Bangkok — The number 3,800 is what finally moved the Thai cabinet. That was the count of “high-grade” cyber attacks against government networks in December alone, three times the typical monthly figure for 2023. On 8 May 2025, ministers approved a new National Cyber Defense Command, handing the military a unified headquarters and 3.6 billion baht to defend its digital turf.
Prime Minister Paetongtarn Shinawatra signed the order placing the unit under the defence ministry. The command will have 450 staff drawn from the army, navy, and air force. They will work out of a joint operations floor inside the army’s Chaeng Watthana compound.
Why the military acted now comes down to that December spike. Sensors run by the National Cyber Security Agency — the NCSA — logged the surge. Most of the probes traced back to IP ranges in Eastern Europe and Southeast Asia, according to NCSA telemetry shared with reporters the day before the cabinet vote.
“The volume crossed a threshold,” Defence Minister Phumtham Wechayachai said after the vote. “We can no longer rely on scattered IT cells inside each service.”
The new command will sit alongside existing cyber crime police and civilian agencies. Its legal charter restricts it to defending .mil domains and classified intranets. Offensive digital operations stay with the Royal Thai Signals Department. Officials say that distinction keeps the command within the constitution’s ban on military action against civilians.
A three-star general will lead the command and report directly to the defence minister, bypassing the chiefs of staff. Three directorates — Threat Intelligence, Network Security, and Digital Resilience — will rotate round-the-clock watches.
The 42 percent jump in hostile intrusions since January gave the cabinet its immediate justification. But defence officials had already begun drafting the command structure late last year, when the NCSA’s December data came in. The 3,800 high-grade attacks in a single month dwarfed the 2023 monthly average. That number appears to have been the tipping point.
The budget works out to roughly US$98 million. The staff of 450 will come from existing military personnel. No new conscription or large-scale hiring is involved.
The command’s location at Chaeng Watthana puts it inside an existing military compound. The joint operations floor is described as a new facility built for round-the-clock monitoring. The three directorates will each handle a slice of the mission: tracking threats, securing networks, and building resilience against future attacks.
Thailand has faced a steady rise in cyber intrusions over recent years, but the December figure appears to have been a step change. The NCSA logged 3,800 high-grade attacks against government IP addresses in that single month. The monthly average for all of 2023 was one-third of that.
The command’s creation does not change the legal boundaries for military cyber operations. Offensive action remains with the Signals Department. The new unit defends. That line matters under Thai law, which restricts military action against civilians. Officials stressed the command will not cross it.
Phumtham’s statement after the cabinet vote made clear the military’s old approach — scattered IT cells in each service — was no longer viable. The new headquarters centralizes defense under one roof, one general, and one budget.
