“many companies in the private sector and federal and state government agencies remain rife with vulnerabilities that Russian actors can find and exploit.”