The Future of Warfighting: SOF-Cyber Training

An Integrated Approach to Training and Employing New Technologies

SOF cyber forces will play a leading and outsized role in future operations by providing offensive, defensive, and influence capabilities across the full range of SOF missions. As the former SOCOM commander, Gen. Richard Clarke, stated, “We need coders … the most important person on the mission is no longer the operator kicking down the door, but the cyber operator who the team has to actually get to the environment so he or she can work their cyber tools into the fight.” While not every SOF operator will become a coder or deliver cyber effects, there is an opportunity to build cyber skills for select personnel while also evolving training for all SOF forces. We have seen the SOF components have already looked internally at how to best develop their ranks to integrate cyber into their core activities. This is a key step toward equipping traditional SOF forces with greater insights about cyber capabilities and what their organic cyber operator teammates need to put these new capabilities into action.

Elite U.S. forces understand the value of realistic training: Accelerating the integration of SOF and cyber in training is a natural next step. By integrating cyber terrain into training areas, SOF teams can gain hands-on experience working with SOF cyber operators to fully understand how to best incorporate new cyber tactics, techniques, and procedures (TTP) into their operations across all SOF missions. SOF-cyber integration should span all SOF core activities, not just direct action and special reconnaissance, but also information operations and irregular warfare. To improve confidence in the value proposition of such integration, cyber activities should not be “white carded”—merely simulated—during training and exercise events: Instead, they should be realistically embedded in live, virtual, and constructive parts of the joint operational and readiness training cycle. Success and failure in realistic environments will accelerate innovation, refine use cases, advance joint interoperability, and increase trust in cyber capabilities. 

Next Steps

It takes years to train operational SOF units to the level of proficiency needed to accomplish their missions. Integrating new cyberspace capabilities into SOCOM’s forces requires investments in time, resources, and partnerships. To accelerate this integration, the following three recommendations are offered.

1. Prioritize training for full-spectrum cyber training simulations, content, and ranges:

The complexity of cyberspace activities is like that of multiflow dynamic combat clearance—it requires countless repetitions and TTP refinement to instill confidence in the operator’s capability to execute the mission. Like combat clearance, cyber training needs to be integrated into training environments using physical hardware and software to depict adversary terrain as realistically as possible. For teams to fully integrate full-spectrum cyber capabilities across the SOF disciplines, operators need to witness them in action—like, for instance, the cyber manipulation of a target vessel during an interdiction operation or cyber destruction of an adversary surveillance system during direct action. SOCOM requires deliberate and continuous investment to enable SOF cyber operators to rapidly build the skillsets required for future mission success.

Funded prioritized cyber training, aligned to SOF-peculiar operational planning requirements, makes the cyber domain applicable and valuable to SOF operator roles and mission requirements, and enables cyber to fully integrate (live, virtual, and constructive) into SOF training exercises. This would evolve SOF exercises from “white carding” cyber activities, to enabling operator use of friendly and adversarial cyber effects that are operationally relevant and realistic. For instance, exercises can leverage catalogs of the latest known vulnerabilities concerning networks, hardware, and software—and leading manufacturing capabilities can help put such capabilities into play. Exercising in this manner will build stronger connectivity and interoperability between SOF and CYBERCOM cyber teams, resulting in more effective SOF-enabled cyber operations and cyber-enabled special operations. For example, realistic joint exercises will enable the cross-pollination of SOF cyber and conventional cyber operations to develop shared practices and greater interdependence. SOF-peculiar exercise environments will also provide operators with a sandbox to experiment with innovative technologies like AI/ML to support forward-deployed operators who may only have minutes to integrate cyber tools into any given mission.

2. Establish a SOF cyber indefinite delivery/indefinite quantity (IDIQ) program:

SOCOM and the service components are developing SOF-specific cyberspace requirements for training, exercises, and operational use. The force requires a program office and method to accelerate the acquisition, distribution, and sustainment of these unique capabilities. The traditional acquisition process cannot keep up with the rate of technological change for cyberspace, even with the Special Operations Forces Capabilities Integration and Development System (SOFCIDS). Teams need ready access to cyber industry subject matter experts, innovative training programs, and cutting-edge tools to develop, test, and evaluate cyber capabilities that could be rendered ineffective by patching on any given day. Establishing a robust IDIQ at SOCOM would be the quickest and most efficient means of supporting the warfighter. 

3. Implement the SOF-Space-Cyber Triad:

The asymmetric advantage offered by integrating the unique capabilities of SOCOM, CYBERCOM, and U.S. Space Command (SPACECOM) will only be realized if cross-functional experiments and training drive a campaign of learning. The outcomes of such an effort will be better-defined use cases, increased speed, and operational agility. Critically, these joint efforts will also identify friction such as differences in doctrine, interpretation of authorities, and potential cultural challenges. An essential outcome is improved trust, a prerequisite to creating the cultural change required to optimize the potential of the triad. It is only through close collaboration and demonstration that the operators and frontline leaders will fully understand the cross-functional and cross-organizational capabilities for mission execution.


Immediately and effectively improving the training for SOF-cyber capabilities will better enable the full range of SOF missions on the future battlefield. One of SOCOM’s SOF Truths states, “Competent special operations forces cannot be created after emergencies occur.” This is also true for cyber forces and capabilities. Now is the time to refine and implement the doctrine, policy, organizations, capabilities, training, and resources required to improve SOF’s success in competition, crisis, and conflict against all adversaries. Now is the time for SOCOM and the joint force to fully invest in bringing SOF cyber capabilities to the forefront of joint force operations.

Learn more about Booz Allen’s approach to National Cyber

For more information on our next demonstration day or, to join us during SOF Week at our booth in the convention center, or to learn how Booz Allen can integrate our cutting-edge, full-spectrum cyber training and exercise capabilities and extensive cyber force development experience into your team and mission, please contact us below.

Meet Our Team

Brian Hogbin, Vice President of National Cyber Solutions

Sam Fuson, Director of Cyber for Combatant Commands and SOF

Rick Diver, National Cyber Solutions Training and Exercise Lead

Jessica de Swart, SOF Cyber Lead

Contact Us

1 - 4 of 8