Homeland Security Secretary Kristi Noem came into office promising to make cybersecurity a top national priority — a “whole-of-government” mission to defend the United States against hackers and foreign adversaries.
Nine months later, that promise is cracking under the weight of her own department’s decisions.
The Cybersecurity and Infrastructure Security Agency, or CISA, which serves as the nation’s digital first responder, has seen its workforce shrink by more than a third since Noem took office. Funding for election security has been eliminated. State and local governments that once relied on CISA’s support say they’ve been left on their own to fend off increasingly aggressive cyber threats.
“There’s a real disconnect between the public messaging about cybersecurity and the reality on the ground,” said one current CISA employee, “We’re spread thin, and we’re not being heard.”
CISA’s gutting comes at a time when cyberattacks on U.S. critical infrastructure — power grids, hospitals, schools, even water systems — have surged. Foreign adversaries, including Russia and China, have ramped up attempts to infiltrate government networks, while criminal groups have carried out ransomware attacks that shut down entire municipalities.
“Every cut makes us more vulnerable,” said Rep. Don Bacon, a Nebraska Republican who chairs the House Armed Services Committee’s cyber subcommittee. “The administration keeps undermining CISA, which serves at the forefront of defending our infrastructure. We’re handicapping ourselves.”
The Department of Homeland Security insists that the criticism is overblown. In a statement, the agency said that under Noem’s leadership, CISA has been “refocused on its core mission” — coordinating critical infrastructure protection, providing “timely, actionable cyber threat intelligence,” and supporting partners across federal, state, and local governments.
But in practice, many of those partnerships have withered. DHS data show that CISA’s staff dropped to around 2,500 employees by the end of May, down from roughly 3,500 at the start of the year. Much of the agency’s stakeholder engagement team — which liaised with state and local governments and private industry — has been reassigned or let go.
Meanwhile, funding for the Multi-State Information Sharing and Analysis Center — a key hub that allowed local governments to share threat data — has been cut entirely. So has money for the State and Local Cybersecurity Grant Program, which distributed nearly $1 billion to help state governments harden their digital defenses.
Even former officials say they barely recognize the agency. “In retrospect, Secretary Noem’s speech at RSAC feels like fiction,” said a former CISA senior adviser, referring to her April remarks at the major cybersecurity conference in San Francisco. “She said, ‘We’re going to lead on cyber.’ Instead, she’s dismantled the one agency capable of doing it.”
“Part of the question for DHS — and for Secretary Noem — is simple,” said former deputy secretary Jane Holl Lute. “Are they doing enough to keep the country safe? Right now, the answer looks like no.”
