Technology & OSINT — 2026-03-21

CISA Acting Director Says No Iranian Cyber Uptick — Contradicting Unit 42 Assessment

CISA Acting Director Andersen stated the agency has not observed increased Iranian cyber threat activity, directly contradicting Unit 42's documented 'Electronic Operations Room' with multiple Iranian-aligned groups claiming destructive operations since February 28. CISA is simultaneously investigating the Stryker cyberattack attributed to a pro-Tehran group. The divergence likely reflects CISA's 38% staffing degrading sensor coverage rather than a genuine analytic disagreement.

Analysis
Prior IC briefs tracked CISA's staffing crisis (38% capacity) and cybersecurity division leadership departure. The contradiction with Unit 42's assessment may not reflect a genuine analytic disagreement; CISA may simply lack the sensor coverage and analyst capacity to detect what private-sector threat intelligence firms are observing at scale.