CISA in Disarray Amid Shutdown and Growing Political Threats

The next major cyberattack could slip past unobserved and unstopped by the U.S. cyber defense agency, where political and operational pressures exacerbated by a hostile White House have led to veteran staff departing in droves, functions being shuttered and state partners scrambling for support.

See Also: Use Cases: Censys for Federal Agencies

Current and former insiders at the Cybersecurity and Infrastructure Security Agency say the agency’s ability to carry out its mission and core duties has been fundamentally weakened during the first nine months of the Trump administration. A government shutdown and the likelihood of further staff reductions have exacerbated already fraying conditions, they say.

Only about 35% of CISA staffers who were working in January are still on the job, and as many as hundreds of those employees have been reassigned to other missions throughout the Department of Homeland Security such as immigration enforcement. Former officials describe those reassignments as unprecedented and say the constant shakeups are causing staff and outside partners who rely on CISA for guidance to question the agency’s long-term stability and future as a central force in U.S. cybersecurity.

“It’s one thing to lose capacity. It’s another thing entirely to lose capability – that’s the risk we’re facing now,” said Nitin Natarajan, former deputy director of CISA. “Once you lose skills and talent, you lose operational capability that’s hard to rebuild.”

At its peak, CISA grew to more than 3,300 employees prior to Trump taking office in January. Trump signed in 2018 the legislation establishing CISA as a stand-alone agency with Homeland Security Department, tasking it with defending federal networks and supporting critical infrastructure sectors cyber defense efforts. Initially viewed as apolitical and mission-driven, the agency became a lightning rod for political scrutiny after its first director, Chris Krebs, affirmed the 2020 election was “the most secure in American history,” in direct contradiction to Trump’s false voter fraud claims.

That scrutiny has hardened into right-wing narratives accusing CISA of censoring conservative viewpoints on social media – claims that gained mainstream traction as Republicans regained control of Congress and figures like Sen. Rand Paul, R-Ky., began escalating efforts to rein in or dismantle the agency entirely. CISA has suffered heavy attrition: internal and public reporting indicate roughly 1,000 employees have left under the Trump administration. CISA staffers tell Information Security Media Group many are actively pursuing roles at private sector firms like Palantir, Google, Amazon and others, where higher pay, stability and mission continuity appear far more certain (see: CISA Cuts Expose US Critical Infrastructure to New Threats).

The government shutdown, which appeared to be heading into another week of stalled negotiations on Capitol Hill, has taken CISA’s erosion and turned it into a rapidly worsening operational collapse, according to current and former staffers, with key programs halted and virtually all policy engagement frozen between federal and state cyber offices (see: State Cyber Teams Brace for Impact of US Government Shutdown
). The timing of the federal closure, coinciding with the lapse of the Cybersecurity Information Sharing Act of 2015 and the expiration of funding for state cybersecurity grants, is making an already bad situation far worse, according to Michael Daniel, president of the Cyber Threat Alliance and former White House cybersecurity coordinator.

“Every federal agency can find efficiencies, [but] the magnitude of the staff and funding cuts at CISA mean that it will have to stop some missions and activities entirely,” Daniel said, adding that the agency “will have to reduce the scope and scale of its missions” to cope with continued staffing and funding challenges.

“These changes increase the likelihood that a problem will be missed or overlooked, and they will make marshaling the capability to respond to significant incidents harder,” he added.

Current and former CISA officials describe a scattered and turbulent reality within the agency, with some outside personnel pulled into cybersecurity units from other DHS components while skilled staffers are shunted to non-cyber missions. The internal swapping and reassignment practices, they say, are largely unprecedented – and causing confusion over who actually holds institutional ownership of critical cyber programs and who remains accountable when threats materialize.

“I can count on one hand the number of directed reassignments we approved – and they always involved consultation and planning with the employee,” said one former senior CISA official who requested anonymity to discuss internal operations. Recent reassignments impacting agency personnel have often come in the form of surprise emails informing workers of a mandatory reassignment that could involve moving across the country, the former official said.

“Telling someone they have to uproot their lives and move across the country or lose their job – that’s not standard practice,” the official added.

For many inside the agency, uncertainty overshadows the mission itself. Current staffers describe weeks without guidance from leadership, paused outreach to industry and states and worsening communication throughout the shutdown on how and why decisions are being made. Current CISA staffers also describe a changing internal landscape where many people who stayed now assume dual responsibilities or stretch across unfamiliar roles, leading to competency gaps and inadequate oversight.

Outside Washington, states and local governments are increasingly relying on information sharing and analysis centers and private firms to fill the gap. State chief information security officers and their offices say they are exploring expanding contracts with vendors and regional cyber alliances once supported by CISA grants to maintain information sharing.

DHS Assistant Secretary Tricia McLaughlin pushed back against ISMG’s reporting in a statement, claiming the department “routinely aligns personnel to meet mission priorities while ensuring continuity across all core mission areas.” She described suggestions that the agency may be unprepared to handle threats due to ongoing realignments as “ludicrous” and attacked “the abject failure” of CISA under the previous White House administration.

“CISA was adrift and was focused on censorship, branding and electioneering instead of defending America’s critical infrastructure,” McLaughlin said. She added that the agency is now “focused squarely on executing its statutory mission,” including “supporting federal, state and local partners, and defending against both nation-state and criminal cyber threats.”

Lawmakers grappling with how to move forward on shoring up the nation’s cyber defenses as the shutdown drags on. Sen. Gary Peters, D-Mich., ranking Democrat on the Senate Homeland Security and Governmental Affairs Committee, introduced a bill this week to reauthorize CISA 2015 for another 10 years that would also retroactively cover the lapse of the bill.

“Without these protections in place, we are [in an] incredibly vulnerable position,” the senator told reporters on Capitol Hill shortly after introducing the new bill. “I believe that our national and economic security are at risk for as long as these safeguards are not available.”

Even if Congress strikes a deal in the days ahead to reauthorize the cyber threat sharing law or reopen the federal government, experts say the deeper question facing the nation’s cybersecurity posture is whether CISA can recover from the political, structural and workforce upheaval. Current and former officials say the agency’s digital defense capabilities have been both tested and weakened by the ongoing exodus of skilled staff, partisan infighting and months of operational paralysis – with no clear end in sight.

“No one really expects CISA to survive these next four years – at least, not like this,” said one staffer who requested anonymity to discuss internal operations. “If it does, it will be an entirely different agency with a very different mission.”