Operations & Intelligence Failures — 2026-03-26
CISA Acting Director Warns Shutdown Driving Up Cyber Risks; Six Threat Hunters Resign in Single Day
CISA Acting Director Nicholas Andersen testified before the House Homeland Security Committee that the DHS shutdown, now in its 40th day, is increasing cyber risks across federal networks and critical infrastructure. Approximately 60% of the agency workforce is furloughed, and CISA has 1,000 vacancies. Six members of a highly technical threat hunting and incident response team resigned in a single day. The agency has been forced into a purely reactive cyber posture, canceling physical and cybersecurity assessments, simulation exercises, stakeholder trainings, and international engagements. Remaining personnel carry out mission-essential functions without pay while facing escalating nation-state and criminal threats.
Analysis
Prior digest reported CISA at 38% staffing; this cycle the acting director testified publicly that the agency is in a purely reactive posture, unable to conduct proactive assessments. The six threat-hunter resignations in a single day represent a loss of specialized talent that takes years to rebuild. The coincidence of CISA degradation with escalating Iranian cyber operations against U.S. healthcare creates a gap where MOIS-linked actors face reduced detection risk.
Prior digest reported CISA at 38% staffing; this cycle the acting director testified publicly that the agency is in a purely reactive posture, unable to conduct proactive assessments. The six threat-hunter resignations in a single day represent a loss of specialized talent that takes years to rebuild. The coincidence of CISA degradation with escalating Iranian cyber operations against U.S. healthcare creates a gap where MOIS-linked actors face reduced detection risk.
1 sources
- CISA Forced Into Reactive Cyber Posture Amid Shutdown -
GovInfoSecurity