Defense Cybersecurity Fraud: False Compliance Without a Publicly Reported Breach

Defense contractor cybersecurity fraud can involve false security promises used to win or keep government business, even without a publicly reported breach. The important comparison may already be familiar to you: the assessment sent to the government says the controls work, while the people responsible for the system know they do not. A score, a security plan, a cloud contract or a promised repair date can carry that contradiction. The question is who knew, what the contractor represented and how that representation reached government money. The compliance statement can conceal gaps in the assessed system, access controls or authorized staff in False SPRS Scores and Assessment Scope: The Defense System Behind the Number, Defense Cloud and Foreign-Access Misrepresentations: The Government Sees the Statement, and Uncleared Personnel on Defense Contracts: Who Was Authorized to Do the Billed Work?.

NIST Compliance Claims Without a Reported Breach

A NIST compliance representation can support a false claim even when no actual breach is publicly reported. The connection runs through the security required for the particular contract, the system doing the work and the representation used to obtain an award or payment. That is where we start with an insider who knows the technical facts.

Defense work brings security obligations into the supplier’s own systems. The defense safeguarding clause addresses covered defense information, adequate security, cloud services and cyber incidents. Its security requirements include NIST controls. The assessment framework adds another record: a score in the Supplier Performance Risk System. The system security plan and the remediation commitments sit beside that score. Together they describe the protection promised and the work still to be done.

The distinction matters when a plan says a control will be implemented later but a certification says it is already working. It matters when the assessment covers a different network from the one holding controlled unclassified information. The government is buying work with security obligations attached, and the people running that network can see whether the promised protection exists.

SPRS Scores, Security Plans and the Systems Behind Them

MORSECORP’s Score Stayed High After the Assessment Went Negative

MORSECORP agreed to a $4.6 million civil settlement over cybersecurity allegations involving Army and Air Force contracts. In its settlement admissions, the company acknowledged deficient controls, cloud arrangements and security plans. It reported a score of 104 in January 2021, received a consultant’s assessment of -142 in July 2022, and left its reported score uncorrected until June 2023, after a government subpoena.

The whistleblower’s complaint also described an alleged management calculation behind the company’s self-assessment. It attributed this explanation to the executives choosing what to report:

We find that alleged calculation revealing: leave a little imperfection in the score so the claim looks more believable. The admitted chronology supplies a separate, concrete comparison between what the consultant found and what remained on file with the government.

Georgia Tech and the Alleged Artificial Environment

Georgia Tech Research Corporation agreed to pay $875,000 to resolve allegations involving Air Force and Defense Advanced Research Projects Agency contracts. The government alleged that its score of 98 described an artificial campus environment instead of the systems doing the contracted work. It also alleged that the Astrolavos Lab lacked a system security plan and antivirus protection during periods when those safeguards were required.

The score was allegedly a condition of receiving the contracts. An assessor or administrator who knows which systems were included can therefore connect the technical boundary to the award decision. An impressive result for the wrong environment answers the wrong question.

LOGZONE’s Assessment Exposed Missing Controls

LOGZONE agreed to pay $507,144 to resolve allegations that it sought payment on two Navy contracts while failing required cybersecurity controls. The Defense Contract Management Agency assessed its score at -170 on a scale from -203 to 110.

Cloud Services, Foreign Access and Promised Repairs

A defense supplier cybersecurity statement contradicted by an audit can reveal both the missing protection and the decision to keep representing compliance. A promise to fix a deficiency adds a date that can be compared with the work actually performed. Penn State’s case shows how remediation and cloud arrangements can meet in the same claim.

Pennsylvania State University agreed to pay $1.25 million to resolve allegations involving 15 defense and NASA contracts or subcontracts. The government alleged missing controls, false promised remediation dates, failure to pursue remediation plans and use of an external cloud provider that failed defense security requirements. The whistleblower’s amended complaint added an operational detail: controlled data allegedly moved from a FedRAMP-certified service into commercial Microsoft cloud storage, while investigators could not locate some systems behind projects claiming compliance.

Prime contractor cyber flowdown extends applicable safeguarding duties to subcontractors handling covered defense information or operationally critical support. A subcontractor’s false claims can therefore involve promises made within that contract chain. Covered cloud services have their own FedRAMP Moderate-equivalent and incident-related requirements, so the host’s terms and the actual location of the data belong beside the prime’s representation.

Aero Turbine and its private equity owner, Gallant Capital Partners, settled for $1.75 million. The government alleged failures to implement required controls on an Air Force contract and the provision of sensitive defense information to a software company in Egypt and unauthorized foreign personnel. The Justice Department credited the companies’ self-disclosures, cooperation and remedial action. For someone administering access, the relevant facts include who could reach the information and what the contract allowed.

Annual Certifications and the Audit Findings Behind Them

A defense contractor’s false cybersecurity annual certification can repeat an assurance that its own audits contradict. Health Net Federal Services and Centene agreed to pay $11,253,400 over alleged cybersecurity failures under a TRICARE administration contract. The government alleged that Health Net certified compliance while failing timely scanning and remediation and ignoring internal and outside findings about access controls, firewalls, obsolete systems, patches and passwords.

We see the contradiction in the alleged annual assurances: the audits identified missing protection while the certifications told the government it was in place. An employee who saw both could connect what the government paid for with what the contractor delivered.

The Same Security Promise Can Reach Different Contracts

Aerojet’s Equipment Was Allegedly Still in the Box

Aerojet Rocketdyne settled for $9 million after a former employee pursued allegations of undisclosed cybersecurity deficiencies on defense and NASA contracts. The government declined to join the case, and the whistleblower carried it to trial before settlement. The amended complaint alleged that Aerojet answered yes when asked whether it had security equipment even though the equipment remained boxed and disconnected. Other protections allegedly covered only part of the environment presented as protected.

Owning the equipment and protecting the contracted system are different claims. We see the point in the alleged answer: the government asked about security, and the contractor answered with possession. The insider’s knowledge of installation and coverage supplies the missing connection.

Raytheon’s Internal Development System

Raytheon, RTX and Nightwing agreed to pay $8.4 million over alleged missing safeguards and a system security plan for an internal development system used on 29 defense contracts and subcontracts. The alleged conduct preceded Nightwing’s acquisition of the business. The same internal environment could therefore sit behind multiple contract assurances. The former engineering director who brought the case was awarded $1.5 million from the settlement.

The whistleblower’s amended complaint alleged that staff sought an exception to cybersecurity requirements and were refused. It quoted this instruction about what to say instead:

The alleged instruction changed the statement going to the customer. The people responsible for the development system would know what work had actually been done to support it.

Illumina’s Product Security and Honeywell’s Network

Illumina agreed to pay $9.8 million to resolve allegations of cybersecurity deficiencies in genomic-sequencing systems sold to government purchasers. The allegations concerned the security of the product itself. Its whistleblower’s complaint alleged that Illumina certified penetration testing to the government while performing only static scanning, making the promised test and the actual test the comparison.

Honeywell Aerospace agreed to pay $2,042,518 over allegations involving one network and one defense contract. The government alleged that a Honeywell business unit sought payment while that network failed required controls. That narrower scope puts the employee who knows the particular network at the center of the evidence.

An Army Cloud Platform and Alleged Concealment

A criminal indictment announced in December 2025 alleged that a contractor’s senior manager misrepresented the security of a cloud platform used by the Army and other government customers. The indictment charged that the manager concealed missing access controls, logging and monitoring, and instructed others to hide deficiencies during testing and demonstrations. It also alleged false authorization materials intended to obtain and maintain government contracts and operating approvals. The alleged mechanics show why the version demonstrated to an assessor and the system running between assessments can matter to a civil whistleblower’s account.

What Evidence Is Needed to Prove Fraud?

We work with you to connect the contract, the promised system, the statement made about it and the operating records that contradict that statement. A security employee may know which controls were missing, an assessor which environment was tested, and a cloud administrator where the covered information actually lived. Dated findings, remediation commitments and instructions about what to certify can show who understood the difference when the government was asked to award work or pay.

A 2022 study in the International Journal of Management and Humanities compared defense contractors with and without written compliance programs. Its average penalty cost per penalty occurrence was higher among contractors with programs, but that difference was not statistically significant. We look at whether the promised controls worked, rather than treating a written compliance program as proof that they did.

We work with the person who can explain those records and the decisions behind them. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

The CMMC Pause Left Safeguarding Duties in Place

The July 13, 2026 CMMC memorandum suspended the planned November 2026 Phase 2 transition and future milestones pending review. The accompanying acquisition instructions limited the certification requirements during the suspension to contractor self-assessments at Level 1 or Level 2 and expressly preserved the defense safeguarding clause.

The pause left safeguarding duties, including incident reporting and preservation of incident records, in place. For an insider who saw a contractor continue certifying security while ignoring those duties, the contract and the assurance still belong together.

When the Certification Contradicts Your Work

If you know why a defense contractor’s cybersecurity assurance did not match its systems, speak with our whistleblower experts about that assurance. We connect your technical knowledge to the contract and the decisions behind the claim, and build your strongest defense cybersecurity whistleblower case with you. We bring in defense cybersecurity whistleblower lawyers who understand security assessments and government contracts, and remain your partners throughout the case.