US Expands Cybersecurity Cooperation With Allies Through Shared Intelligence, Military Teams and AI Research

A Network of Partnerships to Protect Digital Life

A $26 million contract for IBM, joint cybersecurity research by the United States, United Kingdom and Canada, and expanding cooperation with Asian allies show how Washington is building international defenses against digital threats. As of June 16, 2025, the effort spans military networks, electricity grids, telecommunications, financial systems and the technologies that connect them.

The United States is deepening cooperation as state and nonstate actors increasingly target critical infrastructure, government systems and private businesses. An attack on these systems can threaten national security and disrupt the services people and companies rely on. Because digital networks cross borders, a weakness in one country can expose organizations elsewhere.

US cooperation has five main components: sharing intelligence about threats, holding joint training and exercises, coordinating responses to incidents, supporting emerging technologies, and developing common standards. Government agencies, companies, allied countries and multilateral organizations each contribute to that work.

Threat intelligence helps defenders recognize malicious activity sooner. Exercises let teams practice responding to simulated attacks. Shared response plans establish how organizations will coordinate when an incident occurs, while common standards give partners a more consistent foundation for protecting their networks.

Research adds another layer, covering artificial intelligence, quantum encryption and secure telecommunications. Together, these activities connect immediate defense against attacks with longer efforts to make technology and infrastructure more resilient.

The practical challenge is bringing those pieces together across countries with different laws, institutions and technical capabilities. Washington's partnerships address that challenge through civilian coordination, military operations, scientific research and support for allied governments.

How the Joint Cyber Defense Collaborative Works

The Cybersecurity and Infrastructure Security Agency, known as CISA, established the Joint Cyber Defense Collaborative to bring government, industry and international partners into a shared effort. The collaborative, or JCDC, coordinates national management of cyber incidents and campaigns against digital threats.

JCDC supports rapid exchanges of threat information between two partners and among larger groups. The aim is to build a common understanding of what attackers are doing so that participating organizations can coordinate their responses.

The collaborative also combines insights from global partners into cybersecurity advisories and other guidance. These publications help organizations defend against evolving threats by translating shared knowledge into practical recommendations.

Its work extends beyond passing information between members. Through structured collaboration, JCDC carries out plans intended to counter adversaries and reduce risk across the digital environment. That connects the identification of a threat with decisions about how participating organizations should respond.

Military Teams Put Cooperation Into Practice

US Cyber Command, or USCYBERCOM, provides an operational part of the international effort. Its International Coordinated Cyber Security Activity, known as INCCA, deploys defensive cyber teams around the world to detect and address malicious software and vulnerabilities targeting Department of Defense networks.

Malware is software designed to cause harm or gain unauthorized access. A vulnerability is a weakness that an attacker can exploit. INCCA teams work to identify those problems, reduce their impact and share the resulting intelligence.

The activity strengthens US military systems while also supporting the resilience of partner networks. USCYBERCOM coordinates with Joint Force Commanders, other government agencies and international allies to improve defensive capabilities and keep networks functioning under pressure.

Innovation, collaboration and vigilance are central to this military approach. Defensive teams contribute technical knowledge, while relationships with partners help turn that knowledge into coordinated action against threats to national and allied security.

Allies and Industry Bring Different Strengths

Allied governments help identify where adversaries might try to compromise shared capabilities. Private companies contribute experience protecting large organizations and access to skilled cybersecurity workers. The US approach draws on both, treating international cooperation as a necessity for securing connected systems.

Mieke Eoyang, Deputy Assistant Secretary of Defense for Cyber Policy, described the need to make better use of security cooperation and private sector expertise:

We need to do a better job of understanding how we can use security cooperation and other mechanisms to help our allies and partners improve their cybersecurity. This is actually an area where we can really use industry's help because we have tremendous capability inside the United States in terms of providing cybersecurity for large enterprises, and I would argue that some of the best talent is actually in the private sector.

The United States is also working on an approach that manages the cyber workforce throughout a person's career. That includes opportunities for private sector specialists to contribute to national defense, alongside efforts to recruit, develop and retain skilled personnel.

Competition for those workers is a continuing problem. Governments need people who understand complex threats and systems, while private employers seek many of the same skills. Cooperation with industry is therefore part of both the technical response and the workforce effort.

A Strategy Built Around Digital Solidarity

The US International Cyberspace and Digital Policy Strategy sets out Washington's vision for cooperation. Ambassador Nathaniel Fick, the first US cyber ambassador at large, describes it as a roadmap for decisions about technology that will shape generations.

Fick places "digital solidarity" at the center of that vision. The term means working toward shared goals, building partners' capabilities and providing mutual support. The intended result is a technology environment that is secure, respects rights and supports innovation.

Three principles guide the strategy: presenting a positive vision for secure and inclusive cyberspace; connecting cybersecurity with sustainable development and technological innovation; and addressing the whole digital ecosystem. That last principle includes infrastructure such as cloud services and undersea cables, rather than focusing only on individual devices or networks.

The strategy identifies four areas for action:

• Promote an open and resilient digital ecosystem.
• Align international digital governance with respect for rights.
• Advance responsible behavior by states in cyberspace.
• Build the ability of international partners to combat cybercrime and other threats.

The approach responds to repressive regimes, cybercrime and the misuse of emerging technologies. It also supports cooperation on AI safety and the deployment of trusted technology. Security, development and rights are treated as connected responsibilities across the digital environment.

Japan Cooperation Focuses on Essential Services

The US-Japan alliance is a central part of regional cybersecurity cooperation as geopolitical tensions rise in the Indo-Pacific. Both countries have prioritized protecting critical infrastructure, including energy grids, telecommunications and financial systems, against sophisticated cyberattacks.

These systems form the digital backbone of daily life and economic activity. Protecting them means keeping essential services available while reducing opportunities for attackers to interfere with the networks behind them.

Joint initiatives focus on quantum encryption, defense systems using AI and secure telecommunications. Quantum encryption concerns ways of protecting information using quantum technology. AI defense systems use artificial intelligence to help identify or respond to threats.

The partnership connects research into those technologies with the immediate need to strengthen infrastructure. Its stated focus is the resilience of the systems on which both societies depend.

US, UK and Canada Join Cybersecurity Research

The United States, United Kingdom and Canada have committed to collaborative research and development in cybersecurity and artificial intelligence. Participating agencies include the US Defense Advanced Research Projects Agency, known as DARPA; the UK's Defence Science and Technology Laboratory, or Dstl; and Defence Research and Development Canada, or DRDC.

The partnership aims to develop new concepts of operation, trustworthy AI systems and tools for rapid software certification. Concepts of operation describe how a capability will be used in practice. Software certification involves checking software against the requirements it must meet.

The CASTLE program trains AI to defend networks autonomously against advanced threats. Other projects focus on people working alongside AI and on making information environments more resilient.

Dr. Nick Joad, Director Science and Technology at the UK Ministry of Defence, described the agreement's role in the three countries' research relationships:

Our international research collaborations with both the US and Canada are some of our most vital and enduring partnerships. This agreement cements our collective commitments to advancing emerging cyber security technologies such as cyber security and artificial intelligence to enhance the defence and security of our nations.

The research covers both the capabilities of AI systems and the ways people will work with them. Trustworthiness, operational use and software checks sit alongside the development of automated defenses.

IBM Contract Supports Europe and Eurasia

A $26 million contract awarded to IBM will provide cybersecurity support for allied governments in Europe and Eurasia. The work focuses on digital identification, incident response and capacity building.

Digital identification concerns how people or organizations establish their identity when using digital services. Incident response is the work of dealing with a cyberattack or other security problem. Capacity building develops the skills and resources governments need to carry out that work.

The contract is part of the US Agency for International Development's Cybersecurity Protection and Response program. Its aim is to help create a more resilient digital ecosystem while supporting broader US goals of inclusive growth and democratic societies through secure technology.

The initiative gives a concrete example of private sector involvement in allied cybersecurity. Alongside sharing warnings or developing new tools, the United States is using commercial expertise to help partners strengthen their ability to protect and manage digital services.

Five Eyes Shares Intelligence Across Five Countries

The Five Eyes intelligence alliance brings together the United States, United Kingdom, Canada, Australia and New Zealand. It serves as a model for sharing intelligence and coordinating responses among multiple countries.

Cybersecurity leaders from the five nations regularly provide joint threat briefings and collaborate on strategies against global cyber threats. Those activities give trusted partners a way to share their understanding of attackers and coordinate defensive priorities.

The alliance illustrates the information sharing component of Washington's broader approach. A shared understanding of threats helps participating governments prepare responses across national boundaries, where digital attacks and their effects can spread.

NATO Connects Cyber Defense With Collective Security

NATO recognizes cyberspace as a domain of operations and includes cyber defense in its core tasks of deterrence, crisis management and cooperative security. In practical terms, digital networks are treated as an area in which the alliance must prepare to operate and defend itself.

The alliance holds regular exercises, including the annual Cyber Coalition Exercise. It has also established the NATO Integrated Cyber Defence Centre to improve network protection and awareness of activity in cyberspace.

NATO's Virtual Cyber Incident Support Capability, or VCISC, helps coordinate allied assistance during cyberattacks. It connects countries with resources for malware analysis, threat intelligence and digital forensics. Digital forensics is the examination of digital evidence to understand what happened during an incident.

Recent exercises have focused on protecting critical infrastructure, including undersea cables in the Baltic Sea, and responding to hybrid threats from state actors such as Russia and China. Hybrid threats combine different forms of pressure or disruption, including activity in cyberspace.

NATO's approach rests on information sharing, mutual assistance and the development of national cyber defense capabilities. Members strengthen their own defenses while preparing to support one another during incidents.

India Partnership Extends to Telecoms and Space

Cybersecurity has become a central focus of the rapidly evolving US-India partnership. Joint initiatives include research into quantum encryption, defense using AI and secure telecommunications infrastructure.

The countries have launched projects including the 5G Open RAN initiative and the "Rip and Replace" program to remove vulnerable equipment from telecommunications networks. Open RAN refers to an approach to radio access networks, the systems that connect mobile devices to telecommunications services, using open interfaces between components.

Cooperation also extends to securing space systems and strengthening the resilience of defense technologies. The range of work connects communications infrastructure with systems that support security and defense.

The partnership provides an example of countries working together against digital threats across several technological areas. Research and infrastructure protection are both part of the effort, rather than separate tracks.

South Korea Framework Broadens Cyber Cooperation

The United States and South Korea are expanding their Mutual Defense Treaty into cyberspace through a new Strategic Cybersecurity Cooperation Framework. The framework focuses on deterring adversaries, protecting critical infrastructure and securing digital currency and blockchain applications.

Blockchain is a way of maintaining a shared digital record across a network. Its inclusion, alongside digital currency, brings financial technologies into a partnership that also covers essential infrastructure.

Both countries are investing in cloud computing, digital infrastructure and emerging technologies such as semiconductors and quantum computing. Cloud computing provides computing resources through networked services, while semiconductors are the chips that power electronic systems.

The partnership aims to uphold democratic values in cyberspace and reduce global dependence on technology supply chains associated with adversaries. Its scope connects the protection of existing networks with decisions about the technologies and suppliers used to build future systems.

Coordination Faces Legal and Workforce Challenges

Different organizational structures and legal frameworks can slow information sharing and joint operations. Partners may agree on the need to respond to a threat while still having different procedures for authorizing action or exchanging information.

Rapidly evolving threats add pressure. New vulnerabilities and methods of attack emerge continually, requiring governments and companies to update their defenses and keep learning from incidents.

Workforce shortages affect the same effort. Recruiting and retaining skilled cyber professionals remains a global challenge, with governments competing against private employers for technical talent.

Security measures must also respect privacy, individual rights and democratic values. That requires policy choices alongside technical defenses, especially as cooperation reaches more services and technologies.

The United States and its allies are responding through workforce development, efforts to align standards and continued learning and adaptation. AI and quantum computing bring opportunities as well as risks, making sustained cooperation part of the work of protecting national and allied digital systems.

Key Points

• US cooperation combines threat intelligence, joint exercises, coordinated incident responses, technology research and common standards.
• CISA's JCDC connects government, industry and international partners; USCYBERCOM's INCCA deploys defensive teams globally.
• The US, UK and Canada are researching cybersecurity and AI, including autonomous network defense through CASTLE.
• A $26 million IBM contract supports allied governments in Europe and Eurasia through a USAID program.
• Japan, India and South Korea partnerships cover critical infrastructure and emerging technologies.
• Five Eyes and NATO support intelligence sharing, coordinated defenses and assistance during cyber incidents.
• Legal differences, changing threats, workforce shortages and privacy concerns remain practical challenges.