none of the agencies we tested had adequate systems or processes in place to detect, manage or
appropriately respond to a cyber attack. only one agency detected our attacks. The failure of most
agencies to detect our attacks was a particular concern given that the tools and methods we used in
our tests were unsophisticated.