Defense Contractors Are Silencing Their Cybersecurity Watchdogs

The US Department of Defense’s Cybersecurity Maturity Model Certification 2.0 will require more than 300,000 military contracting companies to improve their cybersecurity protections, with phase 1 beginning on 10 November 2025. According to Bloomberg Law, more than half of military contractors are unprepared for these new requirements.

Over the past few years, cybersecurity whistleblowers at defense contractors have become more willing to come forward, and major companies, including Raytheon and Aerojet Rocketdyne, have already paid millions of dollars to the US Department of Justice to resolve cybersecurity fraud claims brought by whistleblowers under the federal False Claims Act. In general, whistleblowers bring such claims because their employer ignores or retaliates against them when they raise concerns internally.