To protect digital businesses, companies are increasingly employing active defense capabilities, at the same time they put basic cyber-hygiene protocols in place. This means maintaining up‐to‐date intelligence from both internal and third‐party sources, mitigating insider threats, engaging attackers on the company's own network, and partnering to mitigate external threats. However, organisations are increasingly questioning whether or not they have (or ought to have) a right to 'hack back' as an offensive retaliatory measure. Revenge is sweet, but is it legal? This presentation explores the current legal positions and evolving debate, proposing the time has come to permit hacking back in particular circumstances and lightening the nudge with a tongue-in-cheek addendum to NIST (The ‘Revenge' Function).