This is the first in a four-part series adapted from my assessment, “The New Mission Relevant Terrain,” which examines AI-enabled cyber threats to U.S. national security and the defenses they demand. Our focus is on how people and intelligent systems work together to strengthen mission decisions.

Key Takeaways:

• AI models can perform only as well as the information chain that supplies their inferences.
• Cyber intrusions follow an information pipeline from reconnaissance and knowledge representation to reasoning and action.
• Governing what exists, how it is known and why it matters creates a durable defensive advantage.

When policymakers and practitioners discuss Super Intelligence (SI) in cyber conflict, the prevailing image is that of a weapon: a powerful model, built at enormous cost, that can be aimed at a network and fired. By locating capability in the model itself, this image obscures both the nature of the threat and the most durable way to defend against it.

An LLM model is not a warhead. It is an engine that takes in information and produces inferences, the conclusions drawn from the data it is given. Like any engine, it can perform no better than its inputs allow. To understand what agentic AI can and cannot do in a cyber operation, the analysis must start not with the model but with the chain of information that feeds it.

The Information Ladder

The most common analytical error in this field is to collapse that chain into a single step. In practice, it is a ladder, and each rung depends on the one below it.

Data is an observation of reality (not reality itself). Information is data organized. Knowledge is information placed in context. Understanding is the recognition of relationships among pieces of knowledge. Reasoning is the application of logic to understanding. Decision is the application of judgment to reasoning. Action is the application of a decision to achieve a mission outcome.

The distinction between data and the reality it observes is not a philosophical nicety. Every observation is partial, and some are simply wrong. When a flaw enters low in the stack, it does not announce itself as it climbs. It arrives at the top as a confident error, which an intelligence analyst would recognize as a well-reasoned conclusion built on a bad source. The reasoning can be flawless and the outcome still wrong.

An Intrusion Is an Information Pipeline

A cyber intrusion follows the same structure. Reconnaissance is observation: collecting data about a target. Vulnerability identification is knowledge representation: organizing those observations into a model of where the target is weak. Lateral movement is reasoning: drawing inferences across a network that is only partially known. Exfiltration is action, and it is only as sound as everything that preceded it.

When an agentic AI system executes this chain, it is not doing something fundamentally new. It is running the classical intelligence and attack cycle at machine speed. Speed dramatically changes the tempo of the contest, as later installments will show, but it does not change the underlying dependency. At every stage, the model remains a consumer of information, and the quality of that information sets the limit on what it can achieve.

That limit is already visible in practice. The most capable autonomous attacks observed to date did not break down because the model lacked power. They broke down because it lacked trustworthy information: It invented a credential that did not exist, or it mistook publicly available data for something secret. The chain failed at a knowledge seam.

Three Questions That Separate Knowledge From Data

If the model sits downstream of the data, then the enduring determinant of capability, for the attacker and, more importantly, for the defender, is the authority and integrity of the information layer. Sound knowledge representation rests on three questions, each drawn from a branch of philosophy:

• Ontology. What exists? Which assets and conditions are present in the environment?
• Epistemology. How do we know it? What is the source, what is our confidence, and what corroborates or contradicts it?
• Axiology. Why does it matter? Which observations bear on the mission, and which are noise?

Together, these questions distinguish a governed knowledge base from a large accumulation of data. I refer to that governed base as the data substrate. In military terms, it is the terrain: the ground on which every model, friendly or adversarial, must operate.

Why This Reframing Matters Now

Federal agencies are moving agentic AI into mission operations, and adversaries are applying the same technology against them. If we continue to treat the model as the weapon, investment will flow toward marginally more capable models while the terrain beneath them remains ungoverned. That is a poor trade for defenders. A more powerful engine reasoning over unverified, poorly documented data simply reaches the wrong conclusion faster.

The alternative begins with the three questions above. An organization that knows what exists in its environment, how it knows it, and why it matters has built something a model cannot supply on its own and an adversary cannot easily replicate. That is where durable advantage in AI-enabled cyber conflict is won or lost.

In the next installment, I turn from first principles to evidence: two real-world cases that establish autonomous offensive SI as a demonstrated capability rather than a forecast while revealing the ceiling that constrains it.