Most cyber reporting stops at individual incidents. This report connects the dots, showing how China’s operations add up to a broader strategy. It explains the methods and infrastructure that give the PRC scale and persistence, and it sets out concrete steps the U.S. and its allies can take to disrupt these efforts and protect their freedom of action.
Predict, Prevent, and Prevail Over the PRC Cyber Threat
The PRC’s cyber acceleration strategy explained
The People’s Republic of China (PRC) is conducting global, persistent, and strategic cyber and information operations. From breaching federal governments to exploiting supply chains and manipulating online discourse, its cyber operations are well documented and widely reported. What remains poorly understood is why China can act so broadly, effectively, and consistently—and how these operations add up.
That’s why we’re publishing Breaking Through: How to Predict, Prevent, and Prevail over the PRC Cyber Threat. This report explains how China converts individual operations into lasting advantage. It shows the force multipliers that give PRC cyber power its scale, how those methods are deployed across regions, and what actions the U.S. and its allies can take to contest and disrupt them.
In this report we:
- Unpack four ways the PRC scales its cyber power—abusing trusted relationships, exploiting edge devices, using AI for speed, and contesting attribution.
- Reveal how AI gives PRC operations an edge, from faster reconnaissance and exploit development to smarter targeting and data analysis.
- Show how China uses cyber operations to shape the playing field in East Asia, Europe, and beyond—limiting U.S. and allied options in both long-term competition and potential crises.
- Explain how China’s shift from denying to contesting attribution risks fragmenting allied response and helps it to control escalation.
- Offer a strategy for how the U.S. and its partners can move from reacting to intrusions toward actively shaping the environment to block PRC footholds.
This report is essential reading for anyone who wants to see the big picture about PRC cyber and information operations and understand how the U.S. can counter them.
--
*“People’s Republic of China” refers to the sovereign state commonly known as “China,” in alignment with U.S. policy since the 1970s. The term “Chinese” is used in an ethnic or cultural context unless explicitly linked to the state or its official entities.
Frequently Asked Questions
What new value will I get from reading this report?
If everyone is using AI, why is the PRC’s use so concerning?
The report examines how the PRC’s intelligence and military agencies are using AI to overcome structural bottlenecks that have limited the reach, scale, and speed of their operations. For example, AI enables them to break through professed language and cultural barriers with tailored, automated, and scaled influence operations.
What’s the difference between cyber operations and information operations?
Cyber operations target technology. They gain access to networks, steal or corrupt data, and sometimes preposition in critical systems. Information operations target people and institutions. They shape perception and decision-making through narratives, persona networks, and selective leaks. Together, they reinforce each other: Cyber access provides material and leverage, while information campaigns turn that material and leverage into pressure and influence.
