“The admission that a critical strategic risk was 'underestimated' implies a failure of foresight and potential security vulnerabilities.”