CISA acting director Nick Andersen told a virtual cybersecurity summit that the agency cannot succeed without threat intelligence from private industry. "It's all carrots and partnerships," he said, pointing to programs like the CI Fortify initiative for critical infrastructure resilience. Andersen also stressed that CISA is not a law enforcement, intelligence, or regulatory agency, so it depends on voluntary contributions from outside partners.
That message sits awkwardly alongside the agency's recent history. The Trump administration has killed or defunded multiple government-industry advisory bodies, including the Cyber Safety Review Board and the AI Safety and Security Board. Some of these bodies were later re-established under new names, and CISA also terminated its relationship with the Center for Internet Security, affecting a threat-sharing hub for local governments.
Staffing and budget figures widen the gap. Around 1,000 people, about a third of CISA's workforce, have left since the administration took office. CISA has committed to rehiring roughly 300, but the latest budget request proposes removing 900 additional positions and cutting almost $1 billion from the agency's 2027 budget.
A CISA spokesperson pointed to reformed councils, CI Fortify, and security exercises as evidence that partnerships remain a priority. But with so many employees and outreach programs gone, Andersen's claims ring hollow to observers. The result, as the source notes, is likely to be unprepared critical infrastructure.