Technology & OSINT — 2026-03-20

CISA Operating at 38% Staffing as Iran Cyber Operations Surge

Unit 42's threat brief documents Iran deploying decentralized cyber operations targeting U.S. critical infrastructure during the active conflict, while CISA -- the primary federal coordination point for cyber defense -- operates at 38% staffing after losing over 1,000 employees to RIFs and buyouts. The agency has eliminated its Election Security Program and cut $84M in programs including Cyber Defense Education and Training.

Analysis
Prior brief noted CISA at 38% staffing. Unit 42's threat brief adds operational context: Iran's cyber operations have shifted to decentralized models specifically designed to overwhelm understaffed defenders. The 03-19 brief reported CISA generated advisories on 136 CVEs targeted by Iranian actors across 3,100+ entities -- intelligence the agency cannot operationalize at current capacity.