The Threat Picture
What the public record shows about who is targeted, and who is left to defend themselves.
The Threat Is Human
Behind nearly every serious loss is a person: a trusted insider, a competitor, a foreign intelligence service, a vendor whose access grew faster than anyone tracked, or someone acting on a grievance. They work through other people, so exposure builds quietly through legitimate-looking channels. By the time the loss is visible, in a competitor's product, a patent filing, a departure, or an incident, it has usually been underway for a long time. Understanding how these people operate is what makes the risk reducible. Fidelis is built to find it earlier, and to close it.
"Much of the battleground we're contesting lies outside the government's control. … None of them are equipped to deal with a threat this complex alone."
FBI Director Christopher Wray, on companies, universities, and local governments · Reagan Library, 31 January 2022
Who Has Counterintelligence, and Who Does Not
The federal government concentrates counterintelligence authority and funding in a defined set of organizations. Everyone else is protected by general security programs and a duty to call the FBI.
Inside the perimeter
Title 50 and Title 10 organizations
The 18 elements of the U.S. Intelligence Community, governed by Title 50, and the military counterintelligence organizations under Title 10. They operate under intelligence authorities set by statute and executive order, with dedicated intelligence funding and trained counterintelligence personnel.
Partial coverage
Departments with an intelligence element, and agencies with their own programs
Departments that house an intelligence element, such as Energy, Homeland Security, State, Treasury, and Justice, where coverage depends on that element's mission and reach. A few agencies, such as NASA, run their own counterintelligence program under agency directive rather than as part of the Intelligence Community.
Outside the perimeter
No statutory counterintelligence program of their own
Most other civilian agencies, state and local governments, universities and research institutes, and most companies. Congress has started to notice: the FY2024 defense bill directed the Director of National Intelligence to seek an agreement to set up an intelligence-community counterintelligence office at the Department of Agriculture, and a 2026 Senate intelligence bill would create one at Commerce, not yet enacted.
When an organization outside the perimeter suspects it is being targeted
1
Something looks wrong
An approach to a researcher, an unusual access request, a data loss, a departing employee.
2
It goes to the FBI
Agencies must advise the FBI immediately when classified information may have been disclosed without authorization to a foreign power or its agent (50 U.S.C. § 3381). Companies and universities may report voluntarily.
3
The FBI weighs it
Against its own priorities and legal thresholds, across every case it carries.
4
The exposure stays yours
Whether or not a case opens, the people, access, and pathways that made you a target are still in place.
That last box is where Fidelis works: inside your own authority, before a referral is needed and after one is made.
Sources: ODNI, Members of the IC · 50 U.S.C. § 3381 · NASA NPR 1660.1C · 50 U.S.C. § 3384 (FY2024 NDAA) · S. 4615, reported May 2026
The Scale of the Threat
2,000+
FBI investigations into Chinese government efforts to steal U.S. information and technology, with a new case about every 12 hours.
Active FBI counterintelligence cases in 2020. Almost half were related to China.
5+ years
How long state-sponsored actors kept footholds inside some U.S. communications, energy, transportation, and water networks.
$17.4M
Average yearly cost of insider risk per organization, up from $16.2M in 2023. 55% of incidents came from negligence or mistakes.
Share of Justice Department cases with a China connection
Economic espionage prosecutions
Trade-secret theft cases
Research and Technology in the Crosshairs
NIH foreign-influence allegations, 2017 to 2024
GAO also noted that agencies must carry out research security without discriminating against scientists by race, ethnicity, or national origin.
200+
Chinese government talent-recruitment plans identified by a Senate investigation, which also found NSF had no dedicated staff to check grant compliance.
Senate Permanent Subcommittee on Investigations, November 2019
8 of 12
At least 8 of the 12 Federal Reserve Banks were represented among 13 persons of interest, and the report cited "a lack of internal counterintelligence competency."
The Coverage Gap
Federal policy requires a certified research-security program only from institutions that receive more than $50 million a year in federal research funding. Institutions below that line, and most companies, face the same kinds of targeting with no such requirement.
National Security Presidential Memorandum 33 (2021) and OSTP research-security guidelines (2024). Bar widths are illustrative.
A Timeline of the Public Record
2009.A former aerospace engineer becomes the first person convicted at trial under the Economic Espionage Act, and is later sentenced to more than 15 years.
2011.Executive Order 13587 requires insider-threat programs at agencies with classified networks. It does not reach companies or universities.
2015.The OPM breach exposes background-investigation records on 21.5 million people and 5.6 million fingerprint sets.
2016 and 2018.Thefts of inbred corn seed and engineered rice seed from U.S. companies end in prison sentences of 36 and 121 months.
2019.A Senate investigation documents more than 200 foreign talent-recruitment plans aimed at U.S. research.
2020.The SolarWinds intrusion reaches email at 27 U.S. Attorneys' offices.
2021.A Senate Commerce Committee report finds abuse of authority, mismanagement, and reprisal in a Commerce Department security unit.
2022.The FBI Director says companies and universities are not equipped to face the threat alone.
2023.One cloud-email intrusion reaches the mailboxes of 22 organizations and more than 500 individuals.
2024.A single spear-phishing campaign is charged for targeting NASA, the military, research universities, and private aerospace companies.
2026.GAO reports China was involved in 570 of 657 NIH foreign-influence allegations reviewed since 2017.
None of the targets in this record is an intelligence agency. Helping organizations like these see the human pathway early is the work Fidelis does.