A recent Air Force contract to help screen small businesses applying for federal research funding reflects a growing national security concern: foreign access to American innovation.
Screening applicants is one part of that challenge. Protecting the technology those companies develop is another.
Startups are part of great power competition, even when their founders do not see themselves that way. Some of the technology the military may rely on over the next decade is being developed by small teams working on specialized components, software and materials.
Consider a hypothetical eleven-person quantum sensing startup, a team writing drone autonomy software for GPS-denied environments, or three researchers prototyping a radiation-hardened chip. None is building an entire weapons system. Each could hold a piece of technology valuable to a foreign intelligence service.
An adversary does not have to steal a complete system to benefit. Access to a component design, source code or test results could help it understand a capability, accelerate its own development or identify a weakness.
Intelligence officials have publicly warned about this exposure. At a Five Eyes gathering in California in October 2023, British intelligence officials warned that espionage increasingly targets startups, university research and people who may not think national security concerns them.
Small companies can face difficult tradeoffs. They need to recruit employees, attract investment and demonstrate products, often with limited resources for security. Those activities require sharing information with people outside the organization. An investor meeting, a product demonstration or a contractor’s network access can create an opportunity for collection if identities, permissions and requests are not adequately checked.
Companies developing sensitive technology need a way to evaluate those relationships without bringing their work to a halt.
Government and industry also operate across different information environments. Classified government work requires approved systems and facilities. A startup’s unclassified research may instead be discussed through commercial email, chat and document-sharing services.
Unclassified does not mean inconsequential. Individually modest details can become revealing when combined. In a hypothetical project, test results in one channel, a product roadmap in another and an integration schedule in a third could collectively reveal a capability’s maturity, expected delivery date or technical limitations.
A documented attack shows how collaboration services can become a route to sensitive information. In August 2023, a technology provider reported that a threat actor used previously compromised cloud accounts belonging to small businesses to send workplace messages impersonating technical support. The report described attempts to steal credentials by persuading users to approve authentication prompts. It identified the actor as a Russia-based group attributed by the U.S. and U.K. governments to Russia’s foreign intelligence service.
That report did not establish that the compromised businesses were startups or that the targets were larger companies. It did illustrate how an attacker could use a compromised business account to make an approach appear legitimate.
The lesson extends beyond any one platform: identity, access and account security matter wherever organizations collaborate.
Defense-related information can pass through a government program office, a prime contractor, a small technology company and a specialist supplier. Every transfer creates another point at which access must be managed.
Imagine a specification shared with a supplier and then uploaded to a folder used by outside contractors. Whether that transfer is appropriate depends on the information, the applicable requirements, the system’s configuration and who has access. Security depends on those decisions at each stage, alongside the protections maintained by the organization that created the file.
Commercial collaboration tools require security controls, configurations and usage policies appropriate to the information being shared. Different products and service offerings support different uses. A familiar interface or an encrypted connection does not, by itself, establish that a particular system is authorized or suitable for a particular defense project.
A March 2025 incident offered a separate example of the risks surrounding sensitive communications. A news organization reported that one of its journalists had inadvertently been included in a messaging group in which senior U.S. officials discussed impending strikes in Yemen. The incident illustrated the consequences of including an unintended participant in a sensitive discussion. It did not, by itself, demonstrate a failure of the messaging service’s encryption.
For startups, the practical challenge is to make appropriate security workable in everyday operations. Employees need clear rules about where information belongs, how to verify outside participants and when to escalate an unusual request. Organizations also need to manage guest access, review permissions and remove access when a relationship ends.
As AI capabilities develop and organizations prepare for future quantum computing risks, security requirements will continue to evolve. New tools may help. So can better use of existing capabilities, stronger account protections and clearer responsibility for information shared between companies.
Screening who receives federal funding is a useful first step. Protecting the intellectual property developed afterward requires sustained attention throughout a project and its supplier relationships.
The next theft of sensitive military technology could begin with a compromised collaboration account or an improperly managed guest invitation at a small supplier. Protecting that point of access deserves attention alongside the defenses surrounding the largest contractors.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
