Distributed by design: Why Agile Combat Employment needs one platform, not a dozen

Air Force doctrine (AFDN 1-21) defines ACE as operational dispersal and proactive maneuver within threat timelines. Executing this requires centralized command, distributed control, and decentralized execution, meaning Airmen at austere sites cannot wait for information to travel back and forth to a main base before acting. Main operating bases feature established networks, security tools, and expert staff. ACE spreads operations across locations with variable equipment, limited bandwidth, and leaner teams. As locations multiply, placing specialists at every site becomes impossible.

ACE requires scalable visibility. Aggregating data across sites gives local operators immediate situational awareness while allowing centralized experts to see across seams, troubleshooting and restoring operations remotely when local capacity is exceeded.

Generating combat power at dispersed locations depends heavily on expeditionary support equipment, such as generators, fuel systems, ground communications, and diagnostic tools. As this gear becomes increasingly networked, it faces cyber risks common to industrial IT and OT environments having been built primarily for efficiency rather than hostile cyber environments.

Cyber threat advisories from CISA, NSA, and FBI highlight Advanced Persistent Threats (APTs) maintaining long-term access to critical infrastructure through administrative tools and living-off-the-land techniques to preposition for crisis disruption.

Disrupting support infrastructure impacts mission generation just as effectively as targeting aircraft directly. Maintaining telemetry across these systems enables remote experts to detect anomalies, correlate multi-site activity, and support on-site Airmen when threats exceed local expertise.

Elastic provides a common data layer anchored on three core principles built for distributed operations:

1. Built for performance: Elastic normalizes disparate data via the Elastic Common Schema (ECS), enabling rapid search and correlation across IT, networks, security tools, and support equipment as new sites come online.

2. Open by design: Multiple ingestion options (e.g., Elastic Agent, Beats, Logstash, and APIs) allow seamless integration of new and legacy data sources without platform redesigns.

3. Wired for innovation: Elastic Cloud Hosted is FedRAMP High authorized, while self-managed deployments operate in disconnected and air-gapped environments at all classifications. Elastic Workflows allows natural-language orchestration with human-in-the-lead approval for consequential actions, supporting decentralized execution with proper authority.

ACE relies on Mission Ready Airmen cross-trained outside their primary specialty. While this reduces footprint requirements, Airmen may lack deep specialized experience when troubleshooting complex systems in remote environments.

Aligning with the Department of the Air Force’s 2026 AI Strategy, AI capabilities connected from enterprise to edge act as an active teammate that uplifts and levels up Airmen rather than replacing them. Functioning as a true force multiplier, AI empowers Airmen to operate with expert-level proficiency across unfamiliar domains. With technical data structured as an accessible knowledge base, AI agents diagnose faults, surface relevant procedures, and connect Airmen to remote specialists who view the same live telemetry to accelerate decision-making.

Recent GAO findings on maintenance delays emphasize that readiness depends on getting actionable data to personnel quickly. Elastic provides the data layer uniting telemetry across operational, maintenance, and security domains, ensuring AI serves as a powerful teammate that expands human capability while keeping ultimate control in the hands of the operator.

At each spoke, Elastic collects local IT, equipment, and sensor data to maintain autonomous edge operations even during denied or degraded connectivity.

When connected, cross-cluster search links nodes into a unified operational picture, allowing experts to correlate events across sites and distinguish isolated malfunctions from coordinated attacks. Correlating data across locations lets teams see across operational seams and act rapidly. Combined with AI agents and human-in-the-lead workflows, Elastic provides Mission Ready Airmen with unified visibility and the speed required to meet mission demands.