Cyber security remains a persistent concern for public and private sector organizations alike. Given the potential impact of cyber threats from criminal groups, adversarial states, and extremists, the topic draws substantial attention. Yet, in a field that evolves so quickly, some risks slip through the cracks. We asked four experts to identify and assess a key cyber security threat to U.S. national security that analysts and policymakers often overlook.Read more below. Emily HardingDirector of the Intelligence, National Security, and Technology Program and Vice President of the Defense and Security Department at the Center for Strategic and International Studies Determining the state affiliation of criminal organizations is a complex challenge. The Trump administration’s recent memorandum on “transnational cyber-enabled crime” declared that industry can engage in offensive cyber operations against criminal groups. But “state-associated” groups are out of bounds, which is an attempt to draw a bright line in a murky space. The Russian government, for example, has a wide spectrum of relationships with hackers. Some groups are wholly owned subsidiaries of the Kremlin, some comprise Russian government employees who moonlight as criminals, and some are criminal groups that occasionally perform a favor. Which of these groups are fair game? Paradoxically, the memo may have created a perverse incentive for states like China and Russia to establish a relationship with a hacking group to better protect the hackers. Getting industry more involved in this fight is good policy, but for it to work, we need clear conventions defining affiliation and strong intelligence on these relationships. Without those, industry will be too caught up in legal debates to act. Caleb WithersResearch Associate for the Technology and National Security Program at the Center for a New American Security AI might improve faster at offense-favoring cyber tasks — like exploiting vulnerabilities, where success is self-evident — than at the messier