In the past two decades, private military and security companies (PMSCs) have become important actors in the international sphere, in armed conflict as well as in law enforcement. Along with the need for private actors in the military and security industry, the need to regulate these actors has increased. Both domestically and internationally, legislators have sought to curtail PMSC actions while trying to accommodate states' demand for more private involvement in the security sector. This article examines how risk mitigation and risk commodification work as socio-political motives for states to outsource security tasks and responsibilities, and how the resulting industry has taken the shape of a horizontal network in which states, companies, NGOs and international organizations play different roles. The article also highlights how and why international and domestic law both struggle to deal with the existence of this network and the nature of the private security industry.