The Line Between Defense and Offense Just Moved. Here’s What Comes Next.

For four decades, U.S. law drew a hard line around private-sector cybersecurity. Companies could detect, respond to, and report attacks. They could not fight back. On Wednesday, August 12, 2026, that line moved. President Trump signed a National Security Presidential Memorandum (NSPM) directing the Department of Justice (DOJ) and the Department of Homeland Security (DHS) to build a program letting vetted private companies conduct offensive cyber operations against foreign criminal groups. The policy question getting the most attention is whether private companies should be allowed to hack back. This idea has many issues and challenges associated with it. One of the more consequential questions is whether the program can solve the problem that has limited cyber disruption efforts for years, which is knowing, with confidence, who is actually on the other end of an attack. Attribution, Not Authorization, Is the Real Bottleneck It is one thing to authorize a new class of operator, and it is quite another to build the intelligence and validation infrastructure to do it safely and effectively. Determining who is truly behind a cyber campaign is often complicated, particularly when criminal organizations, affiliates, and state-linked actors operate within overlapping ecosystems. Threat actors frequently use intermediary infrastructure, compromised systems, criminal affiliates, false flags, and shared tools to hide their identities, and in some cases cybercriminal groups and nation-state actors lean on those same techniques within those same overlapping ecosystems. That ambiguity is exactly why a hack-back program is harder to operationalize than it is to announce. A misattributed target wastes effort, potentially escalating a conflict with the wrong party, damaging an innocent network caught in shared infrastructure, or drawing a response to what was actually a criminal operation rather than a state actor. Any framework built on private-sector participation needs rigorous, ongoing processes for validating targets, avoiding conflicts between operations, and minimizing the risk of unintended consequences. That work has to be continuous, as a one-time vetting of which companies get to participate won’t be enough to sustain trust over years and years of shifts in the threat landscape. A Policy Shift Built for a Scale Problem The NSPM builds on a March 2026 executive order and arrives after years of growing frustration with the limits of purely defensive strategy. Ransomware crews, fraud operations, and cyber-enabled scams have scaled well past what government agencies alone can disrupt, and policymakers on both sides of the aisle have pushed for new tools. The announcement reflects the growing scale and sophistication of global cybercrime and the need for continued collaboration between government and the private sector. Cybercriminal organizations have become increasingly capable and resilient, and disrupting their operations often requires coordinated action across industry and government. Matching Scale With Scale If offensive capabilities continue to scale through automation and commercially available technology, defense will need to scale in much the same way. That shift is already underway across the cybersecurity industry, as organizations increasingly use artificial intelligence (AI) and automation to handle the volume and speed of modern threats. Rather than relying solely on human analysts to review alerts and investigate incidents, security teams are using AI to correlate signals, automate routine workflows, and accelerate response times. We built our Aurora® Superintelligence Platform on that premise, running hundreds of AI agents across a 24×7 security operations model that serves 10,000+ customers worldwide. The results show up in the numbers. Organizations running on our Aurora Agentic SOC see 15x faster case resolution and 3x ticket quality compared with traditional approaches, and our SOC can go live in as few as 10 days. Our platform resolves 22,000+ investigations every week without human intervention, freeing security teams to focus on the judgment calls that still require a person. That is the real answer to a scaled threat landscape, regardless of what shape any new offensive program eventually takes. Closing the gap between detection and response through AI-driven security operations does more for mid-size organizations than any hack-back authority ever will, because it protects them today rather than waiting on a framework that’s still being built. What About the Mid-Size Organizations That Will Not Be Part of the Hack-Back Program? A vetted hack-back program, however it is structured, will involve a small number of companies operating under close federal supervision. Most organizations, including the mid-size businesses that make up a large share of the U.S. economy, will never touch it directly, and they face the same threats as larger enterprises with fewer resources to fight them. Ransomware crews and phishing operations do not scale back their targeting because a headline-grabbing new program exists. They look for weak detection, slow response, and coverage gaps, and those gaps concentrate in organizations too small to run a full-time SOC but too big to stay off the radar of criminal groups running automated campaigns. Regardless of how cyber disruption efforts evolve, organizations still need strong cyber resilience, effective security operations, rapid detection and response capabilities, and trusted security guidance. For most organizations, the fundamentals of cybersecurity remain unchanged. Reduce risk. Harden defenses. Improve visibility. Respond quickly when threats emerge. This blog is provided for informational purposes only. It reflects general industry perspectives and practices and is not intended to represent a guarantee, assurance, or measure of performance. Actual results, outcomes, and capabilities vary by organization, environment, and implementation. This blog reflects the author’s views as of the publication date and contains forward-looking statements and opinions about technology trends. Actual outcomes may differ based on attacker behavior, customer environments, and broader market and regulatory developments.