The market for commercial cyber intrusion capabilities (CCICs) is moving faster than the frameworks designed to govern it.