Writing Team
-1.png)
Diplomacy and cyberwar operate on different clocks.
A preliminary U.S.-Iran agreement reached over the weekend aims to halt nearly four months of fighting and set up a formal signing in Geneva later this week. Five current and two former U.S. officials told Nextgov/FCW the same thing independently: Iranian cyber operations against American systems will continue regardless. One said there is "no chance" Iran and affiliated groups would cease or slow down in cyberspace. Another described cyber conflict as "definitely part of warfare that keeps going" — an "ongoing normal course of business."
The deal, notably, contains no mention of cyber.
What's Already Happened
The conflict, which began on February 28, has produced a documented string of Iranian-linked incidents against U.S. targets. Stryker, the medical technology company, was hit. FBI Director Kash Patel's personal email was targeted. Federal agencies issued multiple warnings about intrusions into U.S. critical infrastructure.
On June 11, California Water Service announced it was investigating claims that Iranian hackers breached its systems, potentially reaching a customer billing database. As of Tuesday, the utility reported no known operational disruptions to water or wastewater systems and said it was working with state and federal officials. The investigation is ongoing.
These aren't isolated incidents. The U.S. intelligence community assessed this year that Iran and affiliated proxy groups represent a persistent cyber threat to American networks and critical infrastructure — and that they intend to continue targeting the U.S. and its allies.
Why a Deal Doesn't Change This
The structural problem is one of attribution and control. Iran's cyber operations don't all originate from state-directed teams. A significant share comes from hacktivist groups that align ideologically with Iran but aren't directly controlled by Tehran. As one former official noted, if pro-Iran hacking collectives object to a finalized resolution, they may conduct attacks specifically to express that objection — and Iran's central government doesn't reliably have authority over them.
Meredith Burkart, the FBI's former chief of cyber policy, put it plainly: "The Iranians have targeted U.S. assets with malicious cyber activity for the last 15 years with espionage and some prepositioning for disruptive attacks. Unless there has been a material change in their cyber workforce, or a cyber-specific component of the deal was reached, I would expect such targeting to continue."
No cyber-specific component was reached.
AI Is Now Part of the Threat
The detail that changes the calculus: Tehran's hackers have grown more organized, more coordinated, and more willing to use artificial intelligence for influence operations in recent months, according to Israel's top cyberdefense official, who spoke to Nextgov/FCW last month. Those capabilities have been demonstrated actively since the conflict began.
This connects directly to the broader conversation happening at the G7 this week, where Anthropic and Google DeepMind called for international cooperation on AI's role in cybersecurity and national security. The use of AI for state-aligned influence operations isn't a future concern. It's a current one, documented and escalating.
What This Means for Organizations
For marketing and growth teams operating digital infrastructure, state-linked cyber threats can feel abstract until they hit a vendor, a platform, or a supply chain partner. The Stryker attack and the California Water Service breach are reminders that critical infrastructure targeting is indiscriminate in its downstream effects. Any organization dependent on third-party systems — which is every organization — carries indirect exposure.
The more immediate implication for businesses building on AI-connected infrastructure is that AI-assisted influence operations are now a documented tool of state-aligned adversaries. Synthetic content, coordinated disinformation, and AI-generated phishing are not hypothetical attack vectors. They're active ones, and the organizations most likely to be caught flat-footed are those that haven't updated their threat models to account for AI on the offensive side.
The deal may hold on nuclear terms. On cyber, the officials who know are not optimistic.
Building AI-connected systems and want to understand the security implications? Winsome Marketing helps growth teams make smart decisions about AI adoption and risk. Let's talk.