The Senate Armed Services Committee just greenlit something that would have been unthinkable five years ago: formally authorizing private contractors to generate and maintain access to foreign computer networks on behalf of the US military. Tucked inside the Fiscal Year 2027 National Defense Authorization Act, the provision would create a pilot program letting civilian firms hold digital ground inside adversary networks under the operational authority of Cyber Command [[1]]. The code doesn't lie, but the narrative does. On the surface, this reads like capacity-building. Read the mechanics, and it's something else entirely.
The provision, advanced on June 23, 2026 during the SASC markup, is deliberately narrow. Operations are restricted exclusively to access-related activities. No disruptive effects. No data destruction. No infrastructure sabotage. Contractors would run their own infrastructure, generate footholds in foreign networks, and maintain persistent access under Pentagon supervision [[21]]. That's the stated scope. The unstated scope is the interesting part.
Think about what "maintaining access" actually means in operational terms. Establishing a foothold in a hostile network can take months or even years of patient, methodical work. The labor is grinding, continuous, and requires constant attention as targets patch and re-patch their systems [[45]]. This is the single most manpower-intensive task in cyber operations. By contracting out the persistence work, US Cyber Command frees its uniformed operators to focus on effects and, as two former military cyber commanders told Breaking Defense, the "mastery" of cyber war [[45]]. This is infrastructure outsourcing in its purest form.
The capacity gap is real. The solution is a structural bet.
The Department of Defense and the intelligence community have relied on contractors for years across operational and administrative cyber support. But that work largely went unacknowledged in public, making new entrants to the market skittish about teaming up with the Pentagon [[6]]. The NDAA provision changes the calculus. It formalizes what has been quiet, informal, and legally gray. It builds a market where defense contractors, Silicon Valley startups, and established security firms can bid for persistent-access missions as a service.
The timing matters. Recent drafts of the Pentagon's forthcoming cyber strategy explicitly encourage enlisting private contractors to support offensive hacking efforts, drawing on what two officials describe as "the private sector's innovation, capabilities and resources" [[25]]. The White House already signed a March memorandum directing the establishment of a framework for vetted companies to support government-led operations against foreign cybercriminal organizations [[46]]. The Senate provision extends that logic from transnational crime to nation-state infrastructure.
I debugged bots; now I debug bias. Let me be specific about what this actually signals.
This is the commodification of cyber persistence. The pilot program effectively turns one of the most expensive and scarce capabilities in offensive cyber operations into a procurable service. That has implications for how we should think about the entire digital conflict ecosystem.
First, attribution ambiguity becomes institutionalized. When a government conducts a cyber operation, the cost of attribution is borne by whoever is doing the forensics. When private contractors operate under government cover, the attribution surface expands dramatically. A contractor's infrastructure, its supply chain, its third-party dependencies all become potential flashpoints for misidentification and retaliation. Lawfare analysts have already flagged the legal uncertainty: no court has addressed whether current federal computer hacking statutes protect private companies conducting operations on behalf of the government [[49]]. The legal precedents simply don't exist yet.
Second, the liability structure is inverted. Defense contractors have historically been targets, not operators. Lockheed Martin lost F-35 specifications to Chinese intrusions. Andrei's earlier analysis aside, the risk profile shifts fundamentally when a contractor moves from being a victim of cyber operations to being an executor of them. Conducting operations from your own infrastructure transforms you into a legitimate military target [[23]]. The pilot program, by using contractor-owned, contractor-operated means, makes that transformation explicit.
Third, and this is where the market angle comes in: the threat of retaliation against civilian infrastructure is a repricing event for the entire cybersecurity industry. Vanessa Le, a partner at Latham & Watkins, raised the question publicly traded cybersecurity companies will face: how do you disclose offensive operations in your SEC filings without exposing your clients and your business to retaliation [[43]]? That's not a theoretical concern. That's an earnings risk.
Now the contrarian angle. Most coverage frames this as a slippery slope toward privatized warfare. The smarter read is that this is a capacity arbitrage play in a uniquely constrained market.
US Cyber Command has roughly 1,000 full-time military and civilian staff according to older CRS figures, a number that has not scaled proportionally with the volume of targets the government wants to hold at risk [[24]]. The demand for persistent access across foreign networks outpaces the uniformed supply. Contractors are the standard mechanism for closing that gap. This is not fundamentally different from outsourcing intelligence, surveillance, and reconnaissance flights to private firms. The domain changed, not the logic.
The real risk isn't the outsourcing itself. It's the deconfliction problem. Andrew Schoka, a former Army officer at Cyber Command, put it plainly: coordinating cyber operations across federal agencies is already a major challenge, and now you're adding private sector firms with "a lot more capability and speed" into the mix [[50]]. Too many cooks with root access. That's the actual vulnerability.
Let me also flag what nobody in the national security press is talking about: the cryptocurrency dimension. The DOD Cyber Crime Center's leadership has been explicit that AI and cryptocurrency are lowering the bar for nefarious actors to threaten national security and circumvent traditional financial tracking systems [[52]]. If private contractors are now operating offensive cyber campaigns, the intersection with crypto-enabled ransomware infrastructure becomes a direct government procurement concern. You're not just buying penetration capability anymore. You're buying operational access to networks where the financial layer runs on pseudonymous rails.
Gold rushes leave ghosts in the ledger. This provision is a gold rush for a specific segment: defense tech startups and established security firms that can demonstrate the operational maturity to handle persistent-access missions. The winners will be the ones with existing government clearance infrastructure, mature compliance processes, and the balance sheet to absorb the legal risk of being designated a military target. The losers will be the enthusiasm-heavy firms that mistake a pilot program for a blank check.
What should we watch? Three signals matter going forward. First, the full Senate vote and subsequent House reconciliation on the FY2027 NDAA. The provision could be narrowed, broadened, or stripped entirely. Second, contractor award announcements. Specific companies winning pilot contracts will tell us more about the program's actual intent than any legislative language. Third, international reaction. A growing body of international norms aims to protect civilian infrastructure from cyber operations and maintain clear distinctions between governmental and private cyber activities [[1]]. When the first foreign government files a formal protest over a US contractor's operations, we'll know the program is live. Until then, it's an infrastructure play with an attribution question mark.
Liquidity is just trust with a timeout. In cyber operations, trust has a very short timeout indeed. The contractors who understand that will build durable franchises. The ones who don't will become cautionary tales in next year's congressional testimony.
Efficiency is the only honest emotion. The market for offensive cyber capability just got a formal pricing mechanism. Trade accordingly.