The acting director of the Cybersecurity and Infrastructure Security Agency (CISA), Nick Andersen, issued a stark warning on September 9, 2026, regarding the severe cybersecurity vulnerabilities facing the United States. Speaking at the Billington CyberSecurity Summit in Washington, D.C., Andersen attributed these risks to past governmental errors, outdated technology, and emerging threats from artificial intelligence.
Andersen emphasized the critical need for rapid and significant changes within CISA to prevent potentially devastating outcomes. He stated that a failure to act decisively would leave officials accountable for not addressing known risks. He specifically highlighted the "overwhelming" technical debt accumulated over decades as a major contributing factor to the current vulnerabilities.
A key focus for CISA is increasing its workforce. Andersen reported that approximately 250 new staff members have been hired and are currently awaiting security clearances. This recruitment drive aims to address significant staffing shortages; CISA lost about a third of its personnel following DOGE-related budget cuts and attrition during the initial year of the Trump administration.
In late June, Department of Homeland Security Secretary Markwayne Mullin pledged to fill roughly 600 vacant positions within CISA, noting that the agency was operating at approximately half its required staffing level. Mullin expressed the ambition for CISA to become the nation's primary cybersecurity resource, necessitating a substantial increase in personnel.
Andersen specified that CISA is prioritizing hiring for its operational, cybersecurity, infrastructure security, and emergency communications divisions. Regional field workers are also a high priority in the agency's recruitment efforts.
The acting director also identified artificial intelligence as a transformative threat. He noted the frequent reports of "rogue AI agents" and referenced a researcher's departure from the AI company Anthropic due to safety concerns regarding advanced AI models. Andersen acknowledged the overwhelming pressure on infrastructure operators who feel vulnerable to an onslaught of new threats.
