Eight months into the second Trump administration, the nation’s cybersecurity posture appears to be in a state of profound disarray, raising alarm bells among experts and former officials.
What’s most striking isn’t just the challenges, but the gaping voids: a significant portion of the Cybersecurity & Infrastructure Security Agency’s (CISA) workforce has vanished, the agency remains without a permanent leader, and a chilling silence hangs over the administration’s controversial treatment of its two previous directors.
This turmoil unfolds against a backdrop of relentlessly escalating digital threats, with sophisticated state-sponsored actors from China and North Korea routinely breaching critical U.S. systems.
The immediate implications are stark.
CISA, ostensibly America’s premier cyber defense agency, is bleeding talent at an alarming rate.
In June, reports indicated that one-third of its workforce had already departed.
The situation has been further exacerbated by a government shutdown, forcing another third of the remaining employees to work without pay, while the rest are furloughed.
This exodus marks a dramatic reversal from the first Trump administration, which actually launched CISA, albeit with its own share of turbulence.
“Sure, there was some upheaval, but nothing like this administration,” observes Katie Moussouris, CEO of the bug-bounty firm Luta Security, underscoring the unprecedented nature of the current crisis.
The agency also finds itself adrift without a Senate-confirmed director.
President Trump’s nominee, Sean Plankey, remains stalled due to a hold placed by Senator Ron Wyden, who demands the release of a 2022 report on U.S. telecom network security.
Yet, the President’s attention seems less focused on securing a leader for CISA than on a campaign against its former occupants.
The fates of Jen Easterly, who led CISA under President Biden, and Chris Krebs, Trump’s own appointee and the agency’s first director, serve as potent warnings.
Krebs was famously fired in November 2020 for publicly defending the integrity of that year’s election.
More recently, in April, Trump ordered agencies to revoke Krebs’ security clearances and launch investigations into him and his employer, the security firm SentinelOne.
Krebs, a decorated veteran, resigned from his post at SentinelOne a week later, stating he needed to confront the fight “fully – outside of SentinelOne.”
Similarly, Easterly’s appointment to a temporary department chair at West Point was rescinded in July following complaints from extremist influencer Laura Loomer.
“When outrage is weaponized and truth discarded, it tears at the fabric of unity and undermines the very ethos that draws brave young men and women to serve and sacrifice,” Easterly, a West Point graduate herself, wrote in a poignant LinkedIn post.
This weaponization of outrage and the targeting of career professionals have deeply troubled cybersecurity experts.
“It’s going to make it harder for career professionals to want to move into the federal government space,” Moussouris warns.
“It’s going to make it harder for those folks coming out of government to be hired by private industry.”
The chilling effect on recruiting and retaining top talent in a field already facing severe shortages could have long-lasting consequences for national security.
Beyond CISA’s internal struggles, the administration has systematically dismantled other critical cyber defenses.
The Cyber Safety Review Board (CSRB), an investigatory body modeled on the National Transportation Safety Board, saw its members dismissed.
Steven Bellovin, a computer-science professor at Columbia University with extensive government advisory experience, decries this as petty, noting, “Of course they did—it was a Biden initiative.”
Federal funding for a widely consulted database of security vulnerabilities narrowly avoided termination.
These actions paint a grimmer picture than many security experts had predicted, even anticipating a possible Trump victory.
“I did not think they were going to break with norms as much as they have in this administration,” Moussouris admits, voicing a widespread concern that “our adversaries are having a field day.”
Ari Schwartz, executive director of the Center for Cybersecurity Policy and Law and a former National Security Council senior director for cyber, echoes this sentiment, lamenting the loss of experienced talent: “They lost some people that have been there a long time.
They lost some people who are really, really good.
And it’s the nation’s loss.”
Schwartz also points to the administration’s foreign policy as an impediment to vital international cooperation in cybersecurity.
The agency’s public profile has also diminished.
At the annual Black Hat conference in Las Vegas, a major gathering for security professionals, CISA representatives were relegated to side stages, a stark contrast to the previous year when Jen Easterly delivered the opening keynote.
When questioned about the administration’s treatment of Krebs and Easterly and its implications for dissenting views, CISA’s public affairs director, Marci McCarthy, offered a terse “That would be a question for President Trump.”
The looming threats are not just theoretical.
Future crises could manifest as further penetrations of corporate or government networks, or attacks on less-defended but critical infrastructure like sewer and water systems.
Furthermore, the administration itself has created new, vulnerable targets through initiatives like its DOGE government-disruption project and the extensive data compiled during its crackdown on undocumented immigrants, both of which raise serious security questions.
Amidst this landscape of concern, some experts cautiously point to minor reasons for optimism.
Schwartz highlights Trump’s choice of Sean Cairncross as national cyber director, describing him as a “good manager.”
Moussouris commends the administration’s stance against Britain’s demand that Apple compromise end-to-end encryption for iCloud backups, a battle in which Washington ultimately prevailed.
“Whoever is giving them advice on that particular policy matter has it dead right,” she notes.
These isolated positives, however, do little to assuage the overarching anxiety.
Schwartz stresses the urgent need for Congress to renew the 2015 law offering legal protection to companies for sharing threat data, a statute that was allowed to expire in September.
This, along with resolving the government shutdown, remains a critical unresolved issue.
Moussouris’s advice to current cybersecurity leaders in the administration is pointed: “Listen to the technologists.
Go beyond the scope of whatever policy agenda has been given to you.”
It is a plea for pragmatism and expertise to rise above the political fray, for the sake of a nation increasingly vulnerable in the digital realm.
The fabric of America’s cyber defense, it seems, is being stretched to its breaking point.
New research highlights how opportunistic infostealer malware is exploiting browser-based password managers to compromise corporate credentials at an unprecedented scale.
A new strategic partnership aims to overhaul space-based encryption hardware to support the high-speed data demands of modern military satellite networks.
Commercial data networks have become a critical vulnerability for military personnel as foreign adversaries exploit real-time bidding for intelligence.
