Cybersecurity Policy Report, DoD in Race With Private Sector to Recruit, Retain Cyber Pros, Senators Told, (Apr 28, 2026)

By Tom Leithauser

U.S. Cyber Command (CYBERCOM) is overhauling an outdated and inadequate system for recruiting, training, and retaining cyber personnel whose talents are coveted by deeper-pocketed private-sector entities, the Senate Armed Services Committee was told today.

Katherine Sutton, assistant secretary–cyber policy at the Department of Defense, called the initiative, known as CYBERCOM 2.0, “the most comprehensive overhaul of USCYBERCOM since its inception 15 years ago.”

DoD has known for several years that its “approach to building cyber talent has not been keeping pace with the rapidly evolving and increasingly contested cyberspace domain,” Ms. Sutton said in her written testimony for a hearing to review CYBERCOM and U.S. Special Operations Command.

“This misalignment has created significant challenges for the Department in recruiting the right people with the right aptitude and skillsets, retaining our most skilled and experienced operators in the face of lucrative private-sector opportunities, and providing the specialized, agile training needed to win against our nation’s adversaries,” she testified.

“This initiative is not merely an incremental adjustment, but a deliberate and comprehensive overhaul designed to deliver greater operational outcomes for the Joint Force,” she said. “The core principles of mastery, specialization, and agility are indispensable for meeting our strategic objectives.”

The CYBERCOM 2.0 project began in 2024 after it became apparent that the command couldn’t continue relying on untrained personnel sent to it for temporary duty by the uniformed services (CPR, Jan. 18, 2024).

Also known as the “revised cyber force generation model,” CYBERCOM 2.0 “establishes policy, implements programs, and executes new approaches to recruiting, developing, and retaining cyber talent,” Joshua Rudd, CYBERCOM’s commander, told the committee.

“In short, it will foster mastery across the force so we can overmatch quantity with quality. These steps were prompted and facilitated by Congressionally approved provisions on readiness and force generation that collectively gave the Department the opportunity to modernize the cyber force and reshape USCYBERCOM,” Mr. Rudd said in his written testimony.

“When the Department established USCYBERCOM in 2010 and authorized our Cyber Mission Force in 2012, it did not fully project the requirement to sustain cyberspace operations at-scale,” he explained.

“CYBERCOM 2.0 calls for several new entities, which are currently under construction. These include a Cyber Talent Management Organization planned for the near year, followed by an Advanced Cyber Training and Education Center and a Cyber Innovation Warfare Center. These are slated to be operational in the near term,” he testified.

“Together they will help change the Department’s approach to generating cyber forces, emphasizing domain mastery, strengthening specialized skills, and enhancing mission agility,” Mr. Rudd added.

Sen. Jack Reed (D., R.I.), the committee’s ranking member, said the changes envisioned by CYBERCOM 2.0 were needed. “The current Cyber Mission Force design is more than a decade old, and chronic readiness problems persist,” he said.

“Our most skilled cyber operators are highly sought after in the private sector, and the military cannot easily match the financial incentives that they’re presented with. As such, professional attrition in CYBERCOM remains high,” he noted.

But Sen. Roger Wicker (R., Miss.), the committee’s chairman, expressed concern that CYBERCOM’s evolution was happening too slowly. “Our cyber operators are working overtime, and we’re not ready to generate new forces to replace them. I’m troubled that this effort is not moving fast enough,” he said.

“We must redouble our efforts to modernize and strengthen America’s cyber forces,” Sen. Wicker added. “Doing so requires us to make fundamental updates to the way military services generate, organize, and sustain cyber forces. This effort is as ambitious as it is necessary.”

News: FederalLegislation DataSecurity