Is the Cybersecurity and Infrastructure Security Agency Failing?

The cybersecurity and infrastructure security agency is probably the most useful federal outfit you’ve never emailed. It’s also standing on unsteady ground right now, and both things can be true in the same breath. So, is the cybersecurity and infrastructure security agency failing? Not quite. It’s strained, short-staffed and led by an acting boss, but its free tools still work. If you skim daily cyber headlines, you’ve seen its name next to emergency orders, outage warnings and a run of acting leaders.

Most people bump into it by accident, usually through a vulnerability alert somebody forwards late on a Friday. What follows is the long version: what the cybersecurity and infrastructure security agency does, what it hands out free, who’s steering it as of late October 2026, and what an ordinary organization should do about all of it.

What the cybersecurity and infrastructure security agency is

The cybersecurity and infrastructure security agency, usually shortened to CISA, is the U.S. government’s civilian cyber defense and critical-infrastructure coordination agency, and it lives inside the Department of Homeland Security. A 2018 law created it, and it grew out of an older DHS directorate that handled the same territory under a clumsier name.

Three jobs sit at the center. It defends the networks of federal civilian departments, the .gov side of government. It helps the owners of power grids, water systems, hospitals, pipelines and banks spot trouble and recover faster, across 16 critical infrastructure sectors. And it works as a switchboard, moving warnings and fixes between government, industry and allied agencies abroad.

Notice what’s missing. Military networks belong to the Pentagon, spying belongs to the intelligence agencies, and chasing criminals belongs to the FBI and Secret Service. The lane of the cybersecurity and infrastructure security agency is defense and coordination, which sounds dull until a regional hospital is locked out of its own patient records.

The word “infrastructure” in the name covers physical risk too, which surprises people. The agency’s Infrastructure Security Division leads work on securing and strengthening the resilience of critical infrastructure. That reaches into chemical sites, crowded public venues and emergency communications, not only code.

My blunt read: the cybersecurity and infrastructure security agency is a coordinator with a handful of sharp tools, not a police force. It can warn, scan, advise, order federal agencies around and publish the names of broken things. It generally can’t compel a private company to do anything, and that gap between expectation and authority explains most of the grumbling you’ll hear.

Is CISA part of DHS?

Yes. The cybersecurity and infrastructure security agency is one of the department’s operating components, so its budget, its big hiring calls and its public fights all run through DHS. The director is appointed by the president and needs the consent of the Senate. That matters more than it sounds, and I’ll come back to it when we get to who’s running things.

The arrangement has a quirk. DHS also covers immigration, the Coast Guard, disaster response and border work, so cyber has to compete for attention in a very crowded house. Observers have pointed at that crowding for years.

For you, as an outsider, the practical upshot is simple. When DHS leadership shifts, the weather around the cybersecurity and infrastructure security agency shifts with it.

Day to day

On a normal Tuesday at the cybersecurity and infrastructure security agency, analysts watch for fresh exploitation, comb through reports from industry partners, and decide what deserves a public alert. Some of those alerts go out jointly with the NSA, the FBI and counterparts in allied countries, which gives them weight a single vendor’s blog post can’t match.

On the federal side, the cybersecurity and infrastructure security agency can issue binding operational directives and emergency directives. Those are orders. When a widely used product is being chewed up by attackers, civilian agencies get a deadline to patch, isolate or unplug it, and they have to report back.

The agency also runs shared tooling for federal networks, sensors and dashboards that let it see across many departments at once. One department’s bad week can become everyone’s early warning.

Then there’s the hands-on layer: incident response help for victims who ask, tabletop exercises, assessments, training, and field staff posted around the country. When the regional offices are fully staffed, those advisors are the part of the cybersecurity and infrastructure security agency you can actually phone. I’d call them the least appreciated asset in the building.

Operational technology keeps climbing the priority list. Water plants, factory floors and pipelines run on equipment never designed to meet the internet, and the cybersecurity and infrastructure security agency has named cybersecurity services for operational technology as a priority as warnings about threats to critical infrastructure pile up.

At the cybersecurity and infrastructure security agency, election security used to be a headline item. A fiscal 2026 budget proposal sought to scale back election security resources, along with infrastructure risk analysis and cyber defense training. What survives of those programs depends on appropriations and on where you live.

The agency also publishes plain-English guidance, including a performance-goals checklist aimed at small and medium-sized businesses. Some of its guidance is dense and some is excellent. Almost none of it gets read by the people who’d benefit most.

What the cybersecurity and infrastructure security agency won’t do: test your network uninvited, clean up your ransomware personally, or regulate most companies. It can send a scan report, connect you with the right humans and publish guidance. After that, the fixing is yours.

KEV, the list to bookmark

If you take one thing from the cybersecurity and infrastructure security agency, take the Known Exploited Vulnerabilities catalog. It was born from a binding directive meant to lower the risk that known exploited flaws pose to federal systems. Federal agencies must fix listed items by set deadlines, usually a matter of weeks.

The size tells the story. At time of writing, the catalog the cybersecurity and infrastructure security agency maintains held 1,748 entries in its 16 October 2026 release. In August, the list amounted to about 0.44% of the roughly 376,000 CVE records in the national database. One pile is a haystack. The other is the small bundle of needles attackers have already used.

The triage logic follows naturally. A severity score tells you how bad a flaw could be. A KEV entry tells you somebody is already using it. When patching time is scarce, the second question tends to win.

Some of what lands there is old. More than half the entries date from 2021 or earlier, and about 39% of the 181 additions in 2026 carried CVE numbers issued before this year, the oldest from 2008. Forgotten internet-facing gear and unpatched appliances keep earning attackers money.

Ransomware crews love this stuff. One tally put 339 entries, roughly a fifth of the catalog, as tied to ransomware campaigns.

Setup takes about twenty minutes. The feed is free and open, published as JSON and CSV files that need no login. Match it against your asset list weekly, patch the hits first, and write down the ones you can’t patch yet along with whatever you did to shield them.

KEV is not a safe-list, though. A flaw missing from it isn’t harmless; it just hasn’t produced reliable exploitation evidence yet. Use it beside exposure data and your own judgment, not instead of them.

Free help most people skip

Few people realize the cybersecurity and infrastructure security agency gives away real services. The best known is Cyber Hygiene scanning, a free scanning program where the agency probes your public-facing, static IPv4 addresses on a loop and sends weekly reports plus ad-hoc alerts. CISA says work typically starts within 72 hours of finished forms, with reports arriving within two weeks.

Eligibility has wobbled over the years, so check the current page before assuming. It has historically served government bodies and critical infrastructure partners, and older FTC guidance described it as open to private businesses too. To start, you email the address on the program page with the subject line “Requesting Cyber Hygiene Services.”

A sibling service looks at web applications. It’s described as delivering detailed monthly reports plus on-demand ones. Here’s the short menu from the cybersecurity and infrastructure security agency, as things stand at time of writing:

Service	Best for	What arrives	How to start
Vulnerability scanning	Anyone with public IP addresses: schools, utilities, clinics	Weekly reports and ad-hoc alerts on exposed services	Email the Cyber Hygiene address with the subject line above
Web application scanning	Teams running public sites or portals	Monthly and on-demand reports	Same request, ask for both
KEV feed	Admins, MSPs, patch owners	A JSON/CSV list of flaws under active attack	Free download, no login
Incident reporting line	Anyone hit by an attack	Triage and coordination	report@cisa.gov or (888) 282-0870

None of this from the cybersecurity and infrastructure security agency replaces a commercial attack-surface tool. What it gives you is a second opinion from a source with no product to sell you, and the price is an email. For a ten-person water district or a county library, that’s a good trade.

Pair the reports with a look at your own insides, because scanners only see what’s reachable from outside. Laptops, vendor access and forgotten cloud accounts sit in the blind spot.

Who runs it right now?

As of October 24, 2026, the cybersecurity and infrastructure security agency has no Senate-confirmed director. Nick Andersen has been acting director since February 26, 2026, stepping up from his post as executive assistant director for cybersecurity after Madhu Gottumukkala moved to a different DHS role.

Andersen’s résumé mixes both worlds. He was president and chief operating officer at the firm Invictus and CISO of Lumen’s public-sector arm, with earlier stints at Energy, the White House, the Coast Guard, the Navy and the State of Vermont.

The road here was bumpy. Bridget Bean held the acting seat from the January 2025 change of administration until May that year, then Gottumukkala, then Andersen. Meanwhile the nominee to lead the cybersecurity and infrastructure security agency, Sean Plankey, was named in March 2025, stalled, was renominated in January 2026 and finally withdrew on 22 April 2026. His own explanation was short: after thirteen months, “the Senate will not confirm me.” He also spoke warmly of Andersen’s competence on the way out.

Stability has been rare for a long while. Chris Krebs, the first director, was terminated in November 2020, an acting stretch followed, and Jen Easterly arrived after a unanimous Senate vote in 2021.

Why care? Because the cybersecurity and infrastructure security agency relies on partnerships across government and critical infrastructure, and the lack of a confirmed leader makes that harder. An acting director can run the place. What gets harder is promising multi-year commitments, calming Congress, or looking a utility CEO in the eye and putting the agency’s weight behind a promise.

A smaller agency, a bigger load

Numbers first, with the caveat that they come from secondary reporting and the agency’s own totals may differ. The workforce at the cybersecurity and infrastructure security agency is reported to have fallen from about 3,300 at the start of 2025 to roughly 2,200, through buyouts, deferred resignations and layoffs.

On money, a fiscal 2026 budget proposal called for nearly $150 million in cuts to cyber operations. A proposal isn’t an appropriation, and Congress rewrites these things, so read the figure as a direction of travel rather than a final tally.

I won’t pretend to settle the argument over whether the cuts were wise. Supporters say a leaner agency can concentrate on its core cyber mission, and agency leaders defended the reductions in public as turmoil built. Critics point to a verdict reported across the aisle and across industry: many on both sides and in the private sector had concluded the cybersecurity and infrastructure security agency was in trouble.

Local governments felt one change sharply. When funding for the Multi-State Information Sharing and Analysis Center ended in fall 2025, many state and local technology and security leaders pointed to that loss as the defining CISA story of that October.

So here’s the working assumption I’d use. The public products of the cybersecurity and infrastructure security agency, the KEV list, advisories and scan reports, will probably keep flowing because they’re cheap to produce and high in value. Its one-on-one attention is the part to treat as a bonus rather than a plan. If your incident response sheet starts with “call the cybersecurity and infrastructure security agency,” add a second line beneath it, perhaps a retainer with some outside security help.

Fewer people also means slower rule-writing, which is exactly what happened to the incident reporting law I’ll turn to next.

CIRCIA and the 72-hour clock

CIRCIA is the 2022 law that will, once its rule takes effect, require covered critical infrastructure companies to tell the cybersecurity and infrastructure security agency about significant cyber incidents. The statute points to a report within 72 hours of reasonably believing a substantial incident occurred, and within 24 hours of making a ransom payment.

The rule is late. Congress set an October 2025 deadline, the cybersecurity and infrastructure security agency pushed it to May 2026 and then to September, and the final rule landed at the White House for review on October 1, 2026. The proposal drew more than a thousand public comments, mostly about who counts as covered, what triggers a report and how it fits with other agencies’ demands.

The scale is big. Estimates run to more than 300,000 entities across 16 sectors. CISA has said it will narrow scope and reduce burden, and the national cyber director has talked up harmonizing the reporting structure across government.

Reporting becomes mandatory only once the final rule takes effect, on dates the rule itself sets. Publication is expected before the end of the year, but the dates in this story have slipped three times, so I’d hold any calendar loosely.

Preparation costs little. Work out whether you’re probably covered by sector, size and function. Decide who can say “we reasonably believe this is substantial,” and how fast. Read your vendor contracts, since a supplier’s incident can start your own clock. The official CIRCIA page from the cybersecurity and infrastructure security agency tracks town halls and updates.

My bet is that the hard part won’t be the 72 hours. It’ll be deciding what counts as substantial when you’re half-asleep at 3 a.m. Write that threshold down now, while you’re calm.

CISA the agency versus CISA the law

Here’s a naming trap that wastes a lot of reading time. The Cybersecurity Information Sharing Act of 2015, shortened to CISA 2015, is a different thing from the cybersecurity and infrastructure security agency. A separate 2018 law created the cybersecurity and infrastructure security agency. The 2015 statute is about legal cover for companies that share threat indicators.

Its life since 2025 has been a string of cliffs. It lapsed when the fiscal year turned on October 1, 2025, got a short reauthorization to January 30, 2026, then an extension to September 30, 2026 in the 2026 appropriations act. The latest stopgap carries it to December 11, 2026, so another cliff looms in about seven weeks.

The common misconception is that a lapse means sharing stops. Not so. Companies kept swapping indicators during the 2025 gap, and one Health-ISAC executive said the lapse had almost no effect on member sharing, though others said the process slowed. What disappears is legal comfort: liability shields, antitrust protection and FOIA exemptions. Lawyers get nervous before engineers do.

Short renewals strike me as a poor way to run a legal framework. At least one security policy leader called them counterproductive to shared defense goals. Planning around a cliff every few months is its own tax.

Reporting an incident

Say ransom notes are sitting on your file server. Where does the call go? report@cisa.gov and (888) 282-0870 are the channels the cybersecurity and infrastructure security agency lists for unusual activity and incidents.

Don’t wait until you understand everything. A rough timeline, the systems touched, any indicators such as file hashes or sender addresses, and whether a ransom was demanded are enough to start. Reports improve through back-and-forth, not through a polished memo three weeks later.

Reporting to the cybersecurity and infrastructure security agency doesn’t replace calling law enforcement, your insurer or your lawyer, and the order depends on your contracts. A one-page sheet with all those numbers, kept somewhere offline, beats any elaborate plan.

Your first alert will most likely come from an employee, not a tool. Regular staff training sessions that teach people to flag odd emails quickly can turn a slow-burn breach into a short report.

What small teams should do now

Here’s what I’d hand a ten-person company or a small county office, in the order I’d tackle it.

Week one: ask the cybersecurity and infrastructure security agency for the scanning service and subscribe to its alert emails. Together they cost nothing and produce a steady trickle of things to fix.

Week two: build a plain inventory of everything touching the internet, every vendor with access to your systems, and everyone holding admin rights. If you want structure, a walk through a risk assessment will help you map your exposure before a scanner does it for you.

Week three: match that inventory against the KEV feed, patch the matches, and write a one-line note for each exception.

Week four: write the incident page. Who calls whom, what gets switched off first, where backups live and who can restore them. Test the restore, because an untested backup is mostly a hope.

None of that depends on who sits in the director’s chair, which is the whole point. The cybersecurity and infrastructure security agency can be a good part of your defense plan, but it shouldn’t be the single load-bearing wall.

Careers around the agency

People ask about jobs because the cybersecurity and infrastructure security agency has been in the news for the wrong reasons. Federal seats are fewer than they were, and hiring has been choppy, so I wouldn’t build a plan that needs a federal offer by spring.

The ecosystem around the cybersecurity and infrastructure security agency hasn’t shrunk the same way. State and local governments, information-sharing groups, utilities, hospitals and the contractors who serve them all consume the output of the cybersecurity and infrastructure security agency and need people who can act on it. Reading an advisory, matching a KEV hit to an asset, and explaining the risk to a non-technical boss is a job description by itself.

Operational technology skills stand out. Few people understand both a programmable controller and a firewall, and if you’re sizing up the security job market, that hybrid is scarce.

FAQs

Is CISA 2015 the same thing as the cybersecurity and infrastructure security agency?
No. One is an information-sharing law from 2015, the other is the agency created by a separate 2018 law.

Can the cybersecurity and infrastructure security agency force a private company to patch something?
Generally no. Binding directives apply to federal civilian agencies; for everyone else it issues guidance, warnings and free tools.

Who is in charge of the cybersecurity and infrastructure security agency today?
At time of writing, Nick Andersen is acting director, and the cybersecurity and infrastructure security agency has no Senate-confirmed director.

Is CIRCIA reporting mandatory yet?
Not yet. The final rule went to White House review on October 1, 2026, and obligations start only on the dates it sets.

Does the cybersecurity and infrastructure security agency charge for scanning and alerts?
No. Cyber Hygiene scanning, the KEV feed and alert subscriptions are free, though scanning eligibility can vary, so check the current program page.

Final Thoughts

Strip away the headlines and the cybersecurity and infrastructure security agency is a fairly modest thing with a fairly large reputation. It’s a coordinating body inside Homeland Security that can scan, warn, advise and tell federal departments what to patch, and it leans on persuasion, relationships and good lists for everything else. When it works, you barely notice. A warning lands a day before the exploit wave, a scan report names the forgotten server, a phone call connects a small utility with someone who has seen this attack before.

Here’s the takeaway version. Take the KEV list seriously, because a short catalog of flaws already being abused is the best patching filter going. Use the free scanning, because the price is one email. Learn the incident reporting number before you need it. Hold the reporting rule loosely, since its date has slipped repeatedly, but start sketching your answer to the 72-hour question anyway.

My perspective, for what it’s worth: treat the cybersecurity and infrastructure security agency like a public utility. You’d keep a flashlight in the drawer even if you trust the power company, and the same instinct applies here. Its public products are cheap to produce and high in value, so they’ll probably keep flowing. Its hands-on attention is thinner than it was, its leadership is still acting, and the 2015 sharing law keeps getting renewed in short bursts. None of that makes it useless. It makes it one layer instead of the whole defense.

There’s also a human point under the policy fights. Behind every advisory sits an analyst who read a hundred noisy reports to find the one that mattered, and behind every unread advisory sits an IT generalist at a school district who never had time to subscribe. The gap between those two people is where most breaches live. Closing it costs less than people think.

So here’s what I’d ask of you. This week, send the scanning request. Today, bookmark the KEV feed and put a weekly reminder on your calendar to compare it against your asset list. This month, write the one-page incident sheet with the reporting contacts, and decide who is allowed to declare an incident substantial. None of it requires a budget meeting. All of it makes the next bad Friday shorter, and the turbulence at the cybersecurity and infrastructure security agency matters a lot less once you’ve stopped waiting on it.