Independent risk assessment to determine size, type and likelihood of foreign threat. (Actuaries?) then conventional risk reduction and mitigation strategy development and implementation which includes expansion/update of military. If risk changes then that can flow through. It's a bit trickier than standard insurance company processes, but instead of just putting this kind of risk in the too hard basket (like insurance companies do) actually put the work in to figure it out.