Lawmakers tucked a pilot program into the Senate's fiscal 2027 Pentagon authorization plan that would let the military contract with private companies to conduct cyber operations. If enacted, it would be the first time Congress has clearly authorized the private sector to carry out offensive cyber missions. These tasks would fall under Cyber Command's authority, with Pentagon personnel overseeing the work. Under the plan, the Defense Department must furnish Congress with particulars about contracts and missions - covering target data - and deliver quarterly briefings to lawmakers.
The proposal tracks with the administration's National Cybersecurity Strategy from March, which promised to "unleash the private sector" and to "identify and disrupt adversary networks and scale our national capabilities." The Trump administration has already moved this year to broaden private-sector roles in hacking. Earlier this summer, a presidential memorandum established a program through which American companies can target and disrupt "foreign cyber-enabled transnational criminal organizations," with the Justice Department and the Department of Homeland Security providing the legal authority and oversight. That White House effort explicitly allows "cyber effects operations" that can disrupt or destroy targets, while the Senate plan limits contractors to "access generation" - gaining entry to systems the US military targets.
Supporters, including officials inside the Trump administration, see outside hackers as a way to make up for government cybersecurity gaps. Detractors warn that a profit-driven hacking market could invite retaliation, escalate conflicts, and slip past robust oversight, and they argue the priority should be fixing Cyber Command itself. The command is already in the middle of a major revamp known as "Cybercom 2.0," reflecting a shared view that the 16-year-old organization needs to adapt to AI, a stubborn talent crunch, and an ongoing war. How to pull off those fixes remains hotly debated.
Should the Senate provision become law, the pilot must kick off by March 1, 2027 and would sunset on Dec. 31, 2030. The Senate's National Defense Authorization Act still needs a vote and could change before then. It also has to be hashed out with the House - which left out a similar measure - before reaching the president's desk.
The backdrop: Cyber Command's workload has jumped over the past year as the US has been involved in multiple overseas conflicts, piling heavier demands on analysts and operators with repeated surges, longer hours, and mounting pressure. According to Bloomberg, command leaders are set to brief lawmakers on Thursday as part of a review into a rise in suicides within the unit. Cyber Command directed questions about the Senate proposal to the Pentagon, and Pentagon officials did not reply to a request for comment.
Rates, prices and policy all end up in your budget eventually. Get the free Market Briefs daily newsletter and see it coming.
If it advances, this pilot opens a new, time-boxed market for contractors focused on offensive access work, not disruption. It also builds in visibility: Congress would see contract-level details and get regular briefings, which can shape how these companies are scrutinized and valued. For investors, that mix of potential revenue and mandated transparency could influence how quickly any winners emerge - and how closely they are watched.
