Expanded threat surface requires agencies to move toward higher levels of security