After Mr. Panetta's remarks on Thursday night, American officials described an emerging shadow war of attacks and counterattacks already under way between the United States and Iran in cyberspace.

Among American officials, suspicion has focused on the "cybercorps" that Iran's military created in 2011 — partly in response to American and Israeli cyberattacks on the Iranian nuclear enrichment plant at Natanz — though there is no hard evidence that the attacks were sanctioned by the Iranian government.

The attacks emanating from Iran have inflicted only modest damage. Iran's cyberwarfare capabilities are considerably weaker than those in China and Russia, which intelligence officials believe are the sources of a significant number of probes, thefts of intellectual property and attacks on American companies and government agencies.

The attack under closest scrutiny hit Saudi Aramco, the world's largest oil company, in August. Saudi Arabia is Iran's main rival in the region and is among the Arab states that have argued privately for the toughest actions against Iran. Aramco, the Saudi state oil company, has been bolstering supplies to customers who can no longer obtain oil from Iran because of Western sanctions.

The virus that hit Aramco is called Shamoon and spread through computers linked over a network to erase files on about 30,000 computers by overwriting them. Mr. Panetta, while not directly attributing the strike to Iran in his speech, called it "probably the most destructive attack that the private sector has seen to date."

Until the attack on Aramco, most of the cybersabotage coming out of Iran appeared to be what the industry calls "denial of service" attacks, relatively crude efforts to send a nearly endless stream of computer-generated requests aimed at overwhelming networks. But as one consultant to the United States government on the attacks put it several days ago: "What the Iranians want to do now is make it clear they can disrupt our economy, just as we are disrupting theirs. And they are quite serious about it."

The revelation that Iran may have been the source of the computer attacks was reported earlier by The Washington Post and The Associated Press.

The attacks on American financial institutions, which prevented some bank customers from gaining access to their accounts online but did not involve any theft of money, seemed to come from various spots around the world, and so their origins are not certain. There is some question about whether those attacks may have involved outside programming help, perhaps from Russia.

Mr. Panetta spoke only in broad terms, stating that Iran had "undertaken a concerted effort to use cyberspace to its advantage." Almost immediately, experts in cybersecurity rushed to fill in the blanks.

"His speech laid the dots alongside each other without connecting them," James A. Lewis, a senior fellow at the Center for Strategic and International Studies, wrote Friday in an essay for ForeignPolicy.com. "Iran has discovered a new way to harass much sooner than expected, and the United States is ill-prepared to deal with it."

Iran has a motive, to retaliate for both the American-led financial sanctions that have cut its oil exports nearly in half, and for the cybercampaign by the United States and Israel against Iran's nuclear enrichment complex at Natanz.

That campaign started in the Bush administration, when the United States and Israel first began experimenting with an entirely new generation of weapon: a cyberworm that could infiltrate another state's computers and then cause havoc on computer-controlled machinery. In this case, it resulted in the destruction of roughly a fifth of the nuclear centrifuges that Iran uses to enrich uranium, though the centrifuges were eventually replaced, and Iran's production capability has recovered.

Iran became aware of the attacks in the summer of 2010, when the computer worm escaped from the Natanz plant and was replicated across the globe. The computer industry soon named the escaped weapon Stuxnet.

Iran announced last year that it had begun its own military cyberunit, and Brig. Gen. Gholamreza Jalali, the head of Iran's Passive Defense Organization, said the Iranian military was prepared "to fight our enemies" in "cyberspace and Internet warfare." Little is known about how that group is organized, or where it has bought or developed its expertise.

The United States has never acknowledged its role in creating the Stuxnet virus, nor has it said anything about the huge covert program that created it, code-named Olympic Games, which was first revealed earlier this year by The New York Times. President Obama drastically expanded the program as a way to buy time for sanctions to affect Iran, and to stave off a military attack on the Iranian facilities by Israel, which he feared could quickly escalate into a broader war.

In advance of Mr. Panetta's speech in New York on Thursday, senior officials debated how much to talk about the United States's offensive capabilities, assessing whether such an acknowledgment could help create a deterrent for countries contemplating attacks on the country

But Mr. Panetta carefully avoided using the words "offense" or "offensive" in the context of American cyberwarfare, instead defining the Pentagon's capabilities as "action to defend the nation."

"We won't succeed in preventing a cyber attack through improved defenses alone," Mr. Panetta said. "If we detect an imminent threat of attack that will cause significant, physical destruction in the United States or kill American citizens, we need to have the option to take action against those who would attack us to defend this nation when directed by the president. For these kinds of scenarios, the department has developed that capability to conduct effective operations to counter threats to our national interests in cyberspace."

The comments indicated that the United States might redefine defense in cyberspace as requiring the capacity to reach forward over computer networks if an attack was detected or anticipated, and take pre-emptive action. These same offensive measures also could be used in a punishing retaliation for a first-strike cyberattack on an American target, senior officials said.

One senior intelligence official described a debate inside the Obama administration over the pros and cons of openly admitting that the United States has deployed a new cyber weapon, and could use it in response to an attack, or pre-emptively.

For now, officials have decided to hold back. "The countries who need to know we have it already know," the senior intelligence official said.

Nicole Perlroth contributed reporting from San Francisco.