For decades, American companies facing cyberattacks have largely been expected to defend themselves.
They could strengthen firewalls, trace malicious activity, preserve evidence and work with law enforcement. What they generally could not do was launch their own cyberattack against the criminals targeting them.
The Trump administration is now changing that equation.
President Donald Trump signed a National Security Presidential Memorandum on August 12, 2026, creating a framework under which vetted US companies can participate in offensive cyber operations against foreign transnational criminal organizations. Those operations could include surveillance as well as disrupting, manipulating or destroying criminal computer infrastructure.
The companies will not simply receive permission to roam the internet attacking suspected hackers. Operations are supposed to remain under US government direction and control.
Even with those restrictions, the policy represents a remarkable shift.
Corporate America is moving from being one of cybercrime’s biggest targets toward potentially becoming part of America’s offensive cyber arsenal.
Why Is Trump Bringing Private Companies Into the Fight?
Cybercrime has become an industrial-scale business.
Ransomware groups can paralyze hospitals, manufacturers and local governments. Fraud networks steal identities and savings. Criminal organizations operate phishing campaigns across national borders, while some cyber groups work from countries where American law enforcement has limited ability to reach them.
Trump’s administration argues that traditional defensive cybersecurity is no longer sufficient.
Its March 2026 cyber strategy explicitly promised to confront malicious actors before they penetrate American networks and called for incentives allowing private companies to help identify and disrupt adversary infrastructure.
The administration had already laid the groundwork through a March executive order targeting cybercrime, fraud and predatory schemes. That order called for an operational cell within the National Coordination Center and specifically instructed federal authorities to draw on technical capabilities and intelligence from commercial cybersecurity firms.
The August memorandum takes that philosophy considerably further.
Rather than merely sharing information with government agencies, participating companies could become directly involved in operations.
This Is More Than Ordinary Cybersecurity
Most companies already perform defensive cybersecurity.
They scan networks.
They block malicious IP addresses.
They investigate compromised systems.
They remove malware.
They share threat intelligence.
The new policy opens the door to actions on infrastructure outside their own networks.
According to reporting on the memorandum, authorized operations could involve cyber surveillance and more aggressive “cyber effects” intended to manipulate, disrupt or destroy information systems used by criminal organizations.
That distinction is enormous.
Imagine a ransomware group compromises an American company.
A defensive cybersecurity team attempts to stop the malware and restore the victim’s systems.
An offensive operation could instead target servers used by the ransomware organization, interfere with its infrastructure or destroy data necessary for its operations.
The strategy is no longer simply to build a stronger castle.
It is to attack the people repeatedly trying to break through the walls.
Companies Will Not Receive an Unlimited “Hack Back” License
This is where some of the more dramatic interpretations need qualification.
The policy does not appear to authorize every American company to retaliate independently whenever it believes someone attacked it.
Participating firms must be vetted.
Operations must take place under federal direction, authority and oversight. The program will be overseen through the Department of Homeland Security and its National Coordination Center.
Companies participating in the program will also be required to maintain at least a $1 million bond or escrow, providing a financial safeguard against misconduct.
Those controls are important because attribution in cyberspace can be extraordinarily difficult.
A server apparently controlled by a ransomware organization could actually belong to an innocent company whose system has been compromised.
Infrastructure may exist in another country.
A criminal group may operate alongside or with assistance from a foreign government.
An incorrectly targeted offensive operation could therefore create consequences far beyond the intended criminal network.
Why Was “Hack Back” Traditionally Considered So Dangerous?
The attraction of retaliation is obvious.
If criminals know victims can destroy their infrastructure, attacking American companies becomes more expensive.
But cybersecurity professionals have debated private-sector retaliation for years because the risks are equally obvious.
The first problem is attribution.
Attackers deliberately hide their identities.
They route traffic through compromised computers.
They rent infrastructure.
They use botnets consisting of devices belonging to innocent people.
They plant misleading evidence.
A company retaliating against the apparent source of an attack could therefore hit the wrong target.
The second problem is escalation.
If an American cybersecurity company disables infrastructure inside another country, that government may view the operation differently from Washington.
Things become even more complicated when cybercriminals have connections to intelligence agencies or state-backed hacking groups.
An operation intended to punish criminals could accidentally become an international incident.
Federal Law Has Traditionally Restricted Private Cyberattacks
There is also a legal reason companies have been cautious.
The US Computer Fraud and Abuse Act broadly prohibits unauthorized access to computer systems.
Historically, that meant being attacked did not automatically give a company legal authority to penetrate someone else’s computer in retaliation.
The new framework marks a substantial departure from that longstanding position by creating government-controlled circumstances under which approved private companies can participate in offensive activity.
That federal oversight could solve part of the legal problem.
It does not eliminate every legal question.
Cyber operations frequently cross international borders, meaning American authorization does not automatically determine how another country views an intrusion into infrastructure located on its territory.
The program’s success may therefore depend as much on diplomacy and operational discipline as technical capability.
Cybersecurity Companies Could Make Serious Money From the Shift
There is an obvious commercial dimension.
The United States has an enormous private cybersecurity industry.
Companies already employ researchers who track ransomware gangs, discover vulnerabilities, reverse-engineer malware and monitor criminal infrastructure.
Some possess technical knowledge that rivals or exceeds what individual government agencies can maintain internally.
Trump’s policy effectively creates a potential new market for that expertise.
Instead of selling primarily defensive products and threat intelligence, qualified cybersecurity firms could receive government work connected with active disruption operations.
The Financial Times describes the policy as a potential windfall for US technology companies.
That could stimulate investment in offensive cyber capabilities.
It could also create uncomfortable incentives.
If private companies make money from cyber operations, policymakers will need strong safeguards to ensure commercial interests do not begin influencing decisions about which threats deserve offensive action.
Big Tech Already Has Extraordinary Visibility Into Cyber Threats
The government has another reason to want corporate participation: private technology companies can see parts of the internet that government agencies cannot easily see themselves.
Cloud providers operate enormous computing networks.
Cybersecurity companies inspect huge volumes of malicious traffic.
Software companies receive vulnerability reports.
Email providers detect phishing campaigns.
Technology platforms can observe infrastructure and accounts used by criminals across many countries.
Companies such as Google and Microsoft already publish extensive research on state-backed and criminal cyber operations.
The Trump administration’s strategy essentially asks whether some of that private-sector visibility and expertise can be transformed into operational power.
According to the Financial Times, major technology groups have shown varying levels of interest, although companies also remain concerned about legal exposure and the possibility of retaliation.
Those concerns are not theoretical.
A company participating in an offensive operation could itself become a high-profile target.
Ransomware Is an Obvious Target
Ransomware organizations are likely to be among the most attractive candidates for the program.
Their business model depends on infrastructure.
They need servers.
They need communication systems.
They need mechanisms for distributing malware.
They often need websites for publishing stolen data.
They need financial infrastructure for receiving and laundering payments.
Law-enforcement agencies have already demonstrated that disrupting these components can damage ransomware operations.
But criminal groups frequently rebuild.
That creates an exhausting cycle in which authorities dismantle infrastructure only to see replacement systems emerge elsewhere.
Private cybersecurity firms could potentially give the government more capacity to maintain pressure continuously rather than relying primarily on occasional international law-enforcement operations.
The administration’s March executive order specifically identified ransomware, malware, phishing and financial fraud among the cyber-enabled threats it wanted to confront more aggressively.
AI Could Make Offensive Cyber Operations Much Faster
Artificial intelligence adds another dimension.
Cybersecurity increasingly involves enormous volumes of information.
An analyst may need to examine malware, server configurations, network traffic and thousands of indicators connecting different pieces of criminal infrastructure.
AI can accelerate parts of that process.
Models can help identify patterns, analyze code and prioritize vulnerabilities.
The administration’s broader cyber strategy specifically emphasizes combining government capabilities with private-sector innovation and emerging technologies.
That could eventually make cyber operations much more scalable.
A relatively small team equipped with powerful automated systems might identify and disrupt infrastructure at speeds that would previously require substantially more personnel.
The danger is equally obvious.
Automation increases the cost of mistakes.
A human analyst misunderstanding one server is a problem.
An automated system incorrectly targeting hundreds of systems is potentially an international crisis.
This Strategy Comes as Washington Rethinks Its Cyber Institutions
The private-sector push is also occurring amid debate over the federal government’s own cybersecurity capacity.
The Cybersecurity and Infrastructure Security Agency has faced staffing and budget pressures even as cyber threats against critical infrastructure have intensified. Recent attacks on American water infrastructure have prompted bipartisan concern in Congress about whether CISA has enough resources to perform its mission.
The administration has simultaneously been experimenting with new public-private models.
In July, the White House launched the Gold Eagle Initiative, bringing government agencies, open-source software organizations and critical-infrastructure companies together to identify and patch vulnerabilities more rapidly.
The offensive cyber program therefore does not appear in isolation.
It fits a broader philosophy.
Washington increasingly wants private companies integrated directly into national cybersecurity rather than treated merely as customers receiving government warnings.
The Policy Resembles Digital-Age Privateering
The historical analogy is difficult to miss.
Centuries ago, governments sometimes authorized privately owned ships to attack enemy vessels through legal instruments known as letters of marque.
The private ship remained privately operated but acted with government authorization.
Some supporters of aggressive private-sector cyber operations have revived that analogy.
The Financial Times notes that figures aligned with the MAGA movement have previously supported modern versions of letters of marque and reprisal as a tool against foreign threats.
Calling today’s cybersecurity companies “digital privateers” is imperfect because the new operations remain more directly controlled by the federal government.
Still, the comparison captures what makes the policy unusual.
The government possesses authority.
Private industry possesses enormous technical capability.
Trump wants to combine them.
The Biggest Question Is What Happens When Criminals Fight Back
Offensive cybersecurity changes the incentives for both sides.
If a ransomware gang believes attacking an American company could result in its own infrastructure being destroyed, deterrence might improve.
But criminals can retaliate too.
They could target participating cybersecurity firms.
They could attack executives.
They could expose stolen information.
They could deliberately route infrastructure through sensitive systems to make American retaliation more dangerous.
State-backed groups could create even greater problems.
A cyber operation against infrastructure associated with a criminal organization may look very different if that infrastructure is also connected with a foreign intelligence service.
That is why critics worry about escalation.
Cyberspace has few clearly visible borders.
A destructive action can cross them in milliseconds.
America Is Moving From Cyber Defense Toward Cyber Deterrence
The most important change is philosophical.
Traditional cybersecurity asks:
How can an organization prevent an attacker from getting inside?
The new approach adds another question:
How can America make attackers regret trying?
Trump’s March cyber strategy explicitly argued that the United States should “detect, confront, and defeat” adversaries before they breach American systems and should increase the costs imposed on malicious actors.
The August memorandum begins turning that principle into an operational program involving private companies.
If it works, ransomware groups and fraud networks could face a much larger pool of American technical talent actively attempting to dismantle their operations.
If it goes wrong, private companies could become involved in international cyber conflicts with legal, diplomatic and security consequences that are difficult to predict.
That is why this is much bigger than another government cybersecurity initiative.
For years, corporate America was told to defend itself, report attacks and wait for law enforcement to pursue the criminals.
Under Trump’s new strategy, selected companies may finally be allowed to cross the digital battlefield.
The United States is no longer asking only how to build better defenses.
It is asking whether the best defense against cybercrime might sometimes be an authorized attack of its own.
