Like conventional warfare, cyber warfare works at three levels. The strategic level sets national goals and policy. The operational level plans and coordinates campaigns. The tactical level carries out specific actions against specific systems. Understanding the levels of cyber warfare helps explain who decides what, and why a single hack can have national consequences.
The three levels at a glance
| Level | Main question | Who works here | Typical outputs |
|---|---|---|---|
| Strategic | Why and what? | Heads of government, ministries, national security councils | National cyber strategy, policy, deterrence, alliances |
| Operational | How and when? | Cyber commands, joint planning staff | Campaign plans, target priorities, coordination |
| Tactical | Which system, with which tool? | Operators, analysts, incident responders | Specific defensive or offensive actions |
Strategic level
At this level, leaders decide how cyber power supports national objectives. Typical decisions include:
- publishing a national cyber security strategy;
- defining red lines and how the country will respond to major attacks;
- building alliances and information-sharing agreements;
- investing in skills, research and critical infrastructure protection;
- deciding when to publicly attribute and sanction attackers.
Strategic choices shape everything below them. For example, a policy of “defend forward” leads to more proactive operations.
Operational level
The operational level turns strategy into campaigns. Planners:
- choose objectives and priority targets;
- coordinate cyber activity with land, sea, air and space operations;
- allocate teams, tools and time;
- manage legal review and approvals;
- assess results and adjust plans.
This level needs people who understand both technology and military planning.
Tactical level
At the tactical level, specialists act on specific networks. On the defensive side, this means monitoring, threat hunting, incident response and patching. On the offensive side, when authorised, it means gaining access to a target system and creating a specific effect. Tactical work needs deep technical skills in networks, operating systems, malware and tooling.
How the levels connect
A single tactical action can have strategic effects. For instance, an intrusion into a government network may begin as a technical operation, yet its discovery can trigger diplomatic sanctions. Conversely, a strategic decision to protect elections results in many tactical tasks: hardening systems, monitoring threats and responding to incidents.
Skills at each level
| Level | Key skills |
|---|---|
| Strategic | Policy, international law, risk management, diplomacy |
| Operational | Planning, coordination, intelligence analysis, legal awareness |
| Tactical | Network security, forensics, malware analysis, scripting, tool use |
Using the same model in a company
Organizations can apply the three levels to their own security:
- Strategic: the board sets risk appetite and approves the security strategy and budget.
- Operational: the CISO and security managers plan programmes, such as an ISO 27001 project or a SOC rollout.
- Tactical: analysts and engineers patch systems, monitor alerts and respond to incidents.
Clear links between the levels make sure daily work supports business goals.
Related guides
Sources
Worried about targeted attacks on your business? Our VAPT services find weaknesses before attackers do, and our OSINT investigations show what is exposed about your organisation online. Contact us for a quote.
