Executive Takeaway
The FBI’s new strategy should change how enterprises prepare for federal engagement, but it does not transfer responsibility for cyber resilience to the government. The Bureau commits to faster victim notification, specialized incident support, sustained adversary disruption, stronger industry partnerships, and AI-enabled analysis under human review and legal controls. Those commitments are meaningful only when a victim can rapidly provide reliable contacts, decision authority, preserved evidence, technical context, and a clear account of operational consequence.
The management decision is therefore not simply whether to call the FBI after a breach. Leaders must decide in advance who can engage, what can be shared, how evidence will be preserved, and how law-enforcement activity will coexist with recovery, safety, disclosure, and cross-border obligations.
What the Four Pillars Mean for Enterprises
The 17-page FBI Cyber 2026 Strategy organizes the Bureau’s approach around four pillars. The following distinction is important: the commitments belong to the FBI; the enterprise implications are CyberEnablement analysis.
| Pillar and stated FBI commitment | CyberEnablement implication |
|---|---|
| Disrupt adversaries: investigate intrusions, attribute activity, and coordinate sequenced actions against people, infrastructure, tools, and money. | A victim’s telemetry may contribute to a broader campaign investigation. Evidence collection should support containment and recovery while retaining the artifacts needed to connect incidents across organizations. |
| Support victims: share intelligence urgently, engage quickly, provide specialized capabilities, and improve reporting channels. | Organizations need a pre-authorized law-enforcement engagement path. Waiting for executives, outside counsel, insurers, and responders to negotiate that path during an intrusion sacrifices time. |
| Increase impact through partnerships: deepen coordination across government, allies, critical infrastructure, and private industry. | Information sharing must become a governed operating capability rather than an occasional exchange of indicators between personal contacts. |
| Enhance FBI capabilities: strengthen talent, tools, technical operations, post-quantum readiness, and AI-enabled analysis. | Enterprise security teams should expect faster, machine-assisted exchanges while independently governing the accuracy, authority, traceability, and consequences of their own defensive AI. |
The strategy does not promise that every report will receive the same response, produce an arrest, or lead to immediate attribution. It instead describes an operating direction and a broader definition of success that includes victim relief, infrastructure disruption, financial seizures, intelligence sharing, and coordinated action.
Incident Engagement Must Be Designed Before the Incident
The FBI says it can deploy specialized personnel within hours of a significant incident, maintains cyber resources across 56 field offices, and intends to expand its Industrial Control Systems Coordinator program to every field office. It also says early engagement helps protect victims, preserve evidence, and create disruption opportunities. Supporting coverage of the strategy’s launch reports that FBI Cyber Division Assistant Director Brett Leatherman urged executives and counsel to resolve concerns about Bureau engagement before a breach rather than allowing weeks of delay.
A large enterprise should translate that into an incident-engagement protocol owned jointly by the CISO and general counsel. It should identify the local FBI field-office contact, alternates, approved communication channels, conditions for executive notification, and the person authorized to share initial technical evidence. Public affairs, privacy, regulatory, insurance, and business-continuity teams should understand that contacting law enforcement is a parallel workstream—not a substitute for their responsibilities.
The relationship should also be exercised. Invite the appropriate FBI representatives into a tabletop scenario, especially where ransomware, nation-state access, intellectual-property theft, or disruption of critical services is plausible. The operating evidence is not a contact name in a plan. It is a demonstrated ability to reach the right person, authenticate the request, assemble an approved evidence package, and make a sharing decision within the required time.
Preserve Evidence Without Compromising Recovery or Safety
The strategy repeatedly connects victim reporting and technical evidence to attribution, notification of other victims, and disruption. A CISA, FBI, and EPA incident-response guide similarly advises critical-infrastructure operators to define evidence-retention processes covering collection, storage, and access before an incident.
That capability requires more than telling responders not to delete logs. Enterprises should establish:
- minimum retention for identity, endpoint, network, cloud, SaaS, administrative, and security-control telemetry;
- consistent timestamps and asset identifiers;
- procedures for forensic images, volatile data, malware samples, affected devices, and responder notes;
- chain-of-custody records and controlled evidence repositories;
- legal and privacy review paths for sharing employee, customer, or cross-border data; and
- a decision process for conflicts between evidence preservation, service restoration, and operational safety.
Petrochemical and other industrial operators need particular care. Collecting evidence from a safety-instrumented, process-control, or engineering environment cannot automatically follow an IT playbook. The OT owner and process-safety authority must decide whether acquisition activity could affect availability, deterministic behavior, vendor support, or safe operation. This reinforces the broader principle described in OT Isolation Is an Operating Model, Not a Firewall Rule: incident actions must preserve the essential function, not merely the network record.
Reporting and Cross-Border Operations Need One Decision Model
FBI reporting does not replace securities disclosure, sector reporting, privacy notification, contractual notice, or foreign regulatory obligations. Each has a different purpose and clock.
For U.S. public companies, the FBI’s SEC disclosure-delay guidance says a request for a national-security or public-safety delay must reach the FBI immediately after the company determines it will disclose a material incident. That narrow process illustrates why legal, security, and executive decision paths must be connected before materiality is determined.
The strategy says the FBI has more than 20 cyber-focused assistant legal attachés and participates in Five Eyes, Cyber 9, Europol, and bilateral relationships. That reach can help investigations spanning infrastructure, victims, providers, and actors in several countries. It does not remove the enterprise’s need to determine which local entity owns the affected system, which counsel advises it, where relevant data resides, and who may authorize transfer to U.S. authorities.
A multinational response plan should contain a jurisdiction matrix rather than the vague instruction to “notify law enforcement.” Exercise a scenario in which the U.S. parent discovers malicious activity in a European subsidiary, the identity platform is operated from another country, and the affected shared service supports plants in several jurisdictions. The test is whether the organization can preserve evidence and coordinate quickly without improvising legal authority or losing local operational control.
Shared Services Turn One Intrusion Into Portfolio Risk
In announcing the strategy, the FBI specifically warned that criminal groups are targeting shared services so that one intrusion can ripple across sectors. That observation should redirect attention from supplier security scores toward concentration and dependency.
Cloud identity, remote administration, managed detection, enterprise resource planning, file transfer, logistics, and industrial support platforms may each connect many business units or customers. The important questions are which essential services depend on them, whether one privileged compromise can cross those boundaries, and whether the enterprise can operate or recover without the provider.
This is the same accountability problem examined in Cloud Security Accountability Cannot Stop at the Contract. Require high-concentration providers to support rapid evidence preservation, named incident contacts, customer-specific containment, forensic access, regulator and law-enforcement coordination, and tested alternatives. A contractual notification clause is not proof that the provider can produce those outcomes under pressure.
Governing AI-Enabled Defensive Capabilities
The FBI commits to using AI for activities such as dataset triage, relationship analysis, malware analysis, victim-notification prioritization, and attribution support. It also states that this work will remain under human review, legal controls, and safeguards for accuracy, civil liberties, and operational security.
Enterprises should treat this as a governance signal, not permission for unconstrained automation. The NIST AI Risk Management Framework calls for clear human-AI responsibilities, inventories, testing, ongoing monitoring, and management of third-party software and data risk. Applied to cyber defense, that means defining what an AI capability may observe, recommend, change, quarantine, disclose, or escalate.
Human review is meaningful only when the reviewer has sufficient context, time, competence, and authority to challenge the output. Security leaders should retain model and tool versions, prompts or task instructions where appropriate, input provenance, generated findings, human approvals, actions taken, and rollback results. High-consequence actions affecting production, OT, evidence disclosure, or external attribution should require explicit authorization and a recoverable execution path.
Prioritized Actions and Leadership Questions
- Pre-authorize FBI engagement. The CISO and general counsel should document contacts, decision rights, authentication methods, and initial sharing boundaries.
- Build a minimum evidence package. Security operations and incident response should be able to produce timelines, affected assets, operational impacts, indicators, preserved logs, and actions already taken.
- Integrate reporting clocks. Legal should maintain one decision model covering law enforcement, regulators, contractual notices, insurers, and disclosure governance.
- Map concentration risk. Business-service owners should identify shared providers whose compromise could affect multiple plants, regions, customers, or regulated services.
- Exercise cross-border and OT cases. Test evidence transfer, local authority, safety constraints, provider coordination, and recovery decisions together.
- Govern defensive AI by consequence. Define permitted actions, human authority, testing requirements, audit evidence, failure handling, and rollback before deployment.
Leaders should ask: Can we contact the FBI without delaying containment? Can we preserve useful evidence without endangering operations? Do providers have the authority and capability to assist? Who decides what crosses a national boundary? What evidence shows that an AI-generated defensive action was accurate, authorized, and reversible?
My Perspective
The most useful part of the FBI strategy is not its list of government activities. It is the implied incident contract between the Bureau and the victim.
The FBI is saying it will pursue the actor, share what it can, bring specialized capabilities, and use victim evidence to protect others. In return, enterprises must be reachable, prepared to report, capable of preserving evidence, and able to make disciplined sharing decisions quickly. Many organizations have not designed their side of that contract. They treat FBI engagement as an exceptional legal judgment made after compromise rather than a rehearsed component of incident architecture.
Leaders should not overcorrect by assuming federal engagement guarantees confidentiality, attribution, recovery, or disruption. The strategy contains commitments, but few service levels, implementation dates, eligibility criteria, or effectiveness measures. The company still owns safe operation, containment, restoration, customer obligations, materiality decisions, and residual risk.
The right objective is not maximum information sharing. It is timely, authorized, useful sharing that preserves both investigative value and the organization’s ability to operate.
Conclusion
The FBI Cyber 2026 Strategy creates an opportunity for more consequential public-private action, particularly for critical infrastructure and industrial operators. Capturing that value requires preparation on both sides.
Executives should require evidence that FBI engagement, preservation, reporting, cross-border coordination, provider participation, and AI oversight work as one incident capability. A policy that says “contact law enforcement” is insufficient. The enterprise must know who will make the call, what can be provided, what operations must be protected, and how it will continue meeting its own obligations while the FBI pursues the adversary.