A recent Government Accountability Office report reveals that the Defense Counterintelligence and Security Agency (DCSA) spent over $160 million in fiscal year 2025 to oversee security compliance among cleared defense contractors — yet the results paint a troubling picture of systemic vulnerability. Despite deploying more than 470 personnel to conduct over 4,600 security reviews, the agency documented 815 security violations and more than 1,000 open security vulnerabilities at cleared contractor facilities. These are not minor administrative oversights; violations are defined as incidents that could reasonably result in the loss or compromise of classified information, meaning sensitive national security data may have been exposed through contractor negligence or mismanagement.
The findings raise serious questions about the structural relationship between the Pentagon and its vast network of private contractors — a relationship that, as detailed in War Is Still A Racket, has historically prioritized profit and expansion over accountability and security. With over 1,000 vulnerabilities left open and hundreds of confirmed violations, the GAO’s call for improved risk management and stakeholder engagement suggests that DCSA lacks the leverage or institutional will to impose meaningful consequences on contractors. When billions in defense contracts depend on maintaining cleared status, the incentive to self-police is structurally weak, and taxpayers are left funding an oversight apparatus that, by its own metrics, is failing to close the gaps it exists to address.