Nobody Had to Defend It

The Office of Personnel Management launched something in 2023 that sounded like an answer to a real problem. One place to see the federal government's cybersecurity workforce, every agency at once, so that any one of them could hold its own numbers up against the rest and plan from there.¹ The government has been short of cyber and IT people for years. The Office of Management and Budget and the Office of the National Cyber Director have both put that in writing, and so has GAO.¹ A shared view of who works where is a sensible thing to build.

Three years on, auditors from the Government Accountability Office took six agencies, picked at random and sorted into three tiers by what they had spent on IT in fiscal year 2025, and asked whether they were using it.¹

Five said no. OPM, which administers the dashboard, also said no.¹ The General Services Administration was the one agency using it, mostly for workforce planning.¹ All six described limitations, including access, functionality, communications with OPM, and the data itself.¹ Almost twenty other federal agencies have access to it. OPM does not know whether any of them open it, and had not asked them for feedback.¹

Nobody had to defend it

The sentence that explains how this went on for three years is about money. OPM officials told the auditors that the funds spent on the effort since its inception were minimal, and that it was therefore not covered by a separate budget line item. They did not have an estimate of exact costs, or of future planned costs.¹

Something with no line item never reaches the meeting where lines get examined. Nothing is being concealed here. There is simply no row carrying its name, and so no yearly moment when a person has to say what it returned against what it consumed. The dashboard did not survive three years of non-use because somebody fought for it. It survived because nothing ever asked.

Carrying on costs nobody a decision. Stopping requires a person who owns that decision, and most organizations have never named one.

That asymmetry does more damage than any individual bad call. A leader who approves something is visible and on the record. The same leader who lets something continue is doing nothing at all, which is why it never feels like a choice that was made. Strip the procedural wording from GAO's recommendation and it comes down to finding out who uses the thing, asking agencies what is wrong with it, working out what it costs, and then deciding to either terminate it or keep offering it with improvements.¹ An auditor had to formally recommend that a decision be reached. OPM partially concurred, and said it would determine what actions, if any, are appropriate.¹

The same arithmetic outside government

Zylo sells software for managing software subscriptions, so it has an interest in there being waste to find. With that noted, its annual index draws on more than 40 million SaaS licenses and 75 billion dollars in spend under management, and the 2026 edition, released at the end of January, reports that organizations leave an average of 36 percent of their licenses unused.²

Renewal is where a number like that comes from. The first purchase required a business case with somebody's name attached to it. The renewal arrives as an invoice, and an invoice does not ask anything. Paying it is the path that requires nobody to convene anyone. After a few cycles the tool has stopped being a decision that anybody remembers making.

Where the stop decision should live

I have sat through enough portfolio reviews to recognise what is missing from the agenda. Nearly everything on it is something somebody wants to begin. New initiatives get scored and argued over, sometimes for hours. What is already running passes through as context, a list of things that are simply true, and then the room moves on to the interesting part. Stopping has no champion in that meeting, because stopping produces nothing anyone can point to at the end of the quarter.

A few weeks ago I wrote about a cost field at Special Operations Command that no program office was obliged to refresh, and how a figure that has not moved can read as a figure under control. What happened at OPM is that same absence one step earlier. There the policy said to keep the data current and never said how often. Here nobody was ever handed the question of whether the thing should exist.

What closes the gap is smaller than a governance framework and considerably more awkward to run. Every tool, report, dashboard, ceremony and standing meeting gets a named owner and a date on which that owner answers two questions in front of people: who actually used this in the last year, and what would break if it stopped. Whether it should exist at all is a different question from how well it is performing, and the second one gets asked constantly while the first almost never does. The date matters more than the format. Without a date the question stays permanently available and permanently not urgent.

OPM built a dashboard so that agencies could make workforce decisions from evidence, and three years later could not say what it had cost or who was using it. The instrument itself was never the problem. What was missing sat one level above it, in the absence of anyone whose job was to ask whether it still earned its place.

Pick the thing in your own organization that everybody assumes somebody else is getting value from. A report that goes out every Monday morning. A tool with a renewal date coming up. A meeting that has been on the calendar since before you arrived. Who is the person who could end it? If that takes you more than a moment to answer, you already have your answer.