Lax Navy cybersecurity has left the Navy and its supply chain “under cyber siege” from Russian and Chinese hackers.
Everyone already knew that Navy cybersecurity had big problems. Last fall, a Wall Street Journal report on Navy cybersecurity revealed that Chinese nation-state hackers had successfully breached a number of third-party Navy contractors over an 18-month period, stealing highly classified information about advanced military technology currently under development, including “secret plans to build a supersonic anti-ship missile planned for use by American submarines.” The hackers had targeted the contractors, the WSJ reported, because they surmised these firms had less robust cybersecurity and would make easy targets.
illustration of cartoon businessman with leaking boat
Shortly after the WSJ published its report, an internal Navy cybersecurity audit was ordered, citing “several significant compromises of classified and sensitive information.” The resulting audit report, which was released last week and first reported on by the Wall Street Journal, portrays a military branch in complete cyber chaos, “in ways few appreciate, fewer understand, and even fewer know what to do about.”
Cybersecurity awareness severely lacking in the Navy
The scathing, 80-page report details many of the same organizational culture stumbling blocks and lack of awareness/education among personnel that stymie cybersecurity at private-sector firms, including:
- Navy cybersecurity is predominantly viewed as “an IT issue and is not integrated across all operations and activities of the organization.”
- Navy leadership “occasionally articulate[s] the importance of cybersecurity, but do[es] not fully understand how to convert their words into action.”
- The Navy’s workforce is “generally uneducated in cybersecurity, largely complacent, and fails to fully embrace ‘a risk to one is a risk to all.’”
- Navy internal bureaucracy is mired in the pre-digital era, is focused on pre-digital threats, and has been reluctant “to shift its focus from ship or platform centric, to information centric, in order to attend to the world of vulnerabilities presented by its adversaries’ capabilities growth and sophistication.”
Navy contractors “under cyber siege” from foreign nationals
The audit did not mince words regarding the significant ongoing threat to Navy cybersecurity posed by its own supply chain, including subcontractors who “are not US owned or domiciled” but who are necessary to the Navy supply chain because they are part of ”key industrial and utility commons ecosystems that are no longer centered or owned in the US, such as advanced composite materials or national telecommunications infrastructures.” These contractors, the audit states, are “under cyber siege” by foreign adversaries, particularly those in Russia and China, and have been for years.
Meanwhile, the Navy “did not anticipate this attack vector,” did not adequately warn its supply chain about possible cybersecurity threats, and has relied on an honor system where contractors self-report vulnerabilities and breaches. This system, the audit states, has “demonstrably failed” and left the Navy and the DoD with no grasp of the true scope of Navy supply chain breaches. Very few cyber incidents are reported, and of those that are, only a small number are “fully investigated.”
In a brief statement, Secretary of the Navy Richard Spencer pledged that “the Department of the Navy Secretariat along with the Chief of Naval Operations and the Commandant of the Marine Corps, will coordinate with the Department of Defense and Congress for the resources required to compete and win in the cyber domain.” The Navy also announced that it had ceased publicizing promotions of Navy captains and admirals last fall to prevent top brass from being targeted by hackers.
The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.
Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.
What Is Autonomous Malware?
We’re reaching the end of 2025, and looking ahead to 2026, most experts are discussing the latest threats that will shape the year ahead. This year, we’re seeing a new, but not unexpected, shift to autonomous threats driven by state-sponsored actors and AI. With that in mind, a new generation of threats, broadly known as...Continue reading→
What CISA’s Emergency Directive 26-01 Means for Everyone
In mid-October 2025, the CISA issued one of its most urgent orders yet: Emergency Directive 26-01. The directive calls on all Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate vulnerabilities in devices from F5 Networks following a state-sponsored breach of F5’s systems and access to portions of BIG-IP source code and vulnerability data. The event...Continue reading→
Cybersecurity and Vetting AI-Powered Tools
A recent exploit involving a new AI-focused browser shone a light on a critical problem–namely, that browser security is a constant issue, and AI is just making that threat more pronounced. Attackers discovered a way to use that browser’s memory features to implant hidden instructions inside an AI assistant. Once stored, those instructions triggered unwanted...Continue reading→
Shutdown Security And Cyber Vulnerability
When the federal government shuts down, the public sees closed monuments, unpaid workers, and halted programs. What they do not see is the silent surge of cyberattacks targeting agencies already operating on fumes. During the most recent shutdown, attacks against U.S. government systems spiked by nearly 85%. Cybersecurity failures during government disruptions rarely start with...Continue reading→
Identity and the Shift from Malware
The world of cyber threats is rapidly evolving, and while we can see these changes more generally, it’s always crucial to understand them concretely. As the 2025 CrowdStrike Global Threat Report shows us, the landscape of our industry is changing. We’re digging into this report to discuss a challenging trend: the move of hackers foregoing...Continue reading→
Maintaining Compliance Against Prompt Injection Attacks
The increasing adoption of AI by businesses introduces security risks that current cybersecurity frameworks are not prepared to address. A particularly complex emerging threat is prompt injection attacks. These attacks manipulate the integrity of large language models and other AI systems, potentially compromising security protocols and legal compliance. Organizations adopting AI must have a plan...Continue reading→
Are We Already Talking About CMMC 3.0?
The ink has barely dried on the CMMC final rule, and already the defense contracting community is buzzing with speculation about what comes next. Just when contractors thought they had a moment to catch their breath after years of regulatory limbo, whispers of CMMC 3.0 have begun circulating through the industry. But is this just...Continue reading→
Centralizing Identity-Based Risk
As the traditional network boundary dissolves and remote work becomes standard practice, identities are the major frontier for security. Whether we’re talking about human users, service accounts, or machine identities, these have emerged as both the primary access mechanism and the most targeted attack vector. It has become imperative for providers to centralize identity management...Continue reading→
Deviation and Significant Change Requests in FedRAMP: A Comprehensive Guide
FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. While the program’s rigorous baseline requirements ensure consistent security, the reality is that this consistency calls for a little flexibility. This is where deviation requests and significant change requests come into play. These two...Continue reading→
The Costs of Compliance and Data Breaches
Data is possibly one of the most valuable assets any organization holds. Customer information, employee records, and proprietary business intelligence present challenges because the data flowing through modern enterprises represents both significant opportunities and serious risks. Businesses face a challenging balance: investing in compliance measures to protect sensitive information while also preparing for the real...Continue reading→
Related Posts