COL (R) Candice Frost Briefs Senior Leaders on Agentic AI and the Changi...

COL (R) Candice Frost Briefs Senior Leaders on Agentic AI and the Changing Face of Cyber Warfare

COL (R) Candice Frost speaks at a Cyber Intelligence Club event organized by IWP CIO Dean Lane. On May 20, The Institute of World Politics community gathered at the historic Army Navy Club (ANC) in Washington, D.C., for a timely plenary briefing by COL (R) Candice E. Frost. This event was part of a monthly lecture series for the Cyber Intelligence Club at the ANC organized by Dean Lane, Chief Information Officer and Senior Vice President of Cyber Intelligence. A retired U.S. Army Colonel, Vice President of Mission Engagement at Parsons, and Adjunct Professor in Georgetown University’s Security Studies Program, COL Frost delivered an uncompromising, strategic analysis of how advanced computational capabilities are reshaping global security dynamics. Titled “Agentic AI and the Digital Battlefield: 2026 Operations Update,” the address moved past standard industry buzzwords to dissect the structural fusion of artificial intelligence, electronic warfare, and space assets among our most persistent state adversaries. COL Frost opened the briefing by declaring the traditional concept of network defense—historically bound by linear models like the Lockheed Martin Cyber Kill Chain—effectively obsolete. The integration of “Agentic AI” (autonomous reinforcement learning systems capable of independent decision-making inside a target network) has collapsed adversary dwell time from weeks to mere milliseconds. When offensive cyber agents can map network topologies, discover zero-day vulnerabilities, and execute disruptive payloads without beaconing back to external command-and-control servers, human defensive reaction windows disappear. Drawing directly from the tactical realities shaping the current threat environment, COL Frost provided a comprehensive masterclass on the “Big Four” nation-state adversaries: The Russian Federation: Shifting from the manual playbooks of a decade ago, Russian military intelligence (GRU’s Sandworm and APT28) is leveraging Large Language Models to conduct automated cognitive warfare at an algorithmic scale. Simultaneously, foreign intelligence (SVR’s APT29) continues to execute quiet, “low-and-slow” supply chain intrusions—evidenced by the systemic poisoning of developer CI/CD environments—and highly tailored spear-phishing campaigns like GRAPELOADER. The People’s Republic of China: Representing the most formidable long-term structural threat, the People’s Liberation Army’s recent reorganization has yielded a potent “Space-Cyber Nexus.” Advanced persistent threat actors like Volt Typhoon and Salt Typhoon are executing aggressive “battlefield preparation” by “living off the land” within U.S. critical infrastructure and deep within the routing core of Western telecommunications. This deep, persistent access positions China to disrupt U.S. troop mobilization and compromise orbital command telemetry (TT&C) streams in the event of an Indo-Pacific conflict. Iran: Operating as the ultimate gray-zone equalizer, the IRGC (through groups like CyberAv3ngers) is deploying automated machine learning models into Operational Technology (OT). These tools can passively map the industrial control logic of smart grids and municipal water utilities, allowing regional proxies to trigger physical destruction while feeding normal telemetry data back to human operators. North Korea: Elevating cybercrime to a primary pillar of statecraft, the Lazarus Group is actively funding the regime’s ballistic missile programs through multi-billion-dollar cryptocurrency thefts, such as the historic Bybit exchange heist. Furthermore, North Korean operatives are systematically infiltrating Western tech supply chains by utilizing generative AI to craft flawless corporate personas and pass remote technical interviews. COL Frost concluded with a strong call to action for collective defense. Because state adversaries, criminal access brokers, and ransomware-as-a-service (RaaS) syndicates operate as an interconnected, fluid community, Western defenders can no longer afford to protect their enterprises in isolated, bureaucratic silos. While defensive AI is critical for threat hunting at machine speed, algorithms lack the strategic empathy and geopolitical context required to determine intent or calculate proportional thresholds under international law. True digital resilience requires “the power of the pack”—a seamless, multidisciplinary synchronization between private-sector technology innovators, academic researchers, and national security strategists to out-collaborate the global syndicates operating in the shadows.