Air Force cyber official: need to invest in digital forensics

Cybersecurity modernization within the Department of the Air Force necessitates increased investment in digital forensics capabilities, according to a principal cyber adviser during a recent industry forum. The central concern highlighted is moving beyond purely reactive incident response; while forensics plays a vital 'after-the-fact' role—determining what happened and who was responsible months later—there is a recognized need to enhance capabilities for real-time threat identification as incidents unfold.
Furthermore, the operational integration of cyber defense requires restructuring how security and operations teams collaborate. While establishing tight coordination is necessary, combining these functions into a single unit is deemed impractical. Instead, liaison relationships ensuring security representation from the planning stage of operational plans are recommended. Finally, there is a push to revolutionize cyber exercises by shifting them from purely reactive drills toward offensive and defensive engagements that more accurately reflect real-world adversary behaviors.

Wanda Jones-Heath, principal cyber adviser for the Department of the Air Force, called for investment in digital forensics at the Datadog Threat Response Forum on Thursday.
Digital forensics is necessary to detect incidents and aid in tracking their origins, even though it occurs after an incident has happened.
Jeffrey Hunt, global operations branch chief for the Department of Defense Cyber Crime Center, spoke at the same event.
Hunt noted that a gap exists between operational teams and security teams regarding network threat visibility.
Combining operations and security into one large unit was cited by Hunt as ineffective.
Jones-Heath suggested changes to cyber exercises so they are not solely reactive modes when data is compromised.
These exercises should incorporate offensive and defensive engagements, moving beyond the assumption that engagement will never occur.
The goal of exercise reform is to allow teams to act decisively if connectivity is lost during an operation.

The narrative presented centers on a systemic friction point: the gap between reactive remediation (forensics) and proactive defense in high-stakes environments like military cyber operations. The strongest assertion—that investment must shift toward real-time capability—is underscored by the admission that current post-incident investigation methods are insufficient for modern threat pacing. This suggests a paradigm where security tooling and procedural structures lag behind adversary innovation, forcing organizations into a perpetual state of catch-up.
The calls for operational integration present a complex organizational trade-off. While seamless information sharing is clearly desirable (a goal driven by the necessity to "keep pace"), Hunt’s resistance to merging teams suggests that institutional culture, mission focus, and existing bureaucratic structures are deeply resistant to wholesale structural amalgamation. The call for liaison roles represents a calculated compromise: maximizing shared insight without dissolving distinct operational identities.
The recommendation regarding cyber exercises points toward an assumption about human limitations in crisis—that doctrine often relies on a 'perfect' scenario where connectivity holds. By demanding offensive engagement simulation, the advice pushes against organizational comfort zones to prepare for inevitable failure states. The benefit accrues to enhanced agency and reduced risk liability; the cost is significant cultural inertia fighting against mandated change.
Patterns detected: none
What structural assumptions must be dismantled—about operational autonomy or bureaucratic necessity—before these integrated security and operations models can achieve traction? If modern adversaries are constantly evolving, does a reliance on historical planning cycles inevitably guarantee vulnerability, regardless of investment level? How might organizations incentivize risk-taking in simulation to move beyond the comfort zone of theoretical safety?