Speaking at DefenseTalks 2026, the Pentagon's cyber chief said the demand for cyber operations "far exceeds supply", an admission that the constraint on US military cyber activity is now capacity rather than authority — trained operators, tooling and integration time — against an operating tempo set by state and criminal activity rather than by the department's own planning cycle. The comments land alongside legislative movement in the same direction: after the attacks on US water utilities, Capitol Hill has offered its own proposal for an AI-cyber test programme through a CISA pilot, running parallel to the administration's push for AI leadership in critical infrastructure. The two tracks do not yet meet — one funds operators, the other funds automation of the defensive side — and industry observers note that regulatory questions remain the sticking point for wider adoption of defensive AI in critical-infrastructure operators, which is the same gap Ukraine's partnership below is designed to close in practice rather than in policy.

• Source article