TELOS CORP

U.S. Budget

In March 2024, the U.S. President proposed the annual appropriations for Fiscal Year ("FY") 2025 to fit within the tight caps set as part of the prior year's debt ceiling agreements. The FY2025 budget request included $850 billion for the DoD base budget, in alignment with levels agreed to in the Fiscal Responsibility Act ("FRA") of 2023. This proposed budget will enable the DoD to make the investments necessary to execute the Administrations' 2022 National Security Strategy and 2022 National Defense Strategy. The President's FY2025 budget also proposed several increases for new, key cyber programs and initiatives. For FY2025, the White House had directed agencies to prioritize cyber investments in "secure by design" technologies and the modernization of legacy technology. In the wake of the President's Executive Order ("EO") on artificial intelligence last fall, the 2025 budget proposal includes plenty of AI-related spending, much of which intersects with cybersecurity and AI safety.

Congress was unable to enact any of its annual appropriations bills before the start of FY2025, which began on October 1, 2024. Instead, on December 20, 2024, the U.S. House and Senate passed a second Continuing Resolution ("CR") to extend federal spending and avert a government shutdown through March 14, 2025. The CR keeps the government operating at FY2024 funding levels, and ensures the federal government can receive adequate funding to operate for the duration of the CR. The current CR provides $888 billion in base defense funding for 2025, an amount exceeding the $850 billion cap on such funding established under the FRA. As of January 6, 2025, $12 billion in Defense funding was designated as an emergency requirement, and is not constrained by the caps established by the FRA.

Appropriators in both chambers had been hoping to at least reach a topline spending agreement, but the momentum for a deal was derailed after the new Administration issued a slew of EOs since inauguration, including an order to freeze funding on several federal programs. While the Cybersecurity and Infrastructure Security Agency ("CISA") is viewed as vital for national security purposes and its programs will still continue, the new Administration has sworn to reduce the size and scope of CISA.

Of note, the CR did not address the federal debt ceiling, which is the limit that Congress imposes on the federal budget for authorized spending. In January 2025, the federal debt limit was reinstated at $36.1 trillion to accommodate borrowing since its suspension through FRA. Until Congress acts to modify the limit, the Treasury Department relies on the available cash on hand and invoked authorities to use extraordinary measures to continue paying its debt obligations, without jeopardizing the "full faith and credit" of the U.S. government.

While there is no clear path to approval of the FY2025 budget, failure to do so poses uncertainty about actual funding and will impact federal customers' ability to move forward on their planned expenditures in FY2025.

Cybersecurity Landscape

The scope of cybersecurity is on the cusp of transformative changes. Cyber threats are not just escalating in frequency but are also becoming more sophisticated, thus challenging traditional security standards. In this rapidly evolving cybersecurity landscape, the need for vigilant defense is vital, and cybersecurity is a priority for organizations to mitigate their risk and keep safe from threats and exploitation. Understanding the threat environment and the impending trends (both current and future) is a matter of foresight and is crucial in designing effective security strategies. The DoD continues to invest in cybersecurity programs to protect the nation from malicious cyber actors and cyber campaigns. These investments strengthen cyber protection standards for the defense industrial base and cybersecurity of DoD networks. With this growing threat, below are some trends to consider when looking at the cybersecurity landscape:

Emerging Cyber and Counterintelligence Threats: The proposed FY2025 budget expands the Department of Justice’s ("DOJ") ability to pursue threats through investments in the FBI’s cyber and counterintelligence investigative capabilities. These investments sustain the FBI’s cyber intelligence, counterintelligence, and analysis capabilities and include funding to enhance those cyber response and counterintelligence capabilities. The budget also includes funding to expand a new section within the DOJ’s National Security Division to focus on cyber threats. These investments align with the National Cybersecurity Strategy that emphasizes a whole-of-nation approach to addressing ongoing cyber threats. Finally, the budget also provides for the DOJ to support the implementation of Executive Order 14110, “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.”

Rising Threats, Rising Liability: Ransomware remains arguably the most severe cyber threat to enterprises in the commercial, state, and local government and education sectors. Phishing is one of the top distribution channels for ransomware. Modern phishing attacks have become adept at bypassing traditional security measures, using more personalized and technically advanced tactics to deceive users. One reason for the rise of ransomware attacks is that it is exceedingly profitable for cybercriminals, and ransomware victims generally settle the ransom rather than restoring the system from backups or dealing with the fallout from a data breach. Aside from the financial costs of paying the ransom and restoring the system, the consequences of a successful ransomware attack can include damage to the organization's reputation, stolen sensitive data being used for malicious purposes, and loss of business.

The Nation's Critical Systems Are Still at Risk: Critical infrastructure and industrial IoT are among the categories at greatest risk of cyberattacks. The IoT continues its rapid growth, interconnecting an increasing number of devices. However, this expansion brings with it a host of security challenges. The wide range of IoT devices make them attractive targets for cyberattacks, and their interrelated nature can lead to pervasive vulnerabilities.

Navigating a Changing Regulatory Landscape and Compliance: The regulatory landscape governing cybersecurity is developing swiftly. Over time, the government mandates stronger security in highly regulated industries. These government initiatives and audit fatigue continue to burden highly regulated organizations, with automation solutions recognized as the most effective remedy for the many repetitive and redundant tasks that security compliance requires.

Additionally, the SEC adopted new rules on cybersecurity risk management, strategy, governance and incident disclosure by public companies. The required reporting of this information leads many companies to proactively establish policies that will improve their cyber risk management posture and enable them to better withstand heightened public and regulatory scrutiny.

Identity Assurance and Privacy Protection are Essential for Today's Enterprises: Identity and access management continue to be a major cybersecurity concern for organizations and individuals that need to ensure their security and protect their privacy. Trusted identities are essential to confidence in IT and physical security strategies and to the success of Zero Trust security models and architectures. The shift to a Zero Trust framework represents a fundamental change in approach to cybersecurity, focusing on identity and access management, continuous monitoring and robust authentication mechanisms to establish a secure digital environment.

Enhancing Identity Security: The shift towards biometric authentication methods is redesigning identity verification in the digital domain. Integrating biometrics with multi-factor authentication can provide a robust defense against unauthorized access.

Artificial Intelligence: AI is set to play a critical role in cybersecurity. Cybercriminals are using AI to launch more sophisticated attacks that can quickly adapt to changing environments, making detection harder. AI's advanced data analysis capabilities are increasingly used for defensive measures over time. To protect against AI-powered cyberattacks, organizations must stay vigilant and adopt advanced cybersecurity tools and techniques that can detect and respond to these threats in a timely manner before they cause damage. The proposed FY2025 budget provides $455 million to extend the frontiers of AI for science and technology and to increase AI’s safety, security, and resilience. These investments enhance the DoD’s computing capabilities and support the development of AI testbeds to build foundation models for energy security, national security, and climate resilience as well as tools to evaluate AI capabilities to generate outputs that may represent nuclear, nonproliferation, biological, chemical, critical-infrastructure, and energy security threats or hazards.