The Trump administration's national cyber strategy introduces a significant shift in the role of private sector entities in cybersecurity, tasking them with taking a more offensive stance against nation-state adversaries, ransomware groups, and cybercriminals. This bold plan raises crucial questions about the execution, liability, and oversight of such operations. By partnering with the federal government, private companies may engage in proactive measures to counter state-aligned threats, which have elevated the stakes from mere criminal activity to geopolitical implications. The strategy's success hinges on the ability of private entities to navigate complex issues of liability and oversight, particularly in cases where offensive operations may have unintended consequences. As state-aligned threat activity continues to escalate, the private sector's newfound role in cybersecurity has significant implications for the industry, so what matters most to practitioners is how effectively they can balance proactive defense with potential risks and liabilities1.