In a first, US will allow some private firms to carry out cyberattacks

The U.S. government has authorized vetted private companies to conduct offensive cyberattacks against international cybercriminals and foreign threat actors, marking a significant departure from decades of policy that restricted private sector to defensive operations only. This shift enables private firms to conduct surveillance and disruptive operations under federal oversight with $1 million escrow requirements, but introduces substantial legal, diplomatic, and operational risks including potential prosecution of American employees abroad and unresolved governance challenges. CIOs and technology leaders must prepare for a transformed cybersecurity landscape where private sector involvement in offensive operations could blur lines of liability, escalate geopolitical tensions, and create new compliance and talent management complications.