What Defence Means by the Cyber Domain: Beyond the Word Hacking

The word “cyber” can bring to mind someone breaking into a computer. In Australian Defence, the cyber domain describes a much broader operational environment. Defence’s public explanation includes the interconnected networks, information systems and electromagnetic spectrum that support military communication and operations. [1]

For service families and readers following Australian military news, understanding that broader meaning makes the subject easier to follow. It explains why a story about cyber might discuss communications, training or cooperation between forces without describing an attack or any form of cyber warfare. These seven common assumptions provide a useful starting point.

What is the cyber domain in Australian Defence?

Defence describes the cyber domain as being made up of interconnected networks, information systems and the electromagnetic spectrum. [1] Its August 2024 explanation states that the cyber domain comprises cyberspace and the electromagnetic spectrum, and describes cyber as the fifth warfighting domain alongside maritime, land, air and space. [2]

Myth 1: The cyber domain is only about hacking

Defence’s cyber domain overview covers both defensive and offensive cyber capabilities. It also describes secure communications, situational awareness, logistics and military decision-making as areas supported by the domain. Reducing all of that to “hacking” leaves out much of its purpose. [1]

A better question when reading a cyber story is what the activity enables or protects. Is the report about maintaining communications, preparing personnel or responding to an incident? Those distinctions tell you more than the broad label alone. They also help avoid treating every mention of cyber as evidence that an offensive operation has occurred.

Myth 2: Cyber activity happens only on the public internet

Defence’s description extends beyond public websites and online services. Its August 2024 explanation identifies cyberspace and the electromagnetic spectrum as components of the cyber domain. That makes the Defence meaning broader than everyday references to internet security. [2]

In its May 2026 article about COHERE, the ADF’s cyber domain concept, Defence describes cyber capabilities ranging from radios to laptops as enabling the flow of information across the integrated force. The article describes protecting those information flows as a critical, everyday task. [3]

For a general reader, the important point is the connection between equipment, information and the people using them. Seeing a radio or laptop in a report does not reveal its particular configuration, vulnerabilities or operational role. Public descriptions establish the broad purpose without supplying those details.

Domain, command and capability describe different things

A domain describes an operational environment. A command is an organisational body. A capability is an ability the force develops or employs. Keeping these meanings separate helps explain why “cyber domain”, “Cyber Command” and “cyber capabilities” can appear in the same article without meaning the same thing. The distinction follows Defence’s separate descriptions of the domain and of Cyber Command as a new command within Joint Capabilities Group. [1] [2]

Myth 3: Cyber is separate from the other military domains

Defence identifies five operational domains: maritime, land, air, space and cyber. Its explanation of Cyber Command describes cyber activities being conducted in and through the other four domains and the information environment. [2] These categories help explain different aspects of military activity; they do not imply that each operates independently.

Space provides a useful example of the connection. Defence’s space domain overview identifies military reliance on space-based meteorology, communications, intelligence, and positioning, navigation and timing. [4] A discussion about communicating information can therefore involve more than one domain. The fact that two domains contribute to a task does not make them interchangeable.

When reading a report, look for the relationship being described. Is a space service enabling communication? Is the article explaining how information reaches a user? Keeping the actual task in view is more helpful than trying to assign every piece of equipment to a single isolated category.

Myth 4: Cyber Command is another name for every cyber function

Defence states that Cyber Command was established on 25 March 2024 [5] as a new command within Joint Capabilities Group. [2] Defence describes it as supporting ADF operations and exercises by generating and delivering operational effects. [5]

Cyber Command is not the only cyber-related body in Joint Capabilities Group. The Australian Government Organisations Register lists a separate Cyber Operations Division, responsible for the integration, operation, management and security of Defence’s global strategic communications capability. [6]

These distinctions matter when identifying who did what. If a report names a particular command, division or agency, retain that name when discussing it. A broad reference to Defence cyber activity should not automatically be rewritten as an action by Cyber Command.

Myth 5: Cyber work is performed by isolated individuals

Defence’s 2024 account of Cyber Command’s establishment describes bringing together sailors, soldiers and aviators, along with Australian public servants and Defence industry partners. [2] The public picture is one of organised teams, shared training and professional coordination.

A documented regional example shows what that cooperation can involve. In a release dated 7 July 2025, Defence reported a combined defensive cyber activity in Manila involving ADF Cyber Command personnel and members of the Philippine Army’s Cyber and Network Enterprise Battalions. The activity aimed to strengthen cyber defence, incident response and network protection. [7]

The release also discussed people-to-people links, trust, shared knowledge and working with key partners. [7] It is an example of a reported cooperative activity, not evidence of a named real-world attack or a claim that the participating networks became immune to future incidents.

Myth 6: Cyber matters only when an attack makes the news

Defence’s 2026 account of COHERE places emphasis on protecting information flows, electromagnetic protection and defensive cyber operations that support the integrated force every day across all domains. It describes the concept as a unified framework that brings all aspects of the cyber domain together. [3]

That helps explain why preparation deserves attention alongside incidents. A story about training, planning or improving shared understanding can describe meaningful work even when it has no dramatic attack at its centre. Readers can ask what the activity was intended to improve and whether the report describes a completed outcome or a future aim.

COHERE is also a reminder to distinguish a concept from a delivered capability. Defence’s article discusses using digital modelling to map capability delivery and clarify requirements. [3] Publishing a framework does not, by itself, establish that every capability it envisages has been delivered.

Myth 7: Public reporting reveals the full operational picture

An official article is evidence for the details it actually reports. The Manila release, for example, identifies participants, location and the focus of the activity. It does not provide a complete account of their systems, methods or operational readiness. [7] Readers should keep any conclusions within those published boundaries.

The same discipline applies to dates. A news article’s publication date is not necessarily the date an organisation was established or an activity took place. Cyber Command was established on 25 March 2024, while Defence’s explanatory article about it was published on 9 August 2024. [2] [5]

When sharing an article, separate the confirmed fact from your interpretation. “Defence reported a combined defensive activity” is supported by the Manila release. A claim that it proved the forces could defeat every cyber threat would go beyond the evidence.

Read Defence cyber stories with four questions in mind

• What is the source describing: an operational environment, an organisation, a capability or a particular activity?
• Which purpose is stated: protection, communication, training, cooperation or another publicly identified task?
• Does the source describe an existing responsibility, a completed activity or a future ambition?
• Which details are published, and which conclusions would require additional evidence?

Recognise the people behind the capability

Understanding the terminology gives service communities a clearer way to discuss work that may be less visible than a ship, aircraft or vehicle. When recognising someone’s service, begin with their actual service connection and the details they are comfortable sharing.

Explore Military Shop’s military collectables and gifts for a suitable commemorative item, checking the product’s stated service or unit association before choosing. [8] A personal connection provides a more meaningful starting point than assuming a generic product represents a specialist cyber role.

Sources

1. Department of Defence | Cyber domain
2. Department of Defence | A new era for the cyber domain | 9 August 2024
3. Department of Defence | Shaping Defence’s cyber coherence | 14 May 2026
4. Department of Defence | Space domain
5. Department of Defence | Cyber Command two-year anniversary news article | 22 April 2026
6. Australian Government Organisations Register | Cyber Operations Division
7. Department of Defence | Australia and Philippines strengthen cyber resilience | 7 July 2025
8. Military Shop | Military collectables and gifts