The 2024 cycle confirmed what analysts have been warning for a decade: adversaries will use low-cost technology and targeted narratives to erode trust, not necessarily to flip vote counts. That is the operating logic. If you prepare for blunt attacks on ballot integrity but ignore influence and cyber probing, you have already ceded the field.

What actually happened, in plain terms Foreign intelligence services and criminal networks ran multi-mode campaigns. They combined AI-amplified disinformation, inauthentic accounts and websites, targeted language campaigns, and cyber intrusions against campaigns and campaign personnel. Russia emerged as the most active influence actor using synthetic content to sow division. Iran conducted disruptive cyber activity against at least one presidential campaign, according to public reporting and government disclosures. The government pushed repeated joint warnings through ODNI, FBI and CISA and issued public service announcements to help the private sector and voters spot tactics.

Five hard lessons 1) The threat is influence first, theft and alteration second. Adversaries aim to shape perceptions and delegitimize institutions because the return on investment is higher and the risk of major escalation is lower. That plays to the asymmetric advantage of small teams and automated tooling.

2) AI changed scale and lowered cost. Automated content generation and amplification enabled adversaries to produce persuasive audio and video at volumes that outpaced existing detection and response capabilities. Expect synthetic artifacts to become routine in post-election narratives.

3) Campaigns and campaigns’ supply chains remain soft targets. Successful intrusions into campaign infrastructure provide raw material for influence operations and blackmail. Operational security for campaigns must be treated like national critical infrastructure.

4) Local and down-ballot races are effective pressure points. Foreign actors deliberately targeted congressional and local races because these are easier to manipulate and the resulting discord amplifies national polarization. Defenders cannot focus only on high-profile contests.

5) Public-private speed matters. The only reason many falsified narratives were blunted was because government agencies, social platforms and civil society moved information and takedown requests quickly. Where coordination lagged, bogus narratives hardened and spread.

Practical recommendations for governments and operators

  • Treat influence operations as kinetic problems. Allocate dedicated analytic and strike teams that combine cyber, OSINT, psychological operations, and rapid legal authority to disrupt malign networks and infrastructure used to amplify lies. Build playbooks that turn monitoring into takedown and attribution into action within hours, not weeks.

  • Harden campaign and political infrastructure. Enforce multi-factor authentication, vetted third-party code and service inventories, routine red-team assessments, and mandatory breach disclosure timelines for campaigns and party infrastructure. Fund and staff regional cyber response teams that can deploy to support local races.

  • Operationalize AI detection and provenance. Invest in tooling that detects synthetic media at scale and promotes provenance standards for authentic video and audio. Require platforms to deploy provenance labels and common protocols for rapid verification. Do not rely solely on voluntary platform measures.

  • Expand defensive briefings and targeted outreach. The intelligence community must continue and scale defensive briefings to campaigns, state and local election offices, and community leaders—especially those serving language-specific communities that adversaries target.

  • Move from transparency to accountability for amplification. Platforms must publish granular transparency reports about coordinated inauthentic behavior, state-linked networks, and political ad dissemination. Where state actors are identified, coordinated sanctions and platform enforcement should follow. Recent sanctions on entities that produced and spread AI-enabled disinformation set a precedent that should be used more deliberately.

  • Prioritize resiliency communications. Election authorities and trusted intermediaries must prepare pre-bunking campaigns and rapid rebuttal channels. When falsehoods appear, the fastest reliable corrective, amplified by trusted local messengers, reduces long-term damage. Prepare messages and amplify them before malign narratives achieve critical mass.

Where money and attention should go first Fund regional cyber-electoral response teams and a national synthetic-media detection hub. Buy capability that cuts response time from days to hours. Fund defensive red teams that simulate combined influence and cyber attacks on real local election systems and supply chains. Prioritize training for county election officials and early-warning info-sharing with ISPs and platforms.

Closing assignment for leaders Accept that elections will be contested in the information domain every cycle. That means three things. First, treat the problem as persistent, not episodic. Second, build mechanisms now so that public and private sectors operate as one defensive organism when the next campaign produces toxic content. Third, stop pretending that transparency alone is deterrence. You need detection, disruption, and consequences.

The 2024 cycle taught a clear lesson. Adversaries will continue to weaponize cheap, scalable tools against public confidence. If you want elections to be decided at the ballot box, act now to stop the vote from being decided in the feed.