Cleared Contractors Face Rising Insider Threat Reports

Defense companies reported more than a 50% rise in critical incident reports last fiscal year, while the FBI warned that North Korean IT workers are seeking jobs with cleared contractors and other U.S. government suppliers. Organizations handling sensitive work are tightening scrutiny of employees and applicants. People inside those organizations are increasingly treated as a point of risk.

The costs of guarding the gates

The Defense Department Cyber Crime Center, or DC3, said companies reported a record number of insider-threat incidents. Les Bernys, the executive director of DC3, said insider cyber incidents reported in the previous six months far outpaced any other period in the center’s history. DC3 couldn’t provide complete figures because reporting defense industrial base companies are anonymous.

Bernys described two kinds of incidents: former Defense Department employees who acted maliciously on networks before leaving or kept access to data and tried to exfiltrate it, and companies discovering they had hired people they believed were Americans but who were North Korean. “These incidents aren’t coming in huge numbers, but the increase is noticeable,” he said after speaking at the ACT-IAC Cybersecurity Summit on Oct. 14. Companies, he added, were struggling to verify applicants.

The FBI recently warned that North Korean schemes use remote IT work for U.S. companies to finance the regime. The Justice Department reported an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas under “Operation Lonestar Roundup,” and the seizure of approximately 187 computer devices used by North Korean IT workers.

The department said the scheme ran from 2019 through 2025, affected more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. Officials believed the revenue went to organizations controlled by North Korea. Affected companies operated in healthcare, communications, cyber support, retail and manufacturing in Ohio, 16 other states and the District of Columbia.

Suspicion as standard procedure

The FBI advises companies to look for combinations of behavior when assessing applicants or activity on corporate networks. Its examples include using remote-desktop software to connect to employment-related devices and frequently downloading applications unrelated to a person’s job onto work devices. North Korean IT workers increasingly recruit American facilitators, the bureau said, and may use them for more tasks or subcontract entire jobs to third-party foreign nationals.

The FBI said groups use identities or facilitators with qualifications that can open more doors, including positions requiring U.S. government security clearances or specialized technical skills. They have targeted cleared defense contractors, other government contractors and active-duty U.S. military members to host laptops.

In its fiscal 2025 annual report, the Defense Counterintelligence and Security Agency (DCSA) said companies reported more than 22,000 suspicious contacts. The agency identified roughly 2,900 incidents involving foreign entities seeking sensitive information or technology from cleared industry. Some foreign entities attempted to circumvent sanctions and compromise cleared employees.

DCSA defines suspicious contacts as contacts with roughly an even chance or higher likelihood of being attempts by people of any nationality to gain illegal access to cleared facilities, classified information or technology, or to compromise cleared employees. Companies reported approximately 32,000 suspicious contact reports in 2024 and 28,000 in 2023, more than a 7% increase from 2022.

The apparatus expands its watch

DCSA said more than 48% of targeted attempts in 2025 came from East Asia and the Pacific. The most common tactics were exploiting experts and submitting resumes. “Foreign entities frequently sought access to cleared subject matter experts, researchers and technical personnel to obtain specialized knowledge and expertise,” the agency said. It also said bad actors used resumes to seek emerging-technology jobs in U.S. academia and cleared industry, aiming for legitimate placement and proximity to defense research data, tools and professional networks.

The agency described the cleared national industrial base, including academia, companies of all sizes and personnel who research, develop and field U.S. technologies, as a primary target. It said that target becomes more attractive as it produces innovative capabilities.

The Cybersecurity and Infrastructure Security Agency updated its Insider Threat Mitigation Guide in September 2026. The guide covers behavioral indicators, hybrid and remote work, artificial intelligence used to manipulate or deceive, access control, visitor screening and risks from adverse employee separations. CISA said credential theft costs each company about $4.8 million a year and containing an insider-threat incident takes an average of 81 days.

“Insider threats can be either intentional or unintentional. A significant portion of insider threats involve negligent or accidental behaviors,” CISA wrote. The agency said these threats involve people with a trusted relationship acting outside its expectations, and recommended complementary, case-specific measures that balance organizational protection with care for individuals. There’s no single formula, the agency said; the machinery of security keeps widening its inspection while insisting it can also be respectful.