Defence of domestic or deployed military missions from cyber threats will require a significant investment to overcome challenges in terms of tools, personnel, time, and cultural change. This truth is largely understood across the defence community, prompting investment into military cyber capabilities as senior leadership across the 5 Eyes countries comes to realise the potential impacts and general challenges involved in countering cyber-delivered effects or cyber-enabled espionage. The increasingly large volumes of financial and personnel resources being allocated to defensive cyber operations and IT security (DCO/ITS) capabilities engenders hope amongst long-time cyber operators who understand that an insufficient investment would likely lead to the loss of sustained cyber-superiority within one’s own systems. While the levels of investment and support inspire hope, the potential to narrowly focus on capabilities that can be directly defined as being “hard cyber” presents risks by causing artificial separation between supporting and operational functions in terms of funding, requirements, and authorities. Any internal resource reallocation taken from Information Technology (IT) service delivery organizations to create “new” cyber investment could reduce available support from these organizations. The allocation of funding to cyber operations capabilities without accounting for the resulting pressures upon support functions could also lead to sustainability issues. Creating authority and responsibility silos could also degrade how DCO/ITS and support functions make integrated plans. This article will discuss key elements of the relationship between DCO/ITS capabilities and how IT systems are managed, and provide perspectives on how they can be leveraged together to significantly advance an organization’s overall cyber operational capability. Understanding the interdependency How a network is managed, specifically its technical management capabilities, has a significant impact on the range of mechanical options available to cyber defence and security personnel. Deploying purpose-built defensive cyber operations (DCO) capabilities is required, but it is not the simple acquisition, deployment, and use of those technologies that will win the cyber fight, just as simply having tanks does not win the tactical fight. From a technology perspective, many advanced cyber defence tools need specific types of services, configurations, and accounts to allow them to function effectively. In terms of process, change and configuration management needs to account for potential actions being initiated for defence or security purposes. Finally, DCO/ITS capabilities can be used to enable ISS and product managers to more effectively monitor and manage the health and hygiene of an IT system, which directly benefits any related defence or security efforts. A network’s maturity state for cyber defence and system management are highly linked Cyber capabilities are dependent upon the maturity of a range of processes and technical configurations within an IT system. There are many examples of this type of dependency: deploying security patches within a network uses that system’s mechanisms to deploy any generic patch; effective network monitoring should use context information from endpoints and networking devices to inform and enrich information; deploying custom tools to devices during an incident relies upon the IT system’s underlying ability to remotely install, manage, and configure programs; and, restoring a hacked device to a safe and trusted state leverages tools to deploy new hosts and to manage endpoint configuration. What the defender can do in any given situation is limited or enabled by the options that the underlying system provides. Increases in the type and quality of information can improve intrusion detection activities, just as granular endpoint configuration management can improve the dexterity of actions aimed at blocking an attack or eradicating malicious code. Understanding this critical dependency, the capabilities to manage network infrastructure, users, program, endpoints, and data should be recognized as providing two types of value to any organization. The first is the efficiencies that are...