In recent years, the U.S. government has intensified its efforts to hold companies accountable for cybersecurity failures, underscored by high-profile cases such as the prosecution of Uber’s former security chief, Joseph Sullivan, and the fallout from the SolarWinds breach. These actions send a strong message: American businesses entrusted with sensitive data must meet rigorous security standards. However, this new reality leaves many companies, especially small to mid-sized enterprises, in a precarious position, caught between the high costs of robust cybersecurity measures and the severe penalties for any perceived lapses.

The federal government’s application of the False Claims Act to cybersecurity violations is an unprecedented shift. Traditionally reserved for fraud in areas like healthcare and defense contracting, the False Claims Act is now being wielded to address cybersecurity. The Justice Department’s recent Civil Cyber-Fraud Initiative, targeting contractors who fail to meet security standards in federal engagements, is a striking example. In one recent case, a tech CEO faces indictment for falsely certifying compliance with federal cybersecurity mandates to secure government contracts. The message is clear: cybersecurity lapses are no longer merely technical problems—they’re legal liabilities.

While accountability is essential to protect sensitive government and consumer data, overly punitive measures may inadvertently threaten the competitiveness and innovation of American businesses, particularly emerging tech firms that lack the resources of industry giants. The financial and legal burdens of compliance could stifle growth and deter companies from pursuing federal contracts, fearing they lack the means to meet stringent standards. For many smaller firms, walking away from federal work altogether may seem preferable to risking crippling legal or financial repercussions. This reduction in the pool of innovative vendors could limit the government’s access to cutting-edge technology, weakening both national security and economic vitality.

Moreover, the tightening of cybersecurity standards has led to soaring cyber insurance premiums, adding yet another layer of cost for businesses. Marsh & McLennan reported that cyber insurance premiums rose by an average of 28% in 2023, with increases reaching up to 40% in high-risk sectors. As a result, many companies find themselves either underinsured or entirely uninsured, exposing them to catastrophic financial consequences should a breach occur. The combination of escalating insurance costs, strict regulatory requirements, and legal liabilities creates an environment where cybersecurity compliance becomes a near-existential challenge for many firms.

The case of SolarWinds underscores this dilemma. In 2020, a sophisticated cyberattack, widely attributed to Russian state actors, compromised several federal agencies and thousands of private organizations. The attack cost SolarWinds an estimated $25 million in direct expenses, not to mention the lasting damage to its reputation and client base. SolarWinds now stands as a cautionary tale, illustrating how cybersecurity breaches can devastate a company, regardless of its resources. This reality calls for a more collaborative approach, where the government works with the private sector to share intelligence, support threat response efforts, and ease the financial burden on companies that fall victim to nation-state attacks.

The Uber case provides another perspective on the complexities of cybersecurity in corporate America. Sullivan’s prosecution, tied to his alleged efforts to pay off hackers and keep a breach quiet, has had a chilling effect on executives responsible for corporate security. Many security leaders are now left wondering where the line lies between crisis management and criminal liability. This gray area demands clear guidance and legal protections so that executives aren’t penalized for doing their best to navigate the immediate aftermath of a cyberattack.

The U.S. government must balance accountability with practical support to foster a more secure digital landscape. Standardized cybersecurity guidelines would reduce ambiguity and enable companies to build effective, compliant security systems without the looming fear of unexpected legal repercussions. These guidelines should be tailored, with minimum requirements based on the sensitivity of the data handled and access to federal systems, so that smaller companies aren’t forced into compliance frameworks designed for the largest contractors.

Incentives could also play a significant role. Tax breaks, grants, and low-interest loans would encourage companies to invest in cybersecurity infrastructure without sacrificing financial stability. This approach has proven effective in other sectors, like renewable energy, where government incentives sparked substantial private investment and accelerated growth. Such a model would allow more companies to meet federal standards, reducing vulnerabilities across the board.

Additionally, legal safe harbors are necessary to encourage transparency. Companies that demonstrate a good-faith effort to comply with federal standards should be shielded from punitive actions when they experience a breach. By offering this “safe harbor” protection, the government could foster a culture of openness, where companies report incidents promptly without the fear of ruinous litigation hanging over their heads.

The government must also take a more active role in sharing threat intelligence. Cyber threats are complex, adaptive, and often state-sponsored. By strengthening public-private partnerships and establishing a centralized platform for real-time threat intelligence, companies could respond more swiftly and effectively to emerging threats. Collaboration between agencies and private firms would allow for a collective defense strategy, strengthening the national cybersecurity posture from the ground up.

Lastly, cybersecurity insurance reform could stabilize the market and make coverage more accessible. A federal backstop for cyber insurance, similar to the Terrorism Risk Insurance Act, would protect companies facing massive, state-level cyberattacks. This approach could help stabilize premiums and provide businesses with a safety net, especially those in high-risk sectors that cannot afford surging insurance costs.

As the U.S. government seeks to secure its digital assets, it must ensure that cybersecurity compliance is a feasible goal for all companies, not just the largest players. Implementing policies that provide clarity, financial support, and shared responsibility will not only protect national security but also foster a resilient economy. Without such measures, we risk driving small and innovative firms away from federal work, ultimately undermining both national security and economic competitiveness.

For America to remain a global leader in technology and security, it needs an approach that recognizes the realities faced by today’s businesses. Holding companies accountable is vital, but we must also provide pathways for compliance that enable firms of all sizes to participate in securing our nation’s digital frontier.

About the Author

Rick de la Torre

Senior Operations Officer CIA (Retired) US State Dept. Foreign Service Officer. Corporate Leader Skilled in Business Planning, Operations Management, Market Research, Risk Management. Strong community and social services professional with a Bachelor of Business Administration (BBA) focused in International Business from Florida International University.