Cyber Risk Reality Check for Defense AI Teams

In 2024, four widely felt cyber events—MOVEit, CDK, Change Healthcare, and CrowdStrike—produced an estimated $8–$10 billion in aggregate economic loss across 2023–2024. That’s a big number, and it’s also the point: big cyber incidents are costly, politically charged, and operationally disruptive.

Now put that beside a different line item: natural disasters drove roughly $280 billion in economic losses in 2023 and $318 billion in 2024. The gap isn’t narrowing. It’s widening.

Most organizations in defense and national security still talk about cyber risk as if it’s the only “catastrophic” scenario worth planning around. I think that framing quietly breaks budgets, distorts readiness priorities, and leads teams to build AI systems optimized for the wrong kind of crisis. The better move is to treat cyber as one threat among many—then use AI to quantify, compare, and actively manage the tradeoffs.

The data says “cyber matters,” not “cyber is everything”

Cyber losses are real, but they rarely dominate national-scale economic damage the way natural disasters do. That’s the perspective reinforced by the latest numbers: single-year natural disaster losses in the hundreds of billions versus multi-incident cyber losses in the single-digit billions.

This matters for defense planners because catastrophe planning always turns into resource allocation: continuity of operations, critical infrastructure assurance, mission assurance, and surge capacity. If leadership treats cyber as the catastrophe, you end up underinvesting in resilience measures that blunt the far more frequent, physically destructive events (storms, fires, floods, earthquakes) that also create cascading cyber and communications failures.

Why the comparison isn’t “unfair” to cyber

A common objection is that natural disasters are “apples to oranges” compared to cyber. They aren’t.

• Both can disrupt logistics, healthcare delivery, fuel distribution, and regional power.
• Both can force emergency operations and shift military support to civil authorities.
• Both can trigger second-order effects: panic buying, supply chain delays, and misinformation.

The real difference is how damage behaves over time. Natural disasters physically destroy. Cyber incidents usually corrupt, deny, or expose—often at scale—but not with the same irreversibility.

Reversibility: the built-in ceiling on many cyber catastrophes

A practical limiter on cyber catastrophe losses is reversibility. Systems can be restored, data can be recovered, and operations can resume—sometimes painfully, sometimes slowly, but often without rebuilding thousands of physical “repair points.”

That reversibility is exactly what makes cyber risk feel paradoxical: it can be massively disruptive without being permanently destructive.

A clean mental model: “repair points” and time-to-restore

Here’s a simple way I’ve found useful when talking to operational leaders.

• Natural disasters create distributed physical repair points: downed lines, flooded substations, broken roads, damaged facilities. Even reaching the repair points can be hard.
• Cyber incidents often create logical repair points: rebuilding images, restoring backups, rotating credentials, reissuing certificates, and validating integrity.

Logical repair can still be brutal—especially across a sprawling enterprise—but it’s frequently faster than rebuilding physical infrastructure at scale.

Where reversibility breaks down

Cyber does become “disaster-like” when reversibility is impaired. Defense and critical infrastructure teams should watch for these conditions:

• No trustworthy backups or backups connected to the same identity plane
• Identity compromise (admin credentials, SSO, PKI) that makes “restore” unsafe
• Safety-critical environments where revalidation and certification dominate timelines
• Long-dwell intrusions where you can’t confidently say what’s clean

This is where AI can help most—not by “blocking all attacks,” but by improving confidence, speed, and decision quality during restoration.

What AI changes: cyber threat assessment becomes measurable

AI doesn’t eliminate cyber risk; it changes the unit of analysis. Instead of debating cyber “catastrophe” as a vibe, you can quantify plausible loss ranges, restoration timelines, and mission impact under different assumptions.

In the broader AI in Defense & National Security series, this is a recurring theme: AI is valuable when it turns uncertainty into structured choices. Cyber risk is one of the best places to apply that discipline.

AI for cyber risk: three use cases that actually hold up

1. Operational impact modeling (mission-first, not IT-first)

   • Map systems to mission threads (deploy, sustain, command, evacuate, treat).
   • Simulate disruptions: “If X is down for 72 hours, what breaks first?”
   • Prioritize controls by mission degradation avoided per dollar.

2. Anomaly detection that’s coupled to response playbooks

   • Detection alone creates alert fatigue.
   • Pair models with decision automation: isolate segments, revoke tokens, force re-auth, switch to degraded comms modes.

3. Restoration acceleration (the underrated win)

   • Use AI to triage: which services must return first for mission continuity.
   • Use AI-assisted forensics to reduce time spent proving a system is clean.
   • Use AI to validate configurations against known-good baselines.

A blunt truth: the fastest way to reduce “catastrophe” losses is to reduce time-to-restore, not to promise perfect prevention.

Planning error: treating “big cyber” as the only black swan

Defense organizations don’t fail because they ignore cyber; they fail because they ignore compound crises. The winter of 2025 has been another reminder that seasonal storms, grid stress, and supply chain brittleness don’t take turns. They stack.

A realistic worst week might look like this:

• A major storm disrupts regional power and transport
• Cellular networks degrade and backup generators run low
• A cyber criminal group opportunistically deploys ransomware
• Misinformation floods local channels and slows response
• Hospitals and emergency services operate in degraded mode

That’s not a “cyber catastrophe.” It’s a resilience catastrophe with a cyber component.

The right question for leaders

Stop asking: “How do we prevent the cyber apocalypse?”

Start asking: “How do we keep operating when multiple systems fail at once?”

This shift is cultural. It changes what you measure, what you fund, and what you test.

A practical framework: AI-driven cyber resilience for national security

Cyber risk management should be a resilience program with AI as the measurement engine. Here’s a straightforward framework defense and critical infrastructure teams can implement without waiting for a perfect enterprise architecture.

1) Define catastrophic impact in mission terms

Write down what “catastrophic” means for your organization:

• Loss of command-and-control visibility beyond a set threshold
• Inability to execute time-sensitive targeting cycles
• Sustainment and logistics delays beyond X days
• Hospital diversion, evacuation failures, or fuel distribution collapse

If you can’t define it, you can’t model it.

2) Build a mission dependency graph

Use a graph approach (even if it starts in a spreadsheet):

• Mission thread → business process → application → identity → network segment → cloud service/vendor

AI can help infer dependencies from logs and configuration data, but the key is having a usable map.

3) Model restoration, not just breach probability

Probability discussions get political fast. Restoration is concrete.

Track:

• Mean time to detect (MTTD)
• Mean time to contain (MTTC)
• Mean time to restore (MTTR)

Then run scenarios: 24/72/168-hour outages of key nodes (identity, EHR-like systems, fleet management, patching infrastructure, satellite comms gateways).

4) Put “reversibility controls” at the top of the backlog

If reversibility is the constraint that caps loss, fund the controls that protect it:

• Offline or logically isolated backups with recovery drills
• Tiered identity with rapid token revocation and break-glass procedures
• Immutable logging and integrity validation
• Clean-room restoration environments

AI can strengthen these by detecting abnormal backup access, flagging identity anomalies, and speeding integrity checks.

5) Test compound crises quarterly

Run exercises that combine:

• Physical disruption (facility loss, regional power outage)
• Cyber incident (ransomware or supply-chain compromise)
• Communications degradation (limited bandwidth, intermittent connectivity)

AI-enabled war-gaming tools can help simulate decision timelines and resource bottlenecks, but the objective is simple: prove the org can operate degraded.

“People also ask” issues leaders bring up (and direct answers)

Can AI give us the upper hand in national cyber defense?

Yes—if “upper hand” means faster detection, smarter containment, and quicker recovery. AI is less reliable as a promise of perfect prediction, especially against adaptive adversaries.

Are cyber losses likely to grow as infrastructure digitizes?

Yes—because more economic and mission activity depends on software and networks. But growth in loss doesn’t automatically mean cyber overtakes natural disasters in total destructive power.

What’s the biggest mistake teams make with AI for cybersecurity?

They build models that optimize alerts instead of outcomes. If the model doesn’t reduce MTTR or mission impact, it’s a science project.

What this means for AI in defense and national security

Cyber threats deserve serious attention. But the numbers and the mechanics of damage point to a more mature posture: treat cyber as a high-frequency, high-disruption risk that’s often reversible—then invest aggressively in the systems and AI workflows that preserve reversibility.

That’s also the most credible way to talk about AI in national security without hype. AI becomes the tool that helps you compare risks, decide faster, and restore operations under pressure.

If you’re building an AI-enabled cybersecurity program for defense, start with two deliverables you can show leadership in 30–60 days: (1) a mission dependency graph for one critical mission thread, and (2) a restoration-focused tabletop exercise with measured MTTR assumptions. Those two artifacts change budget conversations immediately.

Where does your organization sit today: optimized for preventing breaches, or optimized for staying operational when prevention fails?