S. Coast Guard’s cyber command — part of the Department of Homeland Security, not the Pentagon — holds a direct support relationship to CYBERCOM (Congressional Research Service). In June 2025 that relationship went operational: during the command’s capstone exercise Cyber Guard 25-2, folded into the Pacific Sentry exercise’s Taiwan-conflict scenario against China, CYBERCOM stood up Task Force Port — a joint unit, led by a Coast Guard official, to defend U.S. ports against simulated cyberattacks (DefenseScoop).

The authority came from a CYBERCOM–Coast Guard memorandum of agreement that lets the command surge capabilities and forces to the Coast Guard for emergent needs without going through the normal Defense Support to Civil Authorities process (DefenseScoop). Some Coast Guard personnel already serve on CYBERCOM’s cyber mission force teams, and the Coast Guard brings authorities the Pentagon lacks — notably law enforcement powers as a DHS uniformed service (DefenseScoop). The exercise took place about a week after the Defense Secretary designated the DOD Cyber Defense Command a sub-unified command (DefenseScoop).

What this profile does not claim

This profile does not resolve the dispute over the March 2025 Russia pause: the AP reported it, confirmed by a U.S. official, while the Congressional Research Service notes the Pentagon reportedly denied issuing the order and characterizes the reported order as lasting one day. It does not define what counts as one of the 8,000 “missions” — Rudd did not elaborate on the figure. It does not assert the size of the Cyber Mission Force, a formal elevation ceremony date, or the “Department of War” secondary designation referenced in the CRS primer, none of which were verified to citation standard.