Defense Counterintelligence And Security Agency Report Reveals Threats To U.S. Cleared Industry

The Defense Counterintelligence and Security Agency (DCSA) has released its 2026 annual report — Targeting U.S. Technologies: A Report of Threats to Cleared Industry. The Report provides details and data concerning the continued and growing efforts of foreign entities to exploit subject matter experts and business ties to access sensitive US technology and information. The Report highlights several key areas of risk in terms of targets, threat modality, and geography.

The primary targets for foreign entities’ exploitative efforts are cleared subject matter experts, accounting for 28% of incidents. “Cleared” entities refer to companies or individuals that have been granted U.S. government security clearances — typically under the National Industrial Security Program (NISP) — allowing them to access, handle, or safeguard classified information. The exploitation of cyber operations also remains a significant concern, with actors targeting public-facing websites, contractor networks, and points of trust within organizational ecosystems. The main methods of communication with targets are email (30%), academic resumes (15%), and web forms (14%). Through these channels, malicious actors can approach cleared contractors via business, academic, hiring, and procurement avenues, thereby gaining access to sensitive information on US technology. 

The top three targeted technology categories include Services and Other Products, Electronics, and Aeronautics Systems, comprising 41% of all reports. Geographically, while there are threats globally, the Report emphasizes that numerous actors across the eastern hemisphere are engaged in the foreign collection of classified and sensitive US information and technology. The primary perpetrators are from East Asia and the Pacific (48%) and the Near East (19%). 

As a result of these malicious activities, the DCSA received more than 22,000 suspicious contact reports and identified approximately 2,900 incidents involving foreign entities seeking sensitive information or technology from the cleared industry during FY 2025. This underscores the importance for cleared contractors, facility security officers, and cleared personnel to remain alert to suspicious contacts, validate unsolicited employment, consultation, and business opportunities, and report potential foreign collection activities through established security channels.

Comparing the 2026 Report with those from 2025 and 2024 reveals several shifts in the targeting of US sensitive information and technology. From 2025 to 2026, the primary focus shifted from resume submissions to the exploitation of experts. The main method of communication has continued to be email over the past three years, emphasizing the need for heightened caution, robust procedures for good cyber hygiene, deliberate organizational policy, and regular training and testing. While Services and Other Products and Aeronautics Systems were previously among the top targeted technologies, electronics has replaced software in the 2026 report. Finally, over the past three years, there has been a consistent increase in threats from East Asia and the Pacific, along with a decrease from the Near East.