Red teams should be legally allowed to attack companies (within certain parameters), even without the company's permission. As long as the red team attackers re

Red teams should be legally allowed to attack companies (within certain parameters), even without the company's permission. As long as the red team attackers report what they find responsibly. I'm jaded and think our best hope is that the good guys can find the vulnerabilities before the bad guys. We can't depend on the companies to do the right thing when they have no incentive. There are no negative consequences for companies with bad security currently. The bad guys get to attack-at-will and the good guys have to beg permission, "please Equifax, you have all my data, may I please test the effectiveness of your security for myself?" They say no, and I'll risk going to prison if I try. I'm jaded. I think we don't do this because it would embarrass many powerful people. We might also realize many of our institutions are incapable of building secure systems, which would be a national embarrassment. This is important though. It's no exaggeration to say this is a matter of national security. Currently we sacrifice national security so companies can avoid being embarrassed.