Pentagon Wants Private Companies To Help It Scale Up Its Hacking Operations

Recent drafts of the Defense Department’s forthcoming cyber strategy would encourage the Pentagon to enlist private contractors to support the military's offensive hacking efforts, according to three people with knowledge of the strategy.

The policy is part of a broader push in the new hacking blueprint to ramp up the military’s offensive cyber operations, said two of the people, who added the strategy could come as soon as next week. If formalized, it would signify a significant shift from prior Pentagon cyber policies, which have largely emphasized tighter information sharing when working with the private sector and have not as explicitly endorsed the use of offensive cyber operations.

The pivot comes as fast-advancing artificial intelligence models built by private companies are proving more adept than expert hackers at finding and weaponizing flaws in digital infrastructure, raising concerns that foreign adversaries could use the technology to launch devastating cyberattacks against U.S. infrastructure.

Two of the people said the overall goal of the soon-to-be-released cyber strategy was to draw on the private sector’s innovation, capabilities and resources to boost U.S. military hacking efforts. Defense tech startups and leading Silicon Valley firms now regularly build cutting-edge digital tools of interest to the military — unlike in decades past, when the Pentagon drove defense innovation.

“The goal is to build an ecosystem where we can give contractors these missions, and they can scale the operations of the U.S. government,” said the first person, who, like the others, was granted anonymity because they were not authorized to discuss details of the strategy.

The strategy would formally align the Pentagon with the Trump administration’s shift toward prioritizing digital offense, which began in the spring and is already underway elsewhere in the government.

The White House made cyber offense a top priority in its national cyber strategy released this March and pledged to create “new incentives” for security and tech firms to help it identify and disrupt foreign hackers. And last month, President Donald Trump issued a memo paving the way for vetted tech companies to conduct state-approved cyberattacks on cybercriminals for the first time.

White House spokesperson Anna Kelly referred POLITICO to the Pentagon. The Pentagon declined to comment.

The Pentagon’s assistant secretary of defense for cyber policy, Katie Sutton, first announced at a congressional hearing in April that the Pentagon was working on an updated cyber strategy. The last DOD cyber strategy was released under the Biden administration in 2023. Sutton said weeks later at an industry event that the strategy would be released this summer and would outline steps to impose “sharper consequences” on foreign hackers who target U.S. networks.

The previous strategy, first obtained by POLITICO in 2023, began expanding work with the private sector to address threats to critical systems, but stopped short of calling on companies to provide hacking tools or directly partake in efforts to disrupt foreign networks. It also laid out steps to enhance cyber defense efforts with international allies.

NextGov first reported on the strategy’s possible release date.

Those who spoke with POLITICO said the coordination and oversight between private firms and the Pentagon would be extensive.

“The private sector can’t just go off and hit buttons by itself,” said a second person familiar.

Two of the people familiar with the strategy said the Defense Department’s approach to working with the private sector would likely be even more tightly controlled than the presidential memorandum released last month.

The White House program will provide a legal pathway for private companies to hack cybercriminal gangs, which would be overseen by the Homeland Security and Justice departments. Any participating companies would have to undergo extensive federal vetting, and the departments would have to approve any hacking operations.

The companies would also be required to submit a $1 million bond, which they would forfeit if they fall out of compliance with the program.

Whereas tech companies can propose operations against cybercriminals to DHS and DOJ, the Pentagon would likely initiate any request for assistance under the new strategy, the two people said.

In recent months, some private companies and defense tech startups have raised hundreds of millions of dollars on a promise to sell offensive hacking tools to the government. Leading AI makers such as Anthropic have also publicly signaled they are generally willing to let the Pentagon use its most powerful models in offensive cyber operations.

Spokespeople for Anthropic did not immediately respond to a request for comment on whether they are providing any offensive hacking support to the federal government.

The U.S. intelligence and national security community already relies extensively on cyber contractors and private companies for a range of operational and administrative support. But the work largely goes unacknowledged in public, making new entrants to the market skittish about teaming up with the Pentagon, the third person said.

“It’s a bit of an uncomfortable space for companies to enter at the moment because of the lack of precedent,” said the third person.

Proposed language in the Senate’s version of the annual defense policy bill would authorize a pilot program where the Secretary of Defense could pay a private company to hack into and maintain access to certain networks “under the operational authority of the commander of U.S. Cyber Command.”

Sutton, who is leading the strategy effort, was previously a staffer on the Senate Armed Services Committee, where that language originated.

The strategy redux comes amid a broader effort by the Pentagon to ramp up the military’s hacking capabilities.

Last year, the Pentagon announced it was rolling out a new force-generation model for U.S. Cyber Command, known as Cyber Command 2.0, amid concerns about its ability to train and retain top cyber warriors.

U.S. military and intelligence agencies once rarely acknowledged they even sought to break into foreign networks, though recent administrations have been more open about offensive hacking campaigns — a trend that has accelerated since Trump’s return to office.