He returned to the campus to update strategy to fit the age of probe, thievery and assault over computer networks. At the core of the cyberstrategy published by the Pentagon on Thursday was a hierarchy of cyberattacks.

The strategy said that routine attacks should be fended off by companies. The Department of Homeland Security is responsible for detecting more complex attacks and helping the private sector defend against them.

But, in a significant declaration, about 2 percent of attacks on American systems, officials say, may rise to the level of prompting a national response — led by the Pentagon and through the military’s Cyber Command, which is based alongside the National Security Agency in Maryland.

“As a matter of principle, the United States will seek to exhaust all network defense and law enforcement options to mitigate any potential cyberrisk to the U.S. homeland or U.S. interests before conducting a cyberspace operation,” the strategy says.

But it adds that “there may be times when the president or the secretary of defense may determine that it would be appropriate for the U.S. military to conduct cyberoperations to disrupt an adversary’s military related networks or infrastructure so that the U.S. military can protect U.S. interests in an area of operations. For example, the United States military might use cyberoperations to terminate an ongoing conflict on U.S. terms, or to disrupt an adversary’s military systems to prevent the use of force against U.S. interests.” That last phrase seemed to leave open the door for pre-emptive cyberattacks.

Until now, most American cyberattacks on adversaries have been covert operations.

Mr. Carter, questioned by Amy Zegart, a political science professor who directs Stanford’s cyberinitiatives, defined a major cyberattack as “something that threatens significant loss of life, destruction of property or lasting economic damage.” That could cover myriad daily attacks, but Mr. Carter acknowledged that in the biggest case to date — the attack on Sony last November — the president chose to respond with sanctions on North Korea, “not in cyberspace.”