TELOS CORP

U.S. Budget

After using continuing resolutions (“CRs”) to fund the government for the first six months of fiscal year (“FY”) 2024 at the previous year’s levels, Congress completed action in late March on all appropriations bills for FY2024. This has allowed federal departments and agencies to begin proceeding with new program starts and acceleration for the final six months of the fiscal year. With the enactment of the Fiscal Responsibility Act ("FRA"), appropriations bills were marked up in the House and Senate in June and July. The FRA caps total base discretionary spending at $1.6 trillion for FY 2024, with base defense spending capped at $886 billion (a three percent increase from FY 2023) and base non-defense spending capped at $704 billion (up to a nine percent decrease from FY 2023, depending on how it is measured).

There will be debate in Congress on whether to adjust the spending caps in order to boost defense spending to meet increased challenges abroad. Of interest, the Senate passed a package of national security-oriented bills passed by the House on April 20, 2024, that provided supplemental appropriations for Israel, Ukraine, and the Indo-Pacific, as well as a fourth bill that addressed sanctions and other economic concerns. Three of the four bills being considered provide roughly $96 billion in new budget authority. The proposed budget also calls for new increases in funding for non-defense cybersecurity programs and initiatives, many of which continue to prioritize accelerated cloud adoption, IT modernization, further private sector collaboration for sector risk management responsibilities, ensuring adequate cyber threat information sharing, and supply chain risk management. These priorities continue to align with the solutions Telos has been developing and bringing to market for the past several years. However, in the current political environment in Congress and with the presidential election looming in November 2024, it is highly questionable whether Congress and the President can reach an agreement on FY2025 appropriations bills prior to the start of FY2025 on October 1, 2024; this means the Defense Department along with the rest of the federal government will likely begin the fiscal year funded by a CR at FY2024 spending levels.

Cybersecurity Landscape

In recent years, we have seen cybersecurity threats become more complex, with threat actors leveraging a wide variety of tactics to exploit their victims. With this growing threat, below are some trends to consider when looking at the cybersecurity landscape:

Rising Threats, Rising Liability: Ransomware remains arguably the most severe cyber threat to enterprises in the commercial, state, and local government and education sectors. One reason for the rise of ransomware attacks is that it is exceedingly profitable for cybercriminals, and ransomware victims generally settle the ransom rather than restoring the system from backups or dealing with the fallout from a data breach. Aside from the financial costs of paying the ransom and restoring the system, the consequences of a successful ransomware attack can include damage to the organization's reputation, stolen sensitive data being used for malicious purposes, and loss of business.

The Nation's Critical Systems Are Still at Risk: Critical infrastructure and industrial IoT are among the categories at greatest risk of cyberattacks.

The Challenging Complexity of Regulatory Compliance: Government mandates stronger security in highly regulated industries. These government initiatives and audit fatigue continue to burden highly regulated organizations, with automation solutions being recognized as the most effective remedy for the many repetitive and redundant tasks that security compliance requires.

Additionally, the SEC has finalized and adopted new cybersecurity rules for publicly traded companies, which (if they survive challenges in court) will require registrants to disclose additional cyber-related information in their regulatory filings. Specifically, registrants will have to: (1) regularly disclose their governance methods, risk analysis and management processes; (2) meet specific disclosure requirements and deadlines for reporting and describing material cyber incidents; and (3) describe the board's oversight of risks from cybersecurity threats, and management's expertise and role in assessing and managing material risks from cybersecurity threats. The required reporting of this information will lead many companies to proactively establish policies that will improve their cyber risk management posture and enable them to better withstand heightened public and regulatory scrutiny.

Identity Assurance and Privacy Protection are Essential for Today's Enterprises: Identity and access management continues to be a major cybersecurity concern for organizations and individuals that need to ensure their security and protect their privacy. Trusted identities are essential to confidence in IT and physical security strategies and to the success of Zero Trust security models and architectures.

Artificial Intelligence: Cybercriminals are using Artificial Intelligence ("AI") to launch more sophisticated attacks that can quickly adapt to changing environments, making detection harder. To protect against AI-powered cyberattacks, organizations must stay vigilant and adopt advanced cybersecurity tools and techniques that can detect and respond to these threats in a timely manner before they cause damage.