Loading story…
A DHS inspector general report found that CISA mismanaged over $100 million in cyber retention incentives, distributing funds to ineligible employees and failing to track payments. The program, intended to retain mission-critical cybersecurity talent, instead paid incentives to 240 non-cybersecurity staff and issued erroneous backpayments to over 300 employees. CISA has agreed to all eight recommendations from the OIG to address these issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourcefedscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is facing a significant staffing crisis following substantial personnel reductions attributed to Trump-era cuts and a prolonged government shutdown. Acting CISA Director Madhu Gottumukkala acknowledged in an internal memo that these reductions have hampered the agency's ability to fully support national security imperatives, with nearly one-third of the workforce lost in the past year. The memo outlines an urgent need to hire highly qualified professionals by the end of fiscal year 2026 to restore and strengthen CISA's defensive posture, leveraging the Department of Homeland Security's Cyber Talent Management System to attract critical cyber talent at market rates. In response to mounting cyber threats, particularly from China, CISA is accelerating recruitment, workforce development, and retention initiatives. The agency plans to focus on hiring state cybersecurity coordinators, regional cybersecurity advisors, and making itself more attractive to both industry experts and junior practitioners. Additional measures include expanded collaboration with colleges and universities, reviving internship programs, and considering return-to-office exemptions for certain employees. These efforts are intended to ensure CISA's mission readiness and operational continuity amid increasing cyber risks and resource constraints.
Jun 30, 2026
The Department of Homeland Security (DHS) has initiated a large-scale reassignment of cybersecurity personnel, particularly from the Cybersecurity and Infrastructure Security Agency (CISA), to roles focused on immigration and border enforcement. Hundreds of DHS employees, including those from CISA, have been directed to transfer to agencies such as Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), and the Federal Protective Service. This move is part of a broader shift in departmental priorities, emphasizing border security and deportation efforts reminiscent of previous administration policies. Employees affected by these reassignments have reportedly been given a week to respond, with the risk of termination if they do not comply. The CISA Capacity Building team, responsible for drafting emergency directives and overseeing cybersecurity for the government's most critical assets, has been particularly impacted by these changes. Experts warn that the loss of specialized cybersecurity staff could result in slower detection of cyber threats, delayed issuance of security advisories, and increased risks to both federal and enterprise networks. The reassignment comes on the heels of the firing of 130 CISA staff since the change in administration, further depleting the agency's cyber workforce. CISA, as the national coordinator for critical infrastructure security and resilience, relies heavily on the expertise of its analysts to manage risks to both cyber and physical infrastructure. The reduction in cyber personnel is expected to hinder vulnerability scanning, slow down coordination with other agencies, and diminish the agency's institutional knowledge. There is concern that the shift in focus away from cybersecurity could leave U.S. networks more exposed to cyberattacks and reduce the government's ability to respond effectively to emerging threats. The move has sparked criticism from cybersecurity experts, who emphasize the importance of maintaining a robust cyber defense posture amid a rising landscape of cybercrime. The reassignments highlight the tension between competing national security priorities and the potential unintended consequences for the nation's cyber resilience. The situation underscores the need for careful consideration of workforce allocations within critical government agencies. As the DHS continues to implement these changes, the long-term impact on U.S. cybersecurity capabilities remains a significant concern for both public and private sector stakeholders.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has retired six cybersecurity assessment and support programs for critical-infrastructure operators following budget reductions and a workforce decline of roughly one-third. Discontinued services include Cyber Resilience Reviews, Ransomware Readiness Assessments, Incident Management Reviews, and Cyber Infrastructure Surveys, leaving organizations to use a self-service questionnaire, Cybersecurity Performance Goals, and potentially older open-source CSET assessment modules. The reductions are expected to weigh most heavily on under-resourced water utilities, municipalities, hospitals, and other operators that relied on CISA regional-adviser support. Acting Director Nick Andersen said CISA must rapidly address aging technology, accumulated technical debt, and AI-driven risks that could overwhelm infrastructure operators with vulnerabilities. About 250 selected candidates are awaiting security clearances as the agency seeks to fill operational, cybersecurity, infrastructure-security, emergency-communications, and regional roles; Homeland Security has identified roughly 600 positions for refilling. No timeline was provided, and the administration's fiscal 2027 budget request separately proposes eliminating approximately 867 CISA positions, including funded vacancies.
Sep 9, 2026