AnalysisPlankey's withdrawal puts CISA under acting-only leadership during the active Iran-war cyber posture, with
Salt Typhoon persisting against US telecoms,
MuddyWater expanding through commercial MaaS, and the agency operationally asymmetric to allied services (British NCSC, Canadian CSE, Australian
ASD) that route wartime threat coordination through confirmed political principals. The cause is dual-extrinsic: Scott's hold traces to Coast Guard cutter procurement and Wyden's to CISA's withholding of a telecom-vulnerabilities report, neither a judgment on Plankey's cyber fitness. Plankey's Coast Guard departure last month did not move Scott, signaling the hold is strategic leverage rather than a vettable objection, and any like-credentialed replacement inherits the same holds. A Senate-confirmed director is
very likely still absent within 30 days. The 13-month stall, a third of the workforce gone since January 2025, and two acting directors inside twelve months together describe an agency whose inputs to NSC cyber deliberations travel through an acting director without independent stature. The alternative reading that Andersen's steady tenure makes this a lower-order problem is weakened by the workforce loss he inherited.