An offensive cyber operation is an active attempt to disrupt, damage, disable, or interfere with a digital target. Unlike ordinary defense, which aims to detect, contain, and recover, offense is intended to change the target’s state: shut down services, corrupt data, control systems, or prevent the target from functioning as intended.
This matters because offensive action can create real-world risk. A mistake in attribution can hit the wrong system, and a poorly scoped operation can spread beyond the intended target. In practice, offensive cyber operations appear in state operations, criminal attacks, and tightly authorized countermeasures such as disruption campaigns or red-team exercises. They require clear authority, careful targeting, logging, and oversight, because technical success alone does not make the action safe or lawful.