In an era of achieving efficiencies, here’s how the federal government can combat third-party risks and insider threats

In an era of achieving efficiencies, here’s how the federal government can combat third-party risks and insider threats

Third-party vulnerabilities and insider threats continue to gain momentum in a volatile cybersecurity landscape.

The federal government is facing many uphill battles when it comes to addressing third-party vulnerabilities and insider threats. Government agencies are also trying to navigate new government initiatives on efficiency and cybersecurity executive orders, all while dealing with tight budgets.

Additionally, with the strategic push to adopt artificial intelligence across the federal government, this potentially expands risks from new third-party software and AI, such as data poisoning attacks. In March, the National Institute of Standards and Technology released finalized guidelines to address this issue, detailing specific threat and mitigation strategies for predictive and generative AI models.

With these risks, combined with the hiring freezes and budget cuts in government, federal agencies could also see an increase in insider threats. Insider threats are risks posed by individuals with authorized access to an agency’s systems and data, making them high-risk threats due to their in-depth knowledge of the government’s operations and vulnerabilities, which can be exploited intentionally or unintentionally. According to “The State of Data Security in 2025: A Distributed Crisis,” nearly 30% of surveyed IT and security leaders cited insider threats, often linked to compromised credentials, as a factor in recent attacks. This statistic marks a notable increase and highlights the growing challenge the federal government faces in securing data across complex hybrid and cloud environments.

Assume breach

Government agencies should adopt a proactive “assume breach” approach while also addressing the persistent third-party, insider threat landscape and poor cyber hygiene.

Multiple types of insider threats exist, which endanger national security and operational aspects of government agencies. Unintentional threats emerge from two sources: security policy violations by insiders and human error, which create additional cyber risks. The category of intentional threats known as “malicious insiders” targets agencies through deliberate actions for personal benefit.

Government agencies should proactively develop mitigation strategies that address the heightened risk of insider threats, particularly during periods of organizational change, such as layoffs, restructuring or policy shifts. Research indicates that employees who feel negatively impacted by such changes, such as those facing job insecurity, are more susceptible to recruitment or manipulation by external threat actors. According to the 2025 Verizon Data Breach Investigations Report, financial gain remains the leading motive for malicious insiders, but espionage and personal grudges also play a significant role.

For instance, Chinese state-sponsored hackers launched a cyberattack on the Treasury Department through a third-party cybersecurity service provider in December and accessed unclassified government employee workstations and their files. The Treasury hack will neither be the last nor the worst attack against a prominent federal agency, so agencies should anticipate this new norm by building mitigation strategies in response to the global increase in cyber threats.

Recommendations to address these cyber risks include:

• Assuming breaches of all federal systems or the software supply chain and building in cyber resilience along with zero trust across any agency’s most critical systems and data.
• Requiring the complete visibility of every component within the federal digital ecosystem, including all hardware and software systems. This strategy should also include reassessing agency security architectures and planning and designing agency systems for failure or compromise.
• Requiring vulnerability assessments and secure disposal of unused equipment and software usage simplification. NIST frameworks should also be implemented to create standardized cyber hygiene best practices that support ongoing data security management.
• Implementing complex passwords together with multi-factor authentication (MFA) to enhance access controls. Agency system performance should remain optimal through software and firmware updates, which simultaneously protect against emerging security threats like ransomware.

Identify critical assets

Government agencies should begin addressing insider threats and third-party risks by identifying their most critical systems and data.

From this starting point, they can work backward to develop comprehensive data protection strategies. Key questions agencies should address include:

1. What are the most vital systems and data for federal agency operations?
2. Are cyber recovery capabilities in place to rapidly recover these key systems and minimize downtime?
3. What measures can be implemented to ensure operational continuity in the face of cyberattacks, particularly as they threaten emerging technology’s promise for the federal government?

Furthermore, any breach or unauthorized system access can quickly become destructive, such as when attackers deploy ransomware or wiper malware. Therefore, it’s critical that the federal government focus on the motive of the threat actor and not just the tools they use once they have access. The federal government must assume cyber adversaries have access and then start planning for and building in those mitigations for different types of motives and outcomes that cybercriminals want to achieve.

Secure the bottom line

Addressing insider threats and third-party vulnerabilities is also fundamental to securing the federal government’s bottom line.

Government agencies must address cyber resilience challenges amid new government efficiency measures. Budget constraints and acquisition processes must keep up with the rapid pace of technological change in the strategic planning process, as insider threats and cyberattacks against third-party vulnerabilities will continue to wreak havoc across government.

In the future, it will remain crucial for the federal government to adopt a proactive “assume breach” posture, acknowledging that cyber risks of this magnitude will remain a significant threat to sensitive government data if they are not urgently addressed.

But most importantly, I believe addressing these cyber risks is about helping agencies achieve their missions and build cyber resilience.

Travis Rosiek is public sector chief technology officer at Rubrik. The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of Rubrik. This article is for informational purposes only and does not constitute business or legal advice. Organizations should consult with legal and compliance professionals to ensure their cybersecurity strategies meet all applicable federal, state and international requirements.

Copyright
© 2025 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.