For the first time, the US will let private firms carry out cyberattacks: the rules of cyberwar are being rewritten

The US has taken an unprecedented decision: certain private companies will for the first time be officially allowed to conduct offensive cyber operations — previously an exclusive prerogative of the state. Licensing details are still being worked out, but the shift itself is historic: cyberattack stops being a state monopoly and becomes a service.

For the global landscape this means escalation. More actors with offensive mandates means more operations, more tools on the market, more accidental victims: cyber weapons tend to leak and get reused. The precedent will likely push other countries to legalize their own "privateers" — the race will spiral, and its waves will reach everyone connected to the internet, regardless of geography.

Business in Kazakhstan should draw a sober conclusion from this news: the background level of cyber threats will only thicken in the coming years, and hiding behind "we're small, who needs us" will no longer work — automated attacks don't pick victims by size. The practice is boring and reliable: backups that are actually tested by restoring them; two-factor authentication; updates; trained staff. Cybersecurity has finally moved from the category of IT projects to that of permanent hygiene — like fire safety, only with more frequent drills.