The best defence is a good offence - except in cybersecurity where we send people to the battlefield with armour and radios. The most active defence gets is evicting attackers from their network. We've leaned in so hard into defence as an industry we're lying on the floor, and it's time to look up. But, how can we take the fight to the criminals, without crossing legal and ethical boundaries?