ARLINGTON, Va. — The Cybersecurity and Infrastructure Security Agency has operationalized its Joint Cyber Defense Collaborative, stationing commercial cloud engineers, major internet service providers, and federal intelligence analysts side-by-side to disrupt cyber threats in real time.
ARLINGTON, Va. — For decades, the relationship between federal national security agencies and Silicon Valley tech giants was characterized by mutual suspicion, bureaucratic lag, and fragmented information sharing. On Thursday, CISA leadership revealed that its Joint Cyber Defense Collaborative (JCDC) has reached full operational tempo, fundamentally transforming how public and private defenders counter foreign cyber operations.
Established under statutory authority in the FY2021 National Defense Authorization Act, the JCDC brings together major cloud hyperscalers—including Amazon Web Services, Microsoft, and Google Cloud—alongside leading cybersecurity vendors and telecommunications carriers inside unified operational cells.
From Stale Bulletins to Real-Time Telemetry Exchange
Rather than distributing declassified PDF advisory bulletins days or weeks after an intrusion has occurred, JCDC participants operate inside secure, continuous virtual and physical collaboration rooms. When private cloud telemetry detects novel command-and-control infrastructure or weaponized zero-day exploits, private engineers can cross-reference indicators with classified NSA signals intelligence and FBI investigative leads within minutes.
“The traditional model of government warning industry about cyber threats is obsolete,” said Eric Goldstein, CISA Executive Assistant Director for Cybersecurity. “Private technology firms have far greater visibility into global internet traffic than the federal government does. The JCDC creates a shared common operational picture where we plan collective defense together, executing synchronized countermeasures before adversaries can execute their payloads.”
Operational Impact During the Eastern European Crisis
The collaborative model has already demonstrated tangible defense successes during the ongoing crisis in Eastern Europe. JCDC partners successfully coordinated the pre-disclosure neutralization of botnet command servers operated by the Russian GRU’s Sandworm team, pushing defensive rules to millions of commercial firewall endpoints before the malware could be repurposed against Western energy networks.
CISA confirmed that the JCDC is actively onboarding regional electricity generation utilities, major healthcare hospital systems, and municipal water authorities, scaling the defensive umbrella from Silicon Valley data centers directly down to frontline municipal utility operators.