The new model will be used by a small number of high-profile companies to engage in defensive cybersecurity work.