White House to let private firms run offensive cyber ops: your vendor's risk is now yours

The White House will allow private companies to carry out offensive cyber operations, according to risky.biz's Risky Bulletin ^[1]. For anyone who buys security services, shares infrastructure with peers, or writes cyber insurance, that single line changes a background assumption that has held for two decades: that the entities firing shots from US soil were governments, and that a private company found doing it was a scandal rather than a policy.

The bulletin is a summary, and it is worth being precise about how little is public ^[5]. It does not describe the legal instrument, the scope of authorized targets, the approval process, or which companies qualify ^[1]. Every operational question an operator would actually need answered is therefore open. But the direction of travel is enough to start rewriting assumptions.

Three of those assumptions are load-bearing. Liability: contracts with security vendors were written for defensive work, and indemnity language that contemplates a failed detection does not contemplate a vendor conducting an operation against a third party from infrastructure adjacent to yours. Attribution: defenders currently treat US-origin offensive traffic as either criminal or misattributed, and a legitimate private category collapses that heuristic. Insurance: war and hostile-act exclusions, already the most litigated clauses in cyber policies, were drafted around state actors, and a private authorized operator sits in a category the wording did not anticipate. None of that is settled by the reported decision; all of it becomes a question a counterparty can now reasonably ask.

The same bulletin carries three other items that show the environment this lands in. An AI hacking campaign breached Taiwan's government ^[2]. A macOS bug was exploited over the internet to drop cryptominers ^[3]. Kenya has ordered internet cafes to store logs ^[4]. Four items, one edition ^[6]. The Taiwan case matters because AI-assisted intrusion at government scale raises the volume of plausible attacker activity, which is exactly the noise floor against which a defender would have to distinguish an authorized private operation from a hostile one ^[2]. The macOS item is the mundane counterpoint: an internet-exposed bug turned into cryptomining, which is what happens to unpatched fleets regardless of policy ^[3]. The Kenya order is a reminder that log retention mandates are spreading to categories of operator who have never had to answer a subpoena ^[4].

What to watch: the actual authorizing document and whether it names eligibility criteria or a review body ^[1]; whether any named vendor publicly claims the mandate; the first insurer to amend hostile-act wording in response; and technical detail on the Taiwan intrusion, specifically what the AI component did that a human operator would not have ^[2]. Until the instrument is published, the correct posture is contractual, not technical: ask your security vendors, in writing, whether they intend to take this up.