DCSA report warns foreign actors are exploiting experts and business ties to access sensitive U.S. technology and data

WASHINGTON — Foreign intelligence services continued to probe the U.S. defense industrial base through professional outreach, hiring overtures, business relationships, and cyber activity, according to a Defense Counterintelligence and Security Agency report released Sept. 17, 2026.

The 2026 edition of “Targeting U.S. Technologies: A Report of Threats to Cleared Industry” reviews activity during fiscal year 2025 aimed at obtaining unauthorized access to sensitive and classified information across cleared companies and academic institutions. DCSA said it received more than 22,000 suspicious contact reports during the period and identified about 2,900 instances in which foreign actors sought protected information or technology.

The most common tactic involved cultivating access to specialists. Exploitation of experts accounted for 28 percent of recorded incidents, with foreign entities attempting to engage cleared subject-matter experts, researchers, and technical staff to extract niche knowledge. Email was the leading initial approach at 30 percent, followed by submissions of academic résumés and online web forms.

By geography, East Asia and the Pacific generated the largest share of reports at 48 percent, with the Near East responsible for 19 percent. Combined, the two regions represented 67 percent of the activity DCSA tracked in FY 2025.

On the technology front, Services and Other Products, Electronics, and Aeronautic Systems were most frequently targeted, comprising 41 percent of reporting. Foreign collectors also showed sustained interest in emerging and enabling technologies, including AI-enabled software, unmanned aircraft systems, telecommunications, advanced electronics, modeling and simulation, and restricted satellite imagery.

DCSA detailed how adversaries leverage routine-seeming professional and commercial channels—paid consultations, talent recruitment, conference invitations, résumé submissions, supplier engagements, partnership pitches, and direct technology requests—to get closer to protected information. Cyber operators, meanwhile, continued to go after public-facing websites, contractor networks, and trusted organizational access points.

The agency urged cleared contractors, facility security officers, and cleared personnel to stay alert to unsolicited outreach; verify employment, consulting, and business opportunities; and report potential collection attempts through established security processes. The report emphasizes that timely reporting helps DCSA track shifting tactics and disseminate relevant threat information to cleared industry.