White House Cybersecurity Posture of the United States 2025

Keypoints

• Annual threat assessments typically begin with an introduction and foreword that explain the report’s purpose, scope, and timeframe, then organize findings by actor type or threat category before ending with cross-cutting trends and strategic implications.
• They usually cover nonstate threats first, including transnational crime, terrorism, illicit finance, cybercrime, trafficking, and migration pressures, because these risks directly affect homeland security and public safety.
• The report then moves to major state actors, where it evaluates military power, cyber capabilities, economic coercion, intelligence activity, space competition, WMD risks, and influence operations.
• Across the report, a recurring theme is that threats are increasingly interconnected: criminal networks, terrorist groups, and state adversaries reinforce one another through logistics, weapons, financing, and technical support.
• Another major takeaway is that adversary cooperation is growing, especially among China, Russia, Iran, and North Korea, making each actor more resilient and increasing the chance that conflict involving one could draw in others.
• China is described as the most capable long-term strategic competitor, with the broadest reach across military, cyber, economic, technology, space, and influence domains.
• China’s cyber campaign remains especially significant, including prepositioning in critical infrastructure under publicly tracked activity such as Volt Typhoon and telecom compromises referred to as Salt Typhoon.
• China’s military modernization continues to accelerate, with advances in naval, missile, electronic warfare, and counterspace capabilities aimed at deterring or defeating U.S. intervention, especially around Taiwan and the Western Pacific.
• Taiwan remains a major flashpoint, with Beijing applying increasing coercive pressure, expanding military activity around the island, and using economic and diplomatic tools to isolate Taipei.
• The report underscores that China’s economic leverage is also strategic, including dominance in critical minerals, supply chains, and export controls that can disrupt U.S. industry and technology development.
• Russia is assessed as resilient despite war losses, with the Ukraine conflict sharpening Moscow’s military experience, strengthening its defense-industrial adaptation, and deepening dependence on China, Iran, and North Korea.
• Russia’s cyber, disinformation, and influence operations remain persistent, with a focus on election interference, societal division, and support for wartime military operations through disruptive malware and integrated tactics.
• Iran is portrayed as weakened but still dangerous, relying on missiles, UAVs, cyber operations, and proxy networks such as the Axis of Resistance to pressure Israel, threaten U.S. forces, and sustain regime survival.
• The report highlights Iran’s regional volatility, especially the effects of the Gaza war, the fall of the Asad regime, and continued attacks by groups such as the Huthis and Iraqi Shia militias.
• North Korea is presented as an increasingly aggressive nuclear and missile threat, using its expanded strategic partnership with Russia to gain money, technology, and military support while continuing illicit finance and cyber theft.
• North Korea’s cyber theft, especially cryptocurrency theft, is framed as a key source of regime funding and a growing enabler of weapons development.
• Nonstate criminal threats remain severe, especially fentanyl trafficking, human trafficking, money laundering, and cyberattacks on healthcare, municipal systems, and water utilities.
• The report notes more than 52,000 U.S. synthetic opioid deaths in the 12 months ending October 2024, showing how illicit drug flows remain a major public health threat.
• Mexico-based cartels such as the Sinaloa Cartel and New Generation Jalisco Cartel remain dominant producers and smugglers of fentanyl and other drugs, while cartel tactics in Mexico have become more lethal and militarized.
• ISIS remains the most capable transnational Islamist terrorist threat, with ISIS-K especially dangerous for external plotting, attacks in Russia and Iran, and the ability to inspire attacks inside the United States.
• Al-Qa‘ida and its affiliates continue to seek U.S. and allied targets, using media, propaganda, and regional affiliates such as AQAP and al-Shabaab to inspire violence and expand influence.
• The report emphasizes that cyber threats are no longer isolated technical incidents; they are woven into broader geopolitical competition, especially through espionage, sabotage preparation, and infrastructure compromise.
• Another recurring finding is that critical infrastructure, healthcare, telecom, water systems, and supply chains are attractive targets because disruptions there can produce immediate public, economic, and political effects.
• Space and counterspace threats are increasingly important, with China and Russia both developing capabilities to jam, disable, inspect, or destroy satellites that support military and civilian life.
• The overall assessment is that the global cybersecurity and national security environment is becoming more contested, more integrated across domains, and more shaped by long-term strategic competition than by isolated incidents.