As digital threats evolve rapidly and demand for cyber capabilities continues to grow, the Pentagon is rethinking how it works with private companies. The emerging approach, known as Cyber Effects-as-a-Service (CEaaS), shifts the focus from buying particular tools and support services to contracting for defined outcomes under government direction and control.
The objective is operational: companies would no longer provide only technology or advice. They could take part directly in authorized cyber missions. The initiative could give the military faster access to private-sector expertise and infrastructure, but it also raises difficult questions about accountability, oversight and the risk of companies becoming targets for state adversaries.
From tool supplier to mission partner
Katie Sutton, the Pentagon’s assistant secretary for cyber policy, has said that the needs of military commanders and department leaders greatly exceed the government’s current supply of cyber capabilities. In her view, the relationship with industry must evolve beyond conventional contracts for equipment or personnel and make fuller use of companies’ technical expertise and capacity to innovate.
That shift would move industry from a traditional contractual role toward a more direct operational partnership. The Pentagon would set the mission’s objectives and limits, while companies would contribute the personnel, methods, tools and infrastructure needed to deliver the requested effect.
US officials have framed the approach as a way to respond more quickly to threats operating at the speed of technology. Instead of purchasing a capability that military operators must later integrate, the government could contract directly for a defined result — such as gaining access to a particular network, within limits approved by the authorities.
Why the shift is gaining momentum
The pressure is coming from both government and industry. Some cyber-focused start-ups are already building their business models around operational services, while established firms and major defense contractors are seeking to secure a leading role in the emerging market.
The Pentagon appears particularly interested in smaller companies backed by private investors and venture capital. These firms may develop new technologies and approaches without the cost structures of major corporations. Their potential agility and lower costs, however, do not resolve questions about reliability, security or oversight.
Investor interest in companies focused on cyber effects has grown in recent years. At the same time, the Defense Department has begun engaging companies in artificial intelligence and defense technology to identify where the model might be applied.
A trial exercise, not a fully defined framework
In late September, Sutton’s office held a tabletop exercise involving industry representatives and US Cyber Command. Participants explored how new operational models could deliver cyber effects at the speed, scale and complexity demanded by today’s security environment.
The exercise was intended to move the discussion from broad principles toward practical implementation. The Pentagon plans to use its findings to refine the CEaaS framework and identify near-term opportunities. But key details — from the missions companies might perform to the authorization and oversight procedures involved — are still being developed.
A break with traditional procurement
Under the conventional model, the government defines a requirement, and companies compete to provide the requested tools, personnel or expertise. Contractors may help plan missions and work alongside military operators, but the government generally retains primary responsibility for conducting operations.
CEaaS would emphasize the desired effect rather than the product or tool being purchased. A company might be tasked with gaining access to a target network or creating a disruption, using its own resources or working alongside military personnel. Under the framework described by the Pentagon, the government would retain control of objectives, authorizations and functions that cannot be transferred to the private sector.
That distinction is central: contractors would not be free to select targets or conduct operations without approval. They would act within a government-defined mission and under government oversight.
Faster access to innovation — and new risks
Supporters argue that commercial tools are often available sooner than solutions developed through lengthy government processes. In a field where vulnerabilities and attack methods change constantly, quickly deploying existing technologies could give military commanders more options.
But contracting for an outcome does not mean that outcome can be guaranteed. Cyber operations depend on variables that are difficult to predict, including network architecture, an adversary’s response, defensive measures and changes during a mission. A company can commit resources and expertise, but operational success is not always controllable in the same way as the delivery of equipment.
Another unresolved question is what kinds of missions companies might be asked to undertake: operations against criminal groups and other non-state actors, or higher-risk actions targeting nation-states.
Contractors could become targets
One of the most serious concerns is the exposure of companies and their employees. If a firm conducts operations beyond its own networks and infrastructure, adversaries could regard it as part of the conflict and target it. Employees might also face civil or criminal liability in foreign jurisdictions, without the legal protections that may be available to government personnel.
The danger is not limited to legal exposure. A company identified as taking part in cyber operations could face retaliatory attacks, espionage or sabotage. Such threats might affect not only the contractor but also its clients, employees and commercial infrastructure.
Overly specific requests could expose capability gaps
The way the Pentagon writes its contracts may matter as much as the operations themselves. If a request describes the desired effect too precisely, it could reveal to adversaries which capabilities the government lacks or which objectives it cannot achieve on its own.
A narrowly worded requirement could effectively signal gaps in the military’s operational capacity. The Pentagon will therefore need to strike a balance: provide enough detail for companies to understand the mission without disclosing sensitive information.
Oversight is the decisive test
Beyond technical challenges, experts warn that the program could expand without strong governance rules. Growing dependence on contractors might gradually increase their role in sensitive operations, including actions against nuclear-armed rivals.
The opposite risk also exists. If early efforts fail, officials could respond by loosening restrictions and accepting greater risks. In either scenario, weak oversight could turn a program intended to supplement government capacity into a difficult-to-control mechanism.
The Pentagon has already explored a broader private-sector role in cyberspace. In August, the US administration issued an executive order outlining a framework for private companies to conduct operations against transnational criminal organizations under the coordination of the Justice and Homeland Security departments. Separately, a provision in the Senate-passed annual defense policy bill would authorize a pilot program allowing contractors to conduct access operations using their own infrastructure.
Inevitable evolution — or a line that should not be crossed?
For supporters, deeper private-sector involvement is a practical response to a capacity shortfall and to the fact that many relevant technologies are developed outside government. Industry builds much of the infrastructure and many of the tools that shape cyberspace, and officials want to draw on that expertise more directly.
But turning contractors into operational participants changes the nature of the relationship. The issue is no longer only procurement and technical support; it is also who bears responsibility for actions with potentially serious strategic and legal consequences.
CEaaS could give the Pentagon faster access to capabilities it needs. Its success, however, will depend not only on technology and speed, but also on clear rules: who authorizes missions, who is accountable for their effects, and how to prevent the private sector’s role in cyberwarfare from expanding without adequate control.
