Loading story…
Reporting indicates personnel and access-policy changes in US federal cyber and science institutions that could affect national cybersecurity strategy development and research capacity. A senior National Security Council (NSC) cybersecurity policy official, JD Work, reportedly left the White House and returned to teaching at the National Defense University; sources cited uncertainty about the reasons, including leadership denying an extension request. The departure was described as part of broader staffing churn in the NSC cyber directorate as it works with the Office of the National Cyber Director on a forthcoming national cyber strategy and a more hardened approach to offensive cyber policy.
Separately, lawmakers and sources told WIRED that NIST has begun taking steps that could limit foreign-born researchers’ ability to work at the agency, including reported time limits for international graduate students and postdoctoral researchers—changes that lawmakers warned could reduce expertise and harm credibility. While NIST’s work underpins widely used cybersecurity frameworks and guidance (including AI security guidelines), the other items in this set were general security commentary (OT lab security, board engagement, and compliance vs. security) and did not report a specific incident, vulnerability, or threat activity tied to the NSC/NIST developments.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
As of late February 2026, officials were expected to be coordinating a forthcoming national cyber strategy between the NSC and the White House Office of the National Cyber Director. The strategy may include a framework for offensive cyber operations.
After leaving the NSC, JD Work returned to academia, resuming teaching at the National Defense University’s College of Information and Cyberspace. The move was reported as part of broader staffing changes affecting the NSC cyber team.
Earlier in February 2026, JD Work departed his position as a top cybersecurity policy official at the National Security Council. According to anonymous sources, the reasons for his exit were not confirmed, though one source said leadership denied a request to extend his time at the NSC.
JD Work joined the U.S. National Security Council about a year before his reported departure, serving under senior cybersecurity director Alexei Bulazel. His role placed him within the team shaping White House cyber policy.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Senior officials at **NIST** said significant workforce and budget reductions are forcing the agency to narrow and reprioritize work tied to national security and cybersecurity, including mandates related to **AI**, **cybersecurity**, and **post-quantum encryption**. NIST’s Information Technology Laboratory reported losing roughly **89 staff** over the past year (within a headcount of 289), amid broader agency reductions of **700+ positions**, and warned that additional congressional cuts (including a proposed **$13M** reduction to NIST’s labs program) could further constrain technical programs such as cryptographic testing and validation used for federal procurement and joint validation efforts with the Canadian Centre for Cybersecurity. On Capitol Hill, House Homeland Security Committee Democrats pressed **CISA** Acting Director **Madhu Gottumukkala** on major workforce reductions—reported as about **one-third of the agency’s employees** departing over the past 12 months—and whether the agency can sustain its mission under current funding and staffing levels. Gottumukkala defended the reductions as part of a “mission-first” effort to eliminate duplication and align work to statutory authorities, while also signaling **targeted hiring** for key roles but declining to provide lawmakers a clear vacancy count or a definitive answer on whether recently appropriated DHS funding is sufficient for CISA to execute its responsibilities.
Jun 29, 2026
US national security officials and lawmakers are weighing the future of key cyber and intelligence authorities and leadership posts. Lt. Gen. Josh Rudd, nominated to lead **NSA** and co-lead **U.S. Cyber Command**, told the Senate Intelligence Committee he supports **FISA Section 702**, arguing the foreign-intelligence collection authority is “indispensable” for threat insight and has “saved lives,” even as critics continue to press for warrant requirements when querying incidentally collected US-person communications. Separately, a Senate panel heard testimony describing how the US military has formalized a “**non-kinetic effects cell**” to integrate cyber operations, electronic warfare, and influence activities into mission planning and execution, with officials citing an operation in Venezuela that included cyber effects against radar, internet, and the power grid to induce a temporary blackout. A parallel policy dispute is playing out around domestic cyber defense leadership and information-sharing frameworks. An *SC Media* opinion column argues the Senate’s failure to confirm (and subsequent expiration of) Sean Plankey’s nomination as **CISA director** has prolonged a leadership vacuum during heightened critical-infrastructure risk, and it also highlights uncertainty around reauthorizing the **Cybersecurity Information Sharing Act of 2015** amid political resistance to a “clean” long-term extension. Overall, the reporting and commentary point to governance and oversight decisions—surveillance authorities, operational cyber integration, and agency leadership—that could materially affect US cyber posture, but they do not describe a discrete breach, vulnerability disclosure, or active threat campaign.
Jun 29, 2026
US federal cyber and IT leadership saw multiple high-profile personnel moves, including a planned transition at the **Cybersecurity and Infrastructure Security Agency (CISA)**. Acting director **Madhu Gottumukkala** is expected to leave CISA for a new Department of Homeland Security role as director of strategic implementation, with **Nick Andersen** (CISA’s executive assistant director for cybersecurity) slated to become acting director. Separately, CISA **CIO Bob Costello** reportedly received reassignment/transfer orders and is expected to depart the agency, with reporting indicating he may have been offered reassignment to **FEMA**; the reasons for the move were not publicly clarified. In parallel, Senate confirmation politics affected senior national cyber leadership: Sen. **Ron Wyden** said he would block confirmation of Lt. Gen. **Joshua Rudd** to lead both **U.S. Cyber Command** and the **NSA**, citing a lack of cyber and signals intelligence experience and concerns about his understanding of NSA surveillance authorities. Outside the cyber agencies, the **Department of Justice** elevated **Nikki Collier** from deputy CIO to permanent CIO, following a prolonged vacancy after the prior CIO’s departure, underscoring broader federal IT leadership churn during a period of workforce reductions and ongoing scrutiny of security governance practices.
Jun 29, 2026