An offensive security strategy aims to preemptively identify and mitigate gaps and weaknesses within an organization’s digital infrastructure. Defensive cybersecurity involves a systematic and comprehensive approach to identifying vulnerabilities and weaknesses before they can be exploited. With the Commercial Spyware EO in place, is the EO too defensive/restrictive, creating negative economic implications? How can the U.S. find the right defensive/offensive cyber-stance?