For most of the years since World War II, American security policy has followed a familiar pattern.
A threat would emerge, officials would meet and write a policy, secure the funding, and deploy countermeasures. Years later, these would be reviewed.
This worked when threats changed slowly. In today’s world, with the technological advancements that exist, security standards of yesterday are simply not enough. Inadequate standards can leave government agencies, defense contractors, the sensitive information they hold, and ultimately the entire nation vulnerable in ways never anticipated before.
This is not a problem just for the intelligence sector. When security standards fail, it seeps into critical national services and can cause serious harm.
In May 2024, the Environmental Protection Agency reported that more than 70 percent of the community water systems it had inspected since September 2023 were not fully complying with federal risk-assessment and emergency-planning requirements.
Inspectors also identified cybersecurity weaknesses at some systems, including unchanged default passwords and shared staff logins.
I have worked in the security industry for nearly 45 years, and I can confidently say that I have never seen a shift this fast in the industry. Artificial intelligence, open-source intelligence, 5G (and 6G in development), drones, encryption, and quantum computing are all reshaping the greater picture, and not a single one stands still.
Some work that once required substantial resources can now be done from a keyboard.
The problem is that our security standards are not keeping up with the industry’s evolution.
The Heart of the Problem
Many of them have been built to deal with old adversaries, understanding how they work and the tools they use. And too often, success is defined as checking every box of these outdated standards and not being harder to attack. We can see the problem clearly upon closer inspection of secure facilities today.
These are still often designed to protect against physical threats, like someone breaking in. But at present, risks can also come through connected devices, wireless signals, and new digital tools. Yet, the information and missions remain as vulnerable as ever, or even more so now.
This, I believe, is the heart of the problem. Meeting standards does not guarantee success because it is not the same as being protected. Rigid checklists can also make it difficult for small-scale contractors to get government work.
Attempting to meet standards that apply mainly to large companies might require small contractors to spend thousands of dollars, even if they aren’t relevant to the risk. Therefore, the price of compliance alone can make the competition unfair for small contractors.
Also, in my view, the government officials who ensure compliance often don’t understand the technology they are dealing with or the companies they’re checking. This can partly reflect challenges in keeping training aligned with rapidly evolving technologies.
But when officials do receive training, government organizations can be vulnerable to private companies swooping in to offer better pay and benefits. All of this potentially leads to flawed assumptions, which would only get noticed after the policy is in use.
How To Fix It
The fix is not to rip apart everything that exists. It is flexible standards. Security standards must be reviewed regularly, more often in months than in years.
These reviews should draw on existing threat intelligence and employ technical experts and operational security professionals, not just policymakers. And every review and final policy must be tested against two concerns. Does it stop the threats we actually face? Is it worth the cost we pay?
If we stay on the current path, I feel organizations will keep mistaking paperwork and rigid standards for protection while real weaknesses go unnoticed. This could lead to disruption that will not be contained within just one system.
Instead, it might risk anything and everything even remotely connected to the affected systems. And once sensitive information is out, that disclosure can never be undone.
If we get this right, the results will be practical and effective. Security could become more cost-effective as agencies spend money on actual risks and less on irrelevant ones.
Precaution would take center stage, and critical services would fix known weaknesses before the threat materializes. It would also create space for small contractors to compete fairly for government work.
Let’s start by establishing working groups at the expert level to solve issues, plan for future actions, and continually educate leadership on the current status of security countermeasures. Government agencies and industry experts must work together so Americans can sleep peacefully knowing that they are protected against today’s threats, not yesterday’s.
Mitch Lawrence is the founder of Lawrence Solutions, a consultancy advising government and industry on classified-information security. All opinions are the author’s own.