Washington may soon outsource part of its cyberwarfare operations to private companies, according to a new report from Bloomberg. 

Language tucked into the Senate’s 2027 defense bill would create a pilot program allowing the Pentagon to hire outside cybersecurity firms to penetrate computer networks chosen by the US military. Contractors would operate under US Cyber Command and Pentagon supervision.

Bloomberg writes that the authority would initially be relatively narrow. Private operators could establish access to targeted networks, but the Senate language stops short of authorizing them to damage, disable or destroy those systems.

Still, it would represent a significant expansion of private industry’s role in US offensive cyber operations. The administration has already moved in this direction, launching a separate initiative that permits American companies to pursue certain foreign cybercriminal groups under federal oversight.

Advocates say outsourcing some of the work could provide badly needed manpower and expertise as Cyber Command faces growing demands and staffing pressures. Opponents argue that introducing profit-driven companies into cyberwarfare could create new problems, including retaliation, accidental escalation and murky accountability.

If enacted, the experiment would start in 2027 and continue through 2030, with the Pentagon required to regularly disclose information about contractors, missions and targets to Congress.

For now, however, it remains only a Senate proposal. The House defense bill contains no equivalent measure, meaning the provision could still be changed or removed before reaching the president.