In a first, US will allow some private firms to carry out cyberattacks

The United States is changing its cybersecurity policy to allow some private companies to conduct cyberattacks and offensive cyber operations. The order removes decades of restrictions that prohibited private firms from carrying out “hack back” attacks against suspected attackers.

The move directly affects cybersecurity companies and other private contractors that could be authorized to conduct offensive operations. It also changes the policy environment for customers seeking active responses to cyber incidents, rather than relying solely on defensive tools.

The second-order setup is two-sided. Expanded permission could create demand for specialized offensive capabilities, but attribution errors, collateral damage and escalation could produce legal or regulatory exposure for participating firms. With no company-specific enrichment or tickers supplied, the story supports a sector-level regulatory read rather than a single-name equity call.

The next signal is how the order is implemented, including which firms qualify, what oversight applies and how liability is assigned when operations cross jurisdictions. Until those details emerge, the opportunity is concrete at the policy level but not yet tied to a specific public-company earnings or valuation catalyst.