CISA Vacancies and Shutdown Hamper Cyber Defense

A partial government shutdown and leadership vacuum at CISA have left U.S. infrastructure vulnerable as Iran-linked cyberattacks surge following regional strikes.

By: AXL Media

Published: Mar 9, 2026, 10:57 AM EDT

Source: CNBC

A Leadership Vacuum Amidst Geopolitical Turmoil

The Cybersecurity and Infrastructure Security Agency is currently navigating a perfect storm of internal instability and external threats. In the wake of the Trump administration taking office, CISA has reportedly lost approximately one-third of its workforce. This attrition has been compounded by a management reshuffle, including the recent reassignment of temporary director Madhu Gottumukkala and the resignation of Chief Information Officer Bob Costello.

Gottumukkala’s brief tenure was marked by significant internal friction, including the termination of major contracts and personal controversy surrounding the handling of sensitive documents. With key positions vacant or filled by temporary staff, the agency’s capacity to coordinate a unified national response to cyber threats has been called into question. As of early March 2026, the agency's official website remains unmanaged due to a lapse in federal funding, effectively freezing public-facing cybersecurity assessments and training.

Escalating Retaliation from Tehran

The digital threat landscape has shifted dramatically following U.S. and Israeli strikes in the Middle East. Cyber experts, including leadership at cybersecurity startup Tenzai, warn that Iran is likely prepared to deploy "stored capabilities" in a wave of retaliatory strikes. Unlike traditional warfare, these cyber operations often target civilian infrastructure, financial institutions, and communication hubs to maximize domestic disruption within the United States.

Tehran has a documented history of successful digital incursions, ranging from the 2012 denial-of-service attacks on major American banks to the 2024 breach of staff emails associated with the Trump campaign. Analysts at Google’s Threat Intelligence Group and CrowdStrike have observed a surge in network disruption claims linked to Iranian proxies, suggesting that a coordinated offensive targeting the U.S., Israel, and Gulf Cooperation Council (GCC) countries may be imminent.