Commanders now responsible for cybersecurity training after Army cuts online course requirement to once every 5 years

The Army reduced mandatory cybersecurity training to once every five years—down from annually—following a September memo by Defense Secretary Pete Hegseth directing military personnel to spend less time on cyber training to focus on combat operations. Army Chief Information Officer Leonel Garciga said the change empowers commanders to assess their units' specific cyber risks and tailor training accordingly rather than relying on a "one-size-fits-all" annual requirement. Cybersecurity experts warned the shift is risky given active Iranian cyberattacks and ongoing threats from China and Russia, particularly because unit leaders not already focused on the digital domain may deprioritize cyber training below their primary mission. Retired Rear Adm. Mark Montgomery cautioned that a five-year requirement is "unusual and probably a little riskier" for an agency under constant foreign attack, and noted that continuity becomes critical as commanders rotate out of leadership more frequently than the training cycle. The success of the new program hinges on whether individual commanders—supported only by web-based resources on the Joint Knowledge Online portal—will effectively implement cybersecurity training amid competing operational demands.