Interviews with 15 people show CISA is underfunded, short on talent, outmatched by adversaries, and overwhelmed by the fallout from two massive cyberattacks
The agency that protects the U.S. from hackers is hobbled by funding woes, a talent shortage and growing pains that are jeopardizing … Tweets: @ericgeller , @gossithedog , @kevincollier , @howelloneill , @likethecoins , @politico , @mastersonmv , @ericgeller , @homelanddems , @trialbytruth , and @randybias Tweets: Eric Geller / @ericgeller : New: The U.S.' cyber agency is underfunded, overwhelmed, and struggling to keep up with evolving threats. @CISAgov got $650m in the Covid-19 bill, but experts say it'll need a lot more support to have a chance of stopping the next SolarWinds. My story: https://www.politico.com/... https://twitter.com/... Kevin Beaumont / @gossithedog : This is on point, and one bit of my opinion I'd add: Fund it, and make CISA the CSOC for federal organisations, central function. Plug all logs via it and have it be able to notify orgs they've got problems etc. Similar model to UK's NHS central CSOC service coming online. https://twitter.com/... Kevin Collier / @kevincollier : Via @ericgeller, a look at how CISA is exhausted by SolarWinds, lack of funding and staff, no permanent leader since Krebs was fired by tweet in November: https://www.politico.com/... Patrick Howell O'Neill / @howelloneill : “Staffers are worn out, money is tight and the Cybersecurity and Infrastructure Security Agency is struggling to keep up with multiple competing crises” https://twitter.com/... Katie Nickels / @likethecoins : Unfortunately, “underfunded, overwhelmed, and struggling to keep up with evolving threats” describes far too many cyber defenders. To all the @CISAgov employees and defenders everywhere who are doing the best with what they have, thank you! ❤️ https://twitter.com/... @politico : Many of those who track the nation's cyber defenses say they're worried that CISA is so consumed with recovering from existing breaches that it's too stretched to prepare for the next attack https://www.politico.com/... Matthew Masterson / @mastersonmv : Good read from @ericgeller on the expectations & challenges (resources!) facing my former colleagues @CISAgov. They are resilient & dedicated professionals who continue to grind away supporting gov & private sector partners in the midst of some pretty big incidents. https://twitter.com/... Eric Geller / @ericgeller : Resharing my story about how CISA's doing right now. 1 employee told me many staffers “were crushed” in 2020, expected time off in Dec, had to go “all hands on deck” for SW, & were just starting to go from triage to recovery after SW when “we had to ramp up again” for Exchange. https://twitter.com/... @homelanddems : “If Congress wants the private sector to take security seriously — and that means putting money where your mouth is — it has to lead by example” Chairman @BennieGThompson. @Homelanddems is making boosting our cyber capabilities a top priority. https://www.politico.com/... Infospectives / @trialbytruth : A rare rational breakdown of how a security function ends up with burnout, credibility damage, and dropped balls, if not adequately supported. https://twitter.com/... Randy Bias / @randybias : This is ridiculous. Future warfare will be largely cyber-based. Instead we blow billions on a jet fighter. https://twitter.com/...
Context & Ripple Effects
This report lands at the peak of the cleanup from two intrusions that defined CISA's first years: state-sponsored hackers reached into DHS internal communications during the SolarWinds campaign, and the agency was simultaneously managing Microsoft Exchange fallout with no permanent director since the November removal. Eric Geller's interviews with 15 people put numbers on the strain — a $650M COVID-bill infusion experts call insufficient against adversaries they describe as outmatching the agency.
The piece sits early in a longer arc the related coverage traces: months later the government-wide cybersecurity workforce shortage was still worsening, and by late 2022 insiders described an agency adrift on strategy and focused on PR. What reads here as growing pains turns out, across the record, to be the durable condition.
First-order effects
- Congress's $650M appropriation arrives at CISA while its staff runs prolonged 'all hands' responses to SolarWinds and Exchange simultaneously, producing the burnout sources describe.
- CISA must run incident response without a Senate-confirmed director, leaving its leadership vacuum exposed exactly when the Exchange and SolarWinds aftermath demands one.
Second-order effects
- The talent shortage compounds: CISA competes for the same scarce security workers the private sector is hiring, so every unfilled federal seat pushes skilled defenders toward better-paid industry roles.
- Under-resourcing shifts defensive burden onto the victims themselves — companies hit by Exchange and SolarWinds get slower federal support, raising the private cost of each breach.
Third-order effects
- If the pattern holds — emergency money after each headline breach, attrition between them — civilian cyber defense becomes structurally reactive, a trajectory later coverage confirms with reports of mass layoffs, an unconfirmed leader, and a demoralized workforce at CISA and continued instability into Trump's second term.
- An outmatched CISA pushes Washington toward leaning harder on private-sector detection and disclosure mandates rather than government-led defense, reshaping where national cyber resilience actually lives.
The trend: US civilian cyber defense is caught in a boom-and-bust funding cycle — surge appropriations after each mega-breach, chronic understaffing between them — that leaves CISA permanently behind its adversaries.