TELOS CORP

U.S. Budget

The fiscal year ("FY") 2024 budget appropriation was approved in March 2024 and has allowed federal departments and agencies to proceed with new program starts and acceleration for the final six months of the fiscal year. With the enactment of the Fiscal Responsibility Act ("FRA"), appropriations bills were marked up in the House and Senate in June and July. The FRA caps total base discretionary spending at $1.6 trillion for FY2024, with base defense spending capped at $886 billion (a three percent increase from FY2023) and base non-defense spending capped at $704 billion (up to a nine percent decrease from FY2023).

In March 2024, the U.S. President proposed the annual appropriations for FY2025 to fit within the tight caps set as part of last year's debt ceiling agreements. The Defense Department budget includes $850 billion in discretionary budget authority for 2025, a $34 billion or 4.1% increase from the 2023 enacted level. This growth is in alignment with levels agreed to in the FRA of 2023 and enables the DoD to make the investments necessary to execute the Administration's 2022 National Security Strategy and 2022 National Defense Strategy.

The President's FY2025 budget also proposed several increases for key cyber programs and initiatives. For FY2025, the White House had directed agencies to prioritize cyber investments in "secure by design" technologies and the modernization of legacy technology. The budget provides $13 billion in cybersecurity funding across civilian departments and agencies to advance the Administration's commitment to making cyberspace more resilient and defensible. The proposed FY2025 budget includes $3 billion for the Cybersecurity and Infrastructure Security Agency ("CISA"), a $103 million increase over the agency's current budget. CISA's 2025 cyber budget proposal also includes $469.8 million for the Continuous Diagnostics and Mitigation ("CDM") program, wherein the agency would use the CDM funding to complete mobile asset deployments, continued asset deployments, initiate Internet of Things ("IoT") activities in asset management, continue to fill gaps in identity and access management capabilities, and align the agency to Zero Trust use cases. In the wake of the President's executive order on artificial intelligence last fall, the 2025 budget proposal includes plenty of AI-related spending, much of which intersects with cybersecurity and AI safety. This includes $470 million to deploy Federal network tools, including endpoint detection and response capabilities; $394 million for CISA's internal cybersecurity and analytical capabilities; $41 million for critical infrastructure security coordination; and $116 million for critical infrastructure cyber event reporting.

Congress was unable to enact any of its annual appropriation bills before the start of FY2025 on October 1, 2024. Instead, Congress passed and the President has signed into law a Continuing Resolution ("CR") that will extend funding for the federal government until December 20, 2024. The CR provides minimal needed spending adjustments for certain programs to ensure that the federal government can receive adequate funding to operate for the duration of the CR. However, in the current political environment in Congress and with the presidential election in November 2024, it is highly questionable whether Congress and the President will reach an agreement on FY2025 appropriations bills within the duration of the CR. This means the Defense Department and the rest of the federal government will likely be restricted from beginning their planned expenditures in FY2025.

Cybersecurity Landscape

The scope of cybersecurity is on the edge of transformative changes. Cyber threats are not just escalating in frequency but are also becoming more sophisticated, thus challenging traditional security standards. In this rapidly evolving cybersecurity landscape, the need for vigilant defense is vital, and cybersecurity is a priority for organizations to mitigate their risk and keep safe from threats and exploitation. Understanding the threat environment and the impending trends (both current and future) is a matter of foresight and is crucial in designing effective security strategies. The Defense Department's budget continues to invest in cybersecurity programs to protect the nation from malicious cyber actors and cyber campaigns. These investments strengthen cyber protection standards for the defense industrial base ("DIB") and cybersecurity of DoD networks. With this growing threat, below are some trends to consider when looking at the cybersecurity landscape:

Addresses Emerging Cyber and Counterintelligence Threats: The FY2025 budget expands the Department of Justice’s ("DOJ") ability to pursue threats through investments in the FBI’s cyber and counterintelligence investigative capabilities. These investments sustain the FBI’s cyber intelligence, counterintelligence, and analysis capabilities and include funding to enhance those cyber response and counterintelligence capabilities. The budget also includes funding to expand a new section within the DOJ’s National Security Division to focus on cyber threats. These investments align with the National Cybersecurity Strategy that emphasizes a whole-of-nation approach to addressing ongoing cyber threats. Finally, the budget also provides for the DOJ to support the implementation of Executive Order 14110, “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.”

Rising Threats, Rising Liability: Ransomware remains arguably the most severe cyber threat to enterprises in the commercial, state, and local government and education sectors. Phishing is one of the top distribution channels for ransomware. Modern phishing attacks have become adept at bypassing traditional security measures, using more personalized and technically advanced tactics to deceive users. One reason for the rise of ransomware attacks is that it is exceedingly profitable for cybercriminals, and ransomware victims generally settle the ransom rather than restoring the system from backups or dealing with the fallout from a data breach. Aside from the financial costs of paying the ransom and restoring the system, the consequences of a successful ransomware attack can include damage to the organization's reputation, stolen sensitive data being used for malicious purposes, and loss of business.

The Nation's Critical Systems Are Still at Risk: Critical infrastructure and industrial IoT are among the categories at greatest risk of cyberattacks. The IoT continues its rapid growth, interconnecting an increasing number of devices. However, this expansion brings with it a host of security challenges. The widespread range of IoT devices make them attractive targets for cyberattacks, and their interrelated nature can lead to pervasive susceptibilities.

Navigating a Changing Regulatory Landscape and Compliance: The regulatory landscape governing cybersecurity is developing swiftly. Over time, the government mandates stronger security in highly regulated industries. These government initiatives and audit fatigue continue to burden highly regulated organizations, with automation solutions recognized as the most effective remedy for the many repetitive and redundant tasks that security compliance requires.

Additionally, the SEC adopted new rules on cybersecurity risk management, strategy, governance and incident disclosure by public companies. The required reporting of this information leads many companies to proactively establish policies that will improve their cyber risk management posture and enable them to better withstand heightened public and regulatory scrutiny.

Identity Assurance and Privacy Protection are Essential for Today's Enterprises: Identity and access management continue to be a major cybersecurity concern for organizations and individuals that need to ensure their security and protect their privacy. Trusted identities are essential to confidence in IT and physical security strategies and to the success of Zero Trust security models and architectures. The shift to a Zero Trust framework represents a fundamental change in approach in cybersecurity, focusing on identity and access management, continuous monitoring and robust authentication mechanisms to establish a secure digital environment.

Enhancing Identity Security: The shift towards biometric authentication methods is redesigning identity verification in the digital domain. Integrating biometrics with multi-factor authentication can provide a robust defense against unauthorized access.

Machine Learning: Artificial Intelligence ("AI") and Machine Learning are set to play a critical role in cybersecurity. Cybercriminals are using AI to launch more sophisticated attacks that can quickly adapt to changing environments, making detection harder. AI's advanced data analysis capabilities are increasingly used for defensive measures over time. To protect against AI-powered cyberattacks, organizations must stay vigilant and adopt advanced cybersecurity tools and techniques that can detect and respond to these threats in a timely manner before they cause damage. The DoD budget provides $455 million to extend the frontiers of AI for science and technology and to increase AI’s safety, security, and resilience. These investments enhance the DoD’s computing capabilities and support the development of AI testbeds to build foundation models for energy security, national security, and climate resilience as well as tools to evaluate AI capabilities to generate outputs that may represent nuclear, nonproliferation, biological, chemical, critical-infrastructure, and energy security threats or hazards.