Cyber Operations Technology Support

Cyber Operations Technology Support is U.S. Cyber Command's (USCYBERCOM's) research, development, test, and evaluation program element under the Defense-Wide appropriation and Budget Activity 7, Operational Systems Development. The FY 2027 request supports the technical foundation of the Joint Cyber Warfighting Architecture (JCWA) and the Cyber Mission Force (CMF). USCYBERCOM uses these systems to defend the Department of War Information Environment, sustain persistent engagement, and give Joint Force Commanders options to detect, disrupt, or defeat adversary activity while preserving U.S. freedom of action in cyberspace.

Data and Analytics (CY50D2) supports the Department of War Cyber Defense Command (DCDC), formerly JFHQ DODIN, and the Cyber National Mission Force (CNMF). DCDC uses integrated data and analytics to direct Defensive Cyberspace Operations and assess risks across its operational terrain; CNMF uses commercial tools and data environments to investigate malicious actors. In FY 2027, the project will prioritize remediation of critical vulnerabilities and evaluate automated scanning, threat-hunting, supply-chain risk, and predictive-analytics tools. It will also bring key analytic expertise in-house so mission teams can respond more quickly.

Artificial Intelligence (CY50H1) moves beyond the 90-day pilots used to test operational applications in FY 2026. USCYBERCOM has completed 18 such initiatives and transitioned four capabilities to CMF use, including a large language model using Retrieval Augmented Generation (RAG). FY 2027 work scales AI across intelligence, surveillance, and reconnaissance; offensive planning and target development; and defensive threat detection and malware analysis. An AI fabric, models accessible at multiple classification levels, machine-learning operations, assurance measures, and training through the Persistent Cyber Training Environment will support safe campaign-level employment.

Joint Cyber Warfighting Architecture Integration (CY50J1) connects four Service-led programs Unified Platform, Joint Command and Control, Joint Common Access Platform, and the Persistent Cyber Training Environment with USCYBERCOM-led Joint Cyber Weapons and Sensors. Having established a JCWA Program Executive Office and technical governance mechanisms, the Command plans in FY 2027 to deploy a common software line and JCWA-wide controls for observability and system availability. Shared standards, identity services, and integrated testing are intended to reduce duplication and speed delivery of interoperable offensive and defensive capabilities.

JCWA Research, Development, and Innovation (CY50J1) provides a separate route from research prototypes to operational programs. Its DARPA/Constellation partnership uses Technical Project Agreements to mature tools against operator needs, while the Cyber Immersion Lab tests and assesses emerging capabilities. FY 2027 plans advance two existing agreements to full operational maturity and add DANDIE for automated data acquisition and integration and VISTA for AI-enabled analysis of social and information-environment trends. The project will also embed earlier AI prototypes in operational workflows and refine the transition pipeline for future DARPA efforts.

Missile Defense and Defeat Environment (CY50M1) develops non-kinetic options against adversary missile systems and supporting infrastructure. Following earlier asset-validation and access-vector tests, FY 2027 work will adapt existing capabilities for additional areas of responsibility, place MDDE-1 and MDDE-3 on new operational platforms, deliver the new MDDE-9 effects capability, and extend MDDE-5 into another area. The effort complements kinetic defeat options and aims to transition, on average, one operationally relevant capability per quarter across the future-years plan.

Data and Sensors (CY50S1) concentrates on sensing and defense for U.S. Indo-Pacific Command, including Defense Critical Infrastructure networks in Guam and other priority locations. Earlier work placed sensors and operational-technology assets, improved automated alerting, and supported an FY 2026 Nuclear Command, Control, and Communications sensing pilot. FY 2027 resources will sustain Indo-Pacific deployments, expand operational-technology sensing, and mature the Data Analytic Support Cell's tools and mission-thread analysis for DCDC command and control. The shift follows the planned conclusion of nuclear sensing-kit procurement.

Cyber Weapon Payloads (CY50W1) develops exploits, implants, modules, and associated hardware and software for authorized offensive missions. Because operational use can expose an exploit, the program maintains a continuous development pipeline rather than a fixed inventory. FY 2027 work expands access to critical adversary systems and continues integrating classified capabilities into common delivery services and JCWA, including work supporting the Pacific Deterrence Initiative.

Joint Cyber Weapons Common Services (CY50W1) provides applications that automate payload delivery, access generation, and targeting analytics, drawing on intelligence sources, command-and-control systems, and delivery platforms. After FY 2026 updates to its mission applications and a planned DARPA prototype transition, FY 2027 activity narrows to essential sustainment and targeted changes needed for persistent access. Joint Development Environment (CY50W1) separately provides secure source repositories, test environments, and automated evaluation for payloads and services; FY 2027 will maintain interoperability and support approximately 2,500 users across its unclassified and classified environments.

Cyber Weapons Tools/Hard Targets (CY50W2) equips the Hard Targets Portfolio Management Office to accept and operate sensitive capability chains developed with government partners. FY 2027 funding sustains capabilities transitioning from those partners and builds DevSecOps pipelines, mission-level testing in contested conditions, and training for CMF adoption. Federated modeling will assess effects across joint and coalition campaigns, while Intelligence, Development, and Operations (IntelDevOps) workflows will accelerate the passage from intelligence insight to operational effect. The larger base-budget role reflects both consolidation of previously mandatory funding and transfer of IntelDevOps fiscal and programmatic responsibility to USCYBERCOM, making continuity during that handover a central justification.