The US Army Now Runs Cyber Like Artillery: Inside the Fire Cell Built for Epic Fury

What a cyber fire cell actually is

Every division headquarters has a fires cell: the desk where artillery, mortars, close air support and naval gunfire are deconflicted, sequenced and matched to targets. Its job is not to produce ammunition. Its job is to put what already exists into the right order and tie it to the commander’s scheme of manoeuvre. The Joint Integrated Fire Cell ARCYBER built for Epic Fury applies that same logic to cyber effects.

By Eubank’s account, the cell’s main contribution was to knit together the Joint Force Headquarters-Cyber, which sits under US Cyber Command, and the Army Cyber headquarters behind it. In practice that meant the headquarters running the operation could reach into ARCYBER’s full capacity — analysts, infrastructure, specialist teams — through a single door rather than through a chain of liaison requests.

His example makes the mechanism concrete. When his deputy at the joint headquarters said he needed intelligence support, the cell let ARCYBER surge analysts into the fight so that the joint headquarters could keep working its own mission set instead of stripping itself to cover a single task. That is textbook fires-cell behaviour applied to a domain that has rarely been managed this way.

The important point is that the JIFC is neither a weapon nor a piece of software. What was created is a procedure — a decision architecture governing when cyber effects fire, what result is sought against which target, and how that is synchronised with kinetic action. Defence coverage tends to follow hardware. Outcomes tend to follow arrangements like this one.

The construct was borrowed from a night in Venezuela

ARCYBER did not invent the idea. Fleet Cyber Command established a comparable cell in the run-up to Operation Absolute Resolve in Venezuela. Vice Adm. Heidi Berg, who commands Fleet Cyber Command, described that cell as instrumental during the raid that captured Nicolás Maduro.

ARCYBER, which conducts cyber operations on behalf of US Central Command, studied that operation, made its own adjustments and rebuilt the construct for Epic Fury. Cross-service adoption of a procedure sounds unremarkable until you consider how slowly best practice usually travels between American service components — the honest timeline is normally measured in years, not months.

Standing up the same cell for two consecutive named operations is the signal worth reading. Military structures doctrinalise through repetition: the next step is for the cell to stop being an improvisation and become a standard annex to operational planning. When officials say the construct is likely to become a mainstay, that is the process they are describing.

One detail underpins all of it. Each service’s cyber component commander also heads a Joint Force Headquarters-Cyber under US Cyber Command, and each of those headquarters is assigned to a different combatant command for planning, targeting, intelligence, synchronisation and command and control. The JIFC is where that dispersed map of responsibility collapses onto one table for the duration of a fight.

Lights out: what cyber effects look like from outside

US officials acknowledged the use of cyber and other non-kinetic effects during the Venezuela operation. The New York Times reported that American cyber operations turned out the lights in Venezuela, interfered with air defence radars and disrupted hand-held radios.

Those three lines say a great deal about operational value. Cutting power is less about civilian disruption than about breaking the energy and communications chain a defensive system depends on. Interfering with radar produces the same effect as reducing an aircraft’s radar cross-section, without expending a missile. Disrupting radios stretches the defender’s decision cycle: a patrol that cannot report what it sees adds minutes to a response that was already too slow.

Brandon Pugh, the Army’s principal cyber adviser, told the conference that senior leaders have grown markedly more candid about all of this. “Historically we’ve kind of shied away from that topic,” he said, attributing the new openness to the fact that the capability has proved useful. “We’re seeing this not just be an isolated and siloed capability that only rests in Georgia or in Maryland.”

The geography in that sentence is deliberate: Fort Eisenhower in Georgia is ARCYBER’s home, Fort Meade in Maryland is Cyber Command’s. The point is that cyber is moving out of the specialist enclave and into the operational commander’s hand. Pugh put the consequence plainly — cyber can enable other objectives in conflict, and it can achieve objectives of its own.

Before and after, side by side

The way cyber effects attach to an operation has shifted through three stages over the past decade. The table below sets the pre-cell arrangement against the one Epic Fury used.

An idea on loan from air power

Calling the JIFC a cyber CAOC is not lazy shorthand. The combined air operations center exists because air power was once a scattered affair, with each service flying its own aircraft against its own priorities; the CAOC pulled dozens of aircraft types, tankers, reconnaissance assets and electronic warfare platforms under a single daily air tasking order.

Cyber’s present problem rhymes. The capabilities exist, but the process determining who uses what, and when, has trouble keeping pace with the fight. A cyber effect usually depends on a narrow window: access closes, the target patches, the network re-architects. If approval takes three days, the effect may remain technically possible and operationally worthless.

So the cell’s real product is not speed but simultaneity. The overlap between an assault’s H-hour and the moment the lights go out is not luck; it is a shared targeting cycle. Air power took years to mature that cycle. Cyber has, on this evidence, a two-operation track record.

The analogy also has a hard limit. An air tasking order can compute how many aircraft carry how much ordnance to which target. In cyber, the ordnance is largely pre-existing access, and access is usually consumed the moment it is used. A fire cell can schedule that resource. It cannot manufacture it.

The quieter story: ARCYBER is rebuilding itself like a corps

The second thread from Eubank’s remarks draws fewer headlines and will probably outlast the first. ARCYBER is reorganising to operate more like a corps, with the aim of supporting conventional Army formations in a shape those formations already understand.

The technical substance is a move from a table of distribution and allowances (TDA) to a table of organization and equipment (TOE). TDA units are typically non-deployable and can reshape themselves as missions evolve; TOE units are standardised in manning and equipment, which is what makes them deployable and rotatable.

In Eubank’s words, the change puts the headquarters “in a main command post, contingency command post formation, just like a corps, so we war fight better,” with brigades, battalions and then team-level structures beneath it. The practical consequence is that cyber formations acquire company, battalion and brigade commanders — and with them a career path, a promotion ladder and an accountability model spoken in the same language as every other branch.

The headline number is modest but pointed: cyber protection teams grow from 20 to 22. That is less a capability jump than the institutionalisation of capacity that already existed.

Why now: the authorities question

Cyber operations were constrained for years by law rather than by technology. What US cyber forces could do, at what threshold and on whose approval, was drawn narrowly. From 2018 onward, new authorities from the executive branch and Congress widened that frame, and cyber forces began operating far more often and far earlier.

Eubank’s line that “over the past five months, the teams have really been able to hone their skills based on the work they’re doing inside of a live environment” is the practical dividend of that shift. The gap between exercise and operation is wider in cyber than in most branches: a technique that works perfectly in a laboratory can be erased by a single patch decision on a real network.

That is also a risk line. The more the capability is used, the faster an adversary learns. Every access spent is a lesson delivered to the defender. Cyber effects behave less like stockpiled ammunition than like a resource that erodes with use.

The limits: a fire cell does not make ammunition

The JIFC’s promise is synchronisation; its constraint is supply. An artillery battalion can order more shells. A cyber unit cannot multiply access at the same rate — access is bought with intelligence work, patience and, frequently, years.

The second constraint is the intelligence gain-loss problem. Being inside a target network also means collecting from it. Spending that access to produce an effect closes a collection source. A fire cell accelerates the decision; it does not remove it, and as operational tempo climbs, the trade gets made more often and with less deliberation.

The third is measurement. A munition’s effect can be confirmed with imagery. A cyber effect is usually read from indirect signals. You can see that a radar screen went quiet; you cannot always tell whether it went quiet because of your effect or because someone switched it off. Battle damage assessment remains one of the domain’s weakest links.

The allied read

Most NATO members have built respectable cyber and electronic warfare capabilities over the past decade. Türkiye’s own ecosystem — ASELSAN, HAVELSAN and STM across cryptographic devices, cyber fusion centres and threat intelligence — is a case in point, alongside a battlefield electronic warfare record built on systems such as KORAL.

What the American example illustrates is that the harder problem sits downstream of procurement. The question is not whether a country fields cyber capability, but through what procedure that capability reaches the commander running the fight. That the world’s largest cyber organisation is still stitching this seam in 2026 says something reassuring to everyone else working on the same problem.

Sources

• Breaking Defense — “Army Cyber created an ‘integrated fire’ cell for Epic Fury”, 24 August 2026 (TechNet Augusta interview).
• US Army Cyber Command (ARCYBER) — organisation and mission.
• US Cyber Command — Joint Force Headquarters-Cyber construct.
• The New York Times — reporting on non-kinetic effects used during the Venezuela operation.

Related Coverage

• Patriot and THAAD Now Fire From the Same Network: The Quiet Revolution in US Air Defence
• Terma to Acquire Danish Encryption Firm Dencrypt
• The Navy Finally Shows Its Long-Range Card: AIM-424 Malice