Sweden’s intelligence education system lacks the technical-domain competence required to meet the analytical demands of contemporary cyber intelligence. This finding emerges from a diagnostic analysis of eleven international intelligence education programmes using the Intelligence Competence Framework (ICF), which combines a multi-level analytical structure (strategic, operational, tactical) with the domain classification (technical, formal, informal) of the Systemic-Holistic Approach. When applied to the programmes referenced by Sweden's government inquiry on intelligence reform (SOU 2025:78), the framework reveals that formal and informal domains receive strong coverage across all programmes while the technical domain is systematically underarticulated - particularly at the tactical level, where only one of eleven programmes achieves strong coverage. Three interdependent capability requirements emerge from an analysis of SOU 2025:78, five international programme models (the German BND, the Danish MICS, the French DIReM, the ICE CIADM module, and the Norwegian Etteretningsskolen), consultations with Swedish intelligence practitioners, and contemporary analyses of AI-supported intelligence (NSCAI, Snow Globe, Emergent Intelligence). Organisationally, the proposed intelligence academy requires a professional authority function that sets competence standards across the intelligence community rather than delivering education alone. Educationally, programmes that integrate technical content with professional practice through apprenticeship models, twin-track specialisations, and practitioner-led instruction produce broader competence coverage than purely academic programmes. Technologically, baseline digital literacy encompassing data provenance, tool limitations, and AI-assisted analytical workflows must be treated as a structural requirement in curriculum design rather than as an optional specialisation. The practitioner consultations identified three specific capability gaps in the current Swedish system: OSINT training that moves beyond keyword searching, exposure to AI-assisted analytical workflows before operational deployment, and secure technical environments for realistic practice. A Swedish intelligence academy built on existing European models will inherit the same technical-domain deficit unless technical competence is embedded as a design principle from the outset.

Offensiva cyberoperationer har under det senaste decenniet spridits snabbt och påverkar i ökad grad internationell säkerhet och strategisk stabilitet. Förmågor som tidigare främst fanns hos ett fåtal stormakter återfinns nu hos ett växande antal stater och i vissa fall även hos icke-statliga aktörer. Denna spridning förkortar beslutsfönster, ökar oklarheten kring gränsen mellan fred och konflikt och försvårar avskräckning genom osäker attribution, otydliga trösklar och juridisk tvetydighet. Denna policy brief analyserar hur offensiva cyberförmågor integreras i nationell doktrin och i kollektiva säkerhetsarrangemang, samt hur dessa praktiker samverkar med existerande rättsliga och normativa ramverk. Analysen identifierar risker kopplade till felbedömning och eskalation, inklusive oavsiktliga spridningseffekter och samhällskonsekvenser som följer av starkt beroende mellan militära och civila digitala infrastrukturer. Policy briefen argumenterar för att stabilitet i cyberrymden kan stärkas genom ökad transparens, utvecklade förtroendeskapande åtgärder, tydligare normtillämpning och uthållig multilateral dialog. Avslutningsvis presenteras rekommendationer för globalt samarbete som syftar till att minska eskalationsrisker och främja ansvarsfullt statligt agerande.

This policy brief examines the global diffusion of offensive cyberspace operations and its implications for international security, strategic stability, and escalation management. Once confined to a small number of major powers, offensive cyber capabilities are now widely distributed among states and, in some cases, non-state actors. This diffusion compresses decision timelines, blurs thresholds between peace and conflict, and complicates deterrence through attribution uncertainty and legal ambiguity. The analysis traces how major and middle-tier states have integrated offensive cyber capabilities into national doctrine and collective security arrangements, and assesses how these practices interact with existing legal and normative frameworks. It identifies key risks associated with miscalculation, inadvertent escalation, and civilian harm arising from the deep interdependence of military and civilian digital infrastructure. The brief argues that stability in cyberspace depends on greater transparency, strengthened confidence-building measures, clearer articulation of norms, and sustained multilateral dialogue. It concludes with policy recommendations aimed at fostering responsible state behaviour and enhancing global cooperation to reduce escalation risks while preserving international security.

The significance of Offensive Cyberspace Operations (OCO) in cyber warfare and national security is increasingly recognised, yet academic literature lacks a dedicated theoretical framework to fully articulate its unique aspects and strategic dimensions. Traditionally enveloped within the broader context of information warfare, OCO's distinct characteristics have often been overlooked. Addressing this gap, our paper aims to delineate the specificities of OCO and establish a structured conceptual model that enhances understanding and operational clarity. To achieve this, the study adopts an interpretive approach, drawing from existing literature on information warfare and cyberspace, alongside official U.S. government and military publications on cyberspace operations. Employing the theory-building method, we focus primarily on conceptualization. This involves creating a coherent conceptual framework through abstraction, synthesis, and diagramming, informed by seminal works in the field. Among the paper's key contributions are detailed conceptual models that shed light on OCO's integration within the broader cyber domain, the influence of U.S. policy and strategy on OCO, and the critical triad for successful operations: access, vulnerabilities, and payloads. Furthermore, we elucidate the primary and secondary components of OCO, specifically cyberspace attack and exploitation, offering new insights into their roles and implications. Thus, the framework includes conceptual maps highlighting OCO's key elements, relationships, and challenges, aiming to advance academic discourse, practical strategies, and policy in cyberspace operations. This effort marks a significant step forward in both theoretical engagement and practical application within the field.

This paper reviews the strategic use of warning intelligence to pre-emptively address threats in complex geopolitical scenarios through rapid intelligence sharing. Specifically, the paper reviews the question How, based on research and experience, can a set of principles be applied by states to enhance situational awareness and tackle threat actors through a holistic and collaborative approach to intelligence sharing? The paper examines historical and contemporary alliances like the Five Eyes and reviews a Signals Intelligence Alliance as a case in point, highlighting the importance of collaborative approaches to enhance situational awareness and tackle threat actors. The study, grounded in the philosophical paradigm of interpretivism, adheres to the principles for transparent science when researchers use tools such as large-language-models as grammar editors or research assistants. The paper also acknowledges limitations such as the generalisability of the SIGINT model and the need for continuous adaptation of intelligence sharing practices. The results discuss policy, process, and people challenges to intelligence sharing. The paper concludes that successful intelligence sharing should follow eight general principles. Future research directions include exploring the impact of emerging technologies, human aspects of intelligence sharing, and context-based intelligence sharing alliances.

This paper conceptualises how artificial intelligence (AI) reshapes disinformation campaigns by examining the operational shift from predominantly human-led activity to AI-enabled production, targeting, and adaptation. Using a framework that links Human Intelligence Collector Operations (HUMINT) and Offensive Cyberspace Operations (OCO), the analysis focuses on how recent advances affect operational tempo, content generation capacity, and responsiveness to feedback. The findings indicate that AI-enabled campaigns can accelerate the production and tailoring of narratives by processing large datasets at machine speed and adjusting outputs as conditions change. In comparative terms, AI-driven workflows show higher throughput and faster iteration cycles than human-operated approaches, which remain constrained by personnel scale, time, and coordination costs. These characteristics imply that the marginal cost of producing plausible, audience-specific disinformation decreases as models and automation pipelines mature, which in turn can widen exposure for institutions that rely on slower detection and response processes.

Artikeln behandlar hur teknologisk innovation påverkar den globala säkerheten, och betonar att framsteg inom områden som informations- och kommunikationsteknik och sammankopplade informationssystem, cyberförmågor och artificiell intelligens (AI) har dubbla användningsområden. Först definieras innovation och global säkerhet. Därefter granskas två fall av cyberspionage, som visar hur hotaktörer exploaterar framsteg inom teknologiska innovationer för att främja sina strategiska mål. Dessa fall understryker de sårbarheter och strategiska förändringar som teknologiska innovationer medför, särskilt i samband med ekonomisk stabilitet och geopolitisk maktbalans. Dessutom behandlas den snabba utvecklingen av AI och dess implikationer för krigföring och global säkerhet. Resultaten visar att det krävs en balanserad strategi för att omfamna teknologiska framsteg för internationell dialog och utnyttjandet av fördelarna med innovation samtidigt som riskerna för den globala säkerheten minskas.

The article examines how technological innovation affects global security, emphasising that advances in areas such as information and communication technologies and interconnected information systems, cyber capabilities, and artificial intelligence (AI) have dual-use applications. It first defines innovation and global security. It then examines two cases of cyber espionage, illustrating how threat actors exploit technological advances to advance their strategic objectives. These cases highlight the vulnerabilities and strategic shifts associated with technological innovation, particularly in relation to economic stability and the geopolitical balance of power. In addition, the article addresses the rapid development of AI and its implications for warfare and global security. The findings indicate that a balanced approach is required—one that embraces technological advances to support international dialogue and leverage the benefits of innovation while simultaneously reducing risks to global security.

The purpose of this research is to discover more about the challenges and opportunities faced by intelligence agencies wishing to move their data to the cloud. Intelligence agencies collect and process enormous amounts of data and information and need the tools to do so. Two intelligence communities have moved to the cloud to face these issues but there is little scientific knowledge about moving an intelligence agency’s data to the cloud. No research on the topic could be found and this study aims to fill part of that gap by using a case study research strategy and interviews with experts in the field. A literature review was completed to understand previously identified challenges when adopting cloud and was used to create two sets of interview questions. Five interviews were conducted, and a thematic analysis done resulting in fourteen themes. The themes revealed that there are many challenges with laws and regulations being the biggest one, while the opportunities brought by a cloud solution are the processing and analysis of data, and information sharing.

Threat actors conduct offensive cyberspace operations for many purposes, such as espionage, to destroy information assets, and cybercrime. These operations are possible thanks to the innovation and development of information and communications technologies (ICT). Interconnected information systems have transformed societies positively. However, specific states exploit these systems' vulnerabilities to advance their strategic national interests. Therefore, it is important to know how a state can organise itself to defend against threat actors. The purpose of this research is to present how the smart state Sweden can through a whole-of-society approach organise for Offensive Cyberspace Operations. The intent is to conduct an active and independent foreign-, security- and defence policy, but also as a base for deterrence and defence. This article is based on a mixed methods approach. It uses the case study research strategy to discover new information. Fourteen men and women participated in individual semi-structured interviews. The respondents ranged in age from 40 to 65 with more than 20 years of experience in cyberspace operations, intelligence operations, military operations, special forces operations, and knowledge and understanding about information warfare and information operations. The analytic strategies include thematic analysis and quantitative methods to interpret the data. The results show many themes, but the article is especially focused on the themes of Operations, Capability, Policy & Governance, and Legal Frameworks. Finally, a conceptual map of a whole-of-society approach to organise for offensive cyberspace operations is presented inferred from the themes, codes, and content, and mapped to each responsible agency based on the interviews and codes. The answer to the research question is that Sweden should have a whole-of-society approach to organise for Offensive Cyberspace Operations to project power in and through cyberspace with the intent to conduct an active and independent foreign, security and defence policy and for deterrence, as described in Figure 2. 

The Ambidextrous Framework for Offensive Cyberspace Operations was validated using a simulated cyber conflict emulating a cyber operation against critical infrastructure of a fictious country. The purpose of the validation was to assess how well the Framework supports both planning and execution of cyber operations. Data was collected using self-reporting by a team in the cyber range training facility. The study found that the framework works well to support the planning, preparation, and order giving to execute offensive cyberspace operations. However, it was found to be less suited to support operator actions during on ongoing offensive operation due to its current lack of capability to utilize real-time data from battle-stations.

This article addresses the question under which circumstances zero-day vulnerabilities should be disclosed or used for offensive cyberspace operations. Vulnerabilities exist in hardware and software and can be seen as a consequence of programming errors or design flaws. The most highly sought are so-called zero-day-vulnerabilities. These vulnerabilities exist but are unknown and, when exploited, enable one way of entry into a system that is otherwise not thought possible. Therefore, from an anticipatory ethics perspective, it is important to understand in what cases zero-days should be disclosed or not.