A group of leading House Democrats introduced legislation Monday requiring the Cybersecurity and Infrastructure Security Agency to conduct an assessment of its workforce to determine whether it’s up to the task after the exit of around 1,000 employees during President Donald Trump’s second term.

The concept of a force structure assessment is more common in military branches, including one that Congress previously ordered for Cyber Command. The CISA Force Structure Assessment Act would order the agency to carry out a review of whether the agency still has the necessary personnel, training and certifications after budget cuts and other Trump-era departures.

“America’s cyber defenses are only as strong as the people behind them,” Rep. James Walkinshaw, the Virginia Democrat serving as lead sponsor of the bill, said in a news release. “As cyber threats grow more sophisticated and technologies like artificial intelligence and quantum computing reshape the threat landscape, Congress needs a clear accounting of whether CISA has the workforce, skills, and resources required to keep Americans safe and enable mission delivery. This legislation will identify critical gaps and give Congress concrete information to address them.”

Also sponsoring the bill are the top Democrat on the House Homeland Security Committee, Bennie Thompson of Mississippi, and the top Democrat on its cybersecurity subcommittee, Delia Ramirez, D-Ill.

Additional elements of the force structure assessmewould include a review of the security of federal IT systems and support for state and local governments; the risks posed by AI, quantum computing and other cutting edge technologies; CISA’s threat-hunting and incident response capabilities; support for critical infrastructure and operating technology, including CISA’s role as a sector risk management agency for a number of industry sectors; the operation of the Joint Cyber Defense Collaborative; and international cooperation.

Some lawmakers and other observers have worried those areas have been greatly impacted by staffing cuts, ultimately hurting CISA’s ability to carry out its core functions.

Ramirez dinged GOP lawmakers for “a lack of interest in safeguarding our nation’s cybersecurity and our residents’ civil rights and privacy” in going along with the CISA cuts and other developments at the Department of Homeland Security.

Lawmakers on both sides of the aisle have voiced concern about the scope of cuts at CISA, but Republicans have approved some of them while pushing back on others. CISA itself is currently seeking to hire hundreds of new personnel, even as its latest budget blueprint calls for yet more funding reductions.

“With Iran targeting our critical infrastructure and frontier AI models creating new cyber risks, we must ensure we have a cybersecurity workforce to counter these growing threats,” Thompson said. “After Trump has spent the past two years targeting and slashing CISA’s workforce, we need the agency to assess if it has [the] right personnel in place to fulfill its mission.”

National Cyber Director Sean Cairncross has discussed White House plans to develop a cybersecurity academy meant to consolidate and enhance existing federal cyber training and education programs, with the aim of addressing cyber workforce shortages. His office has reportedly drafted an executive order that would establish that academy.

The post Dems seek top-to-bottom assessment of CISA workforce appeared first on CyberScoop.

The United States and allied governments are “buying time for our systems to become more secure” as artificial intelligence advances and spreads, National Cyber Director Sean Cairncross said Thursday.

“That is a big deal to be ahead of this, to be ahead of this race, and because it’s an exponential  equation,” he said at the Billington CyberSecurity Summit. “Once you fall behind, it is much more difficult to make it up, and so that is the context in which all this is taking place. We are trying to balance the innovation side of running at speed with securing our systems and handling this technology responsibly, which is to say, not letting it fall into the hands of people who would do us harm, our adversaries.”

Earlier this week, U.S. security agencies accused Chinese AI companies of trying to illegally distill U.S. frontier AI models. Also this week, Anthropic disclosed a fourth AI hacking incident where one of its models broke into third-party systems.

“We all face the same threat picture, and it’s vital that we’re working closely together to secure those systems before that technological cycle catches up on the back end,” Cairncross said.

AI has further exposed long-standing cybersecurity problems that have gone unaddressed, he said.

“In AI development, particularly on the vulnerability discovery side and the coding side, it hasn’t created a new set of problems,” Cairncross said. “What it’s done is it’s dragged to the surface problems that have been latent in this space for decades. There’s been under-resourcing and deprioritization of basic cyber hygiene and cybersecurity.”

Cairncross’s messages echoed those of other Trump administration cyber officials speaking this week at the summit.

A top FBI official, Jason Bilnoski, said the solutions to the difficulties AI poses aren’t new; basic cyber hygiene is key.

And the director of the Cybersecurity and Infrastructure Security Agency, Nick Andersen, said historical neglect of cybersecurity fundamentals poses a serious threat that requires a speedy answer.

“We know the worst that can happen, and if we don’t make some very serious, very significant changes in quick succession … you all are going to have to go home and look your family, look your friends in the eye and explain to them how you knew the worst that could happen and why we didn’t do enough,” he said.

The post Governments ‘buying time’ in race between innovation, security, national cyber director says appeared first on CyberScoop.

The Trump administration rolled out a six-month test program in Texas on Monday that will draw on volunteer expertise and technology from cyber and artificial intelligence companies to protect the water sector.

“Project Watershed 250” is the first of the state-based, industry-centric pilot projects to cross the finish line that the Office of the National Cyber Director has previewed since the publication of its national cybersecurity strategy earlier this year. Water systems have long been viewed as among the most vulnerable and neediest critical infrastructure sectors, and in recent months the sector has been the victim of a spree of attacks.

“Project Watershed 250 is a commitment from the states, industry and federal government that we will continue to prioritize our nation’s safety and deliver on America-first policies for the American people,” National Cyber Director Sean Cairncross said at a rollout event in San Antonio Monday.

“U.S. companies are providing world-class cyber capabilities, red teaming that tests utilities’ current defenses, system hardening using the latest private sector cyber tools and AI tooling that helps utilities’ frontier cyber defenders to protect Texas water systems and scale proven solutions across the country,” he said. “This six-month pilot program is designed to make our water and wastewater critical infrastructure more resilient and resistant to cyber attacks by proactively finding and fixing system weaknesses.”

The pilot program, featuring collaboration between federal and state governments, stands in contrast to how the Biden administration tried to tackle the issue, with audit requirements that some GOP states challenged in court, forcing Biden’s Environmental Protection Agency to withdraw its rule.

“For too long, at least on the federal level, the government has admired the problem of cybersecurity in water systems,” Cairncross said. “We are going to find out what works. We’re going to target that, and we are going to scale off of this and learn lessons.”

A dozen companies — Parsons, Microsoft, Fortinet, Google Cloud, Palo Alto Networks, Amazon Web Services, Reflection AI, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos — appeared at the rollout Monday to praise the initiative and tout their contributions to it.

Not everyone praised the initiative elsewhere, however. One cyber professional who works on water security issues, speaking on condition of anonymity, said the program was “all smoke” and that “there’s no real money behind it.”

“The White House did what it always does — reached out to industry with their hands out asking for industry to pay for things the government should be doing, at least in part,” the person said.

Texas Gov. Greg Abbott said the program would be overseen by Cairncross’s office and Texas Cyber Command, which was established just last year. Abbott cited the need for the program by mentioning “an Iranian-backed cyberattack” on 30 water systems across 12 states and a 2024 attack on the water system in Muleshoe, Texas, suspected to be the work of Russian hackers.

“The need for cyber resilience is overwhelming,” Abbott said. “Many rural providers simply don’t have the resources they need to be able to protect themselves.”

Watershed 250 isn’t the only federal effort to bolster water cybersecurity, with lawmakers introducing legislation in the aftermath of the recent attacks. Past legislation that Congress has enacted also sought to tackle the problem.

Updated 8/31/26: with comment from cyber professional.

The post ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help appeared first on CyberScoop.

The Trump administration executive order on artificial intelligence tried to strike the balance between responsible use, security and mutual benefit, all with an eye toward not making it regulatory in nature, National Cyber Director Sean Cairncross said Tuesday.

“Everyone is working towards the same goal in terms of protecting the country and securing our systems, and we are trying to ensure that defenders have this technology as quickly and at scale as possible, but there are obviously specific security concerns, and industry has been very sensitive to this as well,” Cairncross said at the Black Hat 2026 conference in Las Vegas.

The security concerns about AI have moved to the forefront of discussions about the technology after OpenAI models escaped a test environment to hack the company Hugging Face last month.

“The design of this is that when there is something that happens, when there is a breach, when there is an event, that that system, that network of connections can exist, adapt to that, and seek to remedy that as quickly as possible, so that form follows function rather than turning that upside down, and as usual with the government pen just proceeding in a vacuum,” Cairncross said.

The Trump administration has drawn criticism over whether it has struck the right balance on AI rules. Trump’s AI executive order notably got pulled just before its scheduled release, with the final version signed in June missing some aspects that had drawn industry opposition.

“What needs to be built is a flexible, adaptable structure that enables information sharing between industry and government, so we can guarantee that this technology benefits everyone it’s going to benefit, but is used responsibly and securely,” Cairncross said.

He said the administration is working with industry during implementation of the executive order.

“A regulatory regime would not only strangle growth, development, and innovation, and be enormously harmful to the industry, but it would be obsolete 48 hours after it was gone through whatever process it had gone through,” Cairncross said.

Open source will play a “vital” role in the U.S. spreading its vision for AI across the globe, he said.

“We are extremely interested in looking at ways to build U.S. open source, make it competitive, make it the preferential adoption by planet Earth,” Cairncross said. “We understand and appreciate the value to the ecosystem that it has, the innovation, the startups who rely on it, the leap forward it makes possible in ways that otherwise would never happen. And so I think it’s an incredibly thriving ecosystem in AI right now, and we are looking to do what we can to grow, foster, and push that U.S. open source model.” 

Speaking at the same conference, Nick Andersen, the acting director of the Cybersecurity and Infrastructure Security Agency, seconded Cairncross’s comments about AI executive order implementation. He touted the Gold Eagle clearinghouse as one example.

“Those are fantastic opportunities we have to really provide a unifying function around the way that we’re going to do AI-enabled vulnerability reporting and disclosure at scale in a way that we haven’t had to do before with some of our legacy platforms, and just continue to expand out those opportunities,” he said. “That access — to build off the director’s point earlier — to really enable that industry collaboration, that’s so key and critical to us as we move forward.”

Matt Kapko contributed reporting to this story.

Updated 8/5/2026: to include comments from Andersen.

The post National cyber director lays out White House plans to secure AI without writing new rules appeared first on CyberScoop.

An annual spy policy bill would authorize a cyberthreat intelligence sharing pilot program for state and local governments, and order an outside assessment of how intelligence agencies are currently sharing that information with those jurisdictions.

The House Intelligence Committee approved fiscal 2027 intelligence authorization legislation Monday that also includes provisions on election security and that are meant to boost intelligence community (IC) usage of artificial intelligence for cyber and other purposes.

The measure’s language on state and local information sharing come amid widespread frustration with Trump administration cutbacks on such aid from the federal government, with the president taking explicit action to shift more responsibility for cyber defenses to the local level.

Under the pilot program, the Office of the Director of National Intelligence (ODNI) would pick one state to receive monthly briefings from the ODNI, Department of Homeland Security, FBI and others to receive monthly briefings on “timely, specific, and actionable information regarding cyber threats” in unclassified form. After a year, the ODNI would then provide a report on the viability of a wider briefing program for state and local governments.

The bill requires the ODNI to produce a strategy on information sharing with states and local areas, and would require the Government Accountability Office to conduct an assessment of the state of such sharing now, including a summary of relevant agencies’ current efforts, how the agencies deconflict those efforts and what kind of obstacles security clearances pose to improving information sharing.

Trump’s pick to serve as DNI, Jay Clayton, emphasized his desire to focus on cyber threat information sharing as part of his Senate vetting last week, but some in the GOP are also pushing to significantly reduce the size of his office.

National Cyber Director Sean Cairncross has also talked about creating pilot programs for cyber threat information sharing with state and local governments, but there’s been little movement on that initiative.

During committee deliberation, panel Democrats won adoption of a trio of election security amendments.

An amendment from the panel’s top Democrat, Rep. Jim Himes of Connecticut, would require the intelligence community to publish an unclassified assessment of foreign intelligence threats to the 2026 midterms. Rep. Jason Crow of Colorado’s amendment would partially withhold funding for the ODNI until Congress gets overdue reports it had required on the 2024 and 2026 elections. And  Rep. Chrissy Houlahan of Pennsylvania’s amendment would “protect analysts from retribution by IC leadership for working on intelligence products related to foreign influence in US elections,” according to a news release.

The Democrats’ push arrives shortly after President Donald Trump delivered a primetime address seeking to bolster his long-debunked claims that the 2020 election was stolen from him.

According to a Republican summary of the bill, it includes provisions for “significantly increasing funding for expanded access and use of frontier AI models for intelligence and cyber missions,” to codify and expand the role of the Artificial Intelligence Security Center at the National Security Agency and strengthen information sharing on AI threats.

“This year’s [bill] balances strong transparency and accountability measures while equipping the IC with the resources needed to combat the ever-evolving threats from our adversaries around the world, with a particularly strong focus on the global AI race,” said House Intelligence Chairman Rick Crawford, R-Ark.

Another assessment that the bill orders would come from the Office of Intelligence and Counterintelligence of the Department of Energy on foreign cyberthreats to critical energy infrastructure, including their intent and risks.

The trend in Congress is for lawmakers to incorporate the annual intelligence authorization bill, or some of its provisions, into the annual National Defense Authorization Act, which often reaches the president’s desk at the end of each calendar year.

The post House intel bill includes provisions on state and local threat intelligence, election security, AI appeared first on CyberScoop.