The United States is changing the rules of the game in combating cybercrime.

Operativ Media reports that Tural Mammadov, Deputy Head of the Main Department of the State Service of Special Communication and Information Security, stated this on his social media account.

According to him, private sector activity is no longer limited to cyber defense alone, as involving companies in cyber intelligence and active disruption operations is now coming onto the agenda.

Mammadov noted that a new presidential memorandum marks a major shift in the US approach to cross-border cybercrime. Selected private cybersecurity companies under federal supervision could be engaged in cyber surveillance and active disruption operations against foreign cybercriminal groups.

According to him, this approach goes far beyond the traditional "defend, block, restore" model.

"It is no longer just about detecting an attack, but about tracking the attacker's infrastructure, disrupting their operations, weakening their resources, and degrading their operational capabilities," Mammadov said.

He emphasized that one of the most critical aspects of this development is that the boundary between the state and the private sector in cyberspace is beginning to shift.

"Until now, private companies primarily operated in roles such as threat intelligence, SOC, incident response, and technical defense. The new model, however, could turn them into part of the state's cyber-operational capabilities in a controlled manner," Mammadov noted.

In his view, this approach could enable a more agile and rapid response against ransomware networks and other transnational cybercrime infrastructures.

At the same time, the new model raises several serious questions. Issues remain open regarding who will bear responsibility in cases of misidentification, what consequences will arise if an operation impacts the infrastructure of a third country, and at what stage a private company's actions would be considered a state operation.

Mammadov noted that an important distinction is that this is not about an unrestricted right to "hack back." Operations must be approved and coordinated by the state and carried out within strict legal constraints.

"The US is shifting from passive defense to an active disruption model against cybercrime," he stressed.

According to Mammadov, if this model delivers results, the role of cybersecurity companies in the future will not be limited solely to protecting systems. In certain cases, their role could expand to becoming operational partners of the state's cyber power.

He noted that this approach could mark the beginning of an entirely new era in the cybersecurity industry.