IC Workforce & Operational Posture — 2026-03-26

CISA Acting Director Warns Congress Compounding Risk Will Cause Real Damage as Six Threat Hunters Resign in Single Day

CISA Acting Director Nick Andersen testified to Congress March 26 that the DHS shutdown is creating compounding systemic risk, warning that at some point the dynamic threat landscape is going to cause real damage to the American people. He disclosed that six members of a highly technical threat hunting and incident response team submitted their resignations in a single day. The agency has delayed binding operational directives, reduced coordination with industry partners, and constrained incident response capacity. Andersen flagged specific risks ahead of America 250 and the FIFA World Cup, noting that 60% of the workforce remains furloughed with 1,000 vacancies. The CIRCIA cyber incident reporting final rule, originally due in May, will likely be further delayed.

Analysis
Three independent outlets, MeriTalk, SC Media, and BankInfoSecurity, each covered Andersen's House Homeland Security Committee testimony and corroborate the same workforce figures, resignation details, and operational constraints, producing a high-confidence factual foundation. Andersen's flagging of America 250 and the FIFA World Cup reflects standard threat calculus: high-visibility events with fixed timelines create targeting windows that adversaries plan against months in advance, and degraded defensive posture cannot be surged back to full capability overnight. The CIRCIA final rule delay removes the incoming mandatory reporting framework precisely when visibility into critical infrastructure incidents matters most. The six same-day threat-hunter resignations signal accelerating brain drain; losing offensive-trained incident responders represents irreplaceable capability loss that cannot be backfilled on short timelines.

3 sources

CISA Loses Workers as DHS Shutdown Drags On, Acting Director Says - MeriTalk
Cyber risks against US escalate amid DHS shutdown, says CISA official - SC Media
CISA Forced Into Reactive Cyber Posture Amid Shutdown - BankInfoSecurity