3AUG

Trump proposes $707m CISA cut, 860 jobs

3 min read

16:08UTC

The FY27 budget would leave CISA on roughly $2bn with 860 fewer staff. The counter-ransomware initiative is already gone.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyDeveloping

Key takeaway

CISA is being asked to enforce a rising tempo of federal deadlines with one-third fewer people.

The Trump administration's FY27 budget proposal, published on 7 April 2026, proposes cutting the Cybersecurity and Infrastructure Security Agency (CISA) by $707 million, eliminating 860 positions and bringing the agency's operating budget to roughly $2 billion ¹. The counter-ransomware initiative, which coordinated federal response to incidents including the 2021 Colonial Pipeline attack, had already been cancelled under earlier reductions. CISA lost roughly one-third of its staff through 2025-2026 cuts before the FY27 number landed. The FBI's cybercrime obligations would fall a further $560 million, with around 1,900 FBI staff affected across cyber and adjacent portfolios.

The National Institute of Standards and Technology (NIST), the US federal standards body for measurement and technology, is also inside the cuts envelope. NIST maintains the vulnerability-scoring baselines, Common Vulnerabilities and Exposures (CVE) enrichment and Software Bill of Materials work the private sector relies on to run any modern patch-management programme. Stripping budget from NIST at the same time as CISA removes both the agency that publishes the Known Exploited Vulnerabilities (KEV) deadlines and the agency that scores the CVEs those deadlines attach to.

The budget proposal is not law; Congressional appropriations can modify or reject it through markup and committee amendments. But the direction of travel is already set by prior reductions that cleared the appropriations process. For US private-sector Chief Information Security Officers, the federal KEV deadlines issued in April, CitrixBleed 3, the F5 reclassification, the 17-year-old Office bug, are now scheduled to be enforced by an agency with one-third fewer staff. The UK and EU, moving the opposite way on cyber regulation, are widening the transatlantic policy gap at exactly the point the threat cadence is tightest.

Deep Analysis

In plain English

CISA (the Cybersecurity and Infrastructure Security Agency) is the US government body that helps protect the country's critical infrastructure, businesses, and government systems from cyber attacks. It manages the Known Exploited Vulnerabilities list, which tells government and private organisations which security flaws need patching urgently. It also ran the programme that coordinated responses to major ransomware attacks. The Trump administration's FY27 budget, published in April 2026, proposes cutting CISA's budget by $707 million and eliminating 860 jobs. The counter-ransomware coordination programme has already been cancelled. The FBI's cybercrime budget would also be cut by $560 million, affecting around 1,900 staff. This is happening at the same time as the briefing is documenting multiple ongoing nation-state cyber campaigns against US infrastructure and a record level of ransomware attacks.

Deep Analysis

Root Causes

The FY27 budget proposal reflects the Trump administration's 'departments can handle their own cyber' position, which distributes cybersecurity responsibility to sector-specific agencies (Department of Energy, Department of Transportation, Department of Health and Human Services) rather than centralising it at CISA. This logic is coherent in theory but requires the sector agencies to have cyber capacity they currently lack.

NIST's inclusion in the cuts envelope is particularly consequential. NIST maintains the CVE enrichment and CVSS scoring standards that underpin the KEV catalogue's technical credibility. Reduced NIST capacity for vulnerability characterisation degrades the speed and quality of KEV additions, the exact mechanism that gives enterprises their patching priority signals.

What could happen next?

Risk
The counter-ransomware initiative's cancellation removes the federal coordination function that organised responses to Colonial Pipeline and similar CNI ransomware incidents; the next equivalent attack will encounter a thinner federal response structure.
Immediate · 0.8
Risk
NIST cuts will slow CVE enrichment and CVSS scoring, degrading the quality and timeliness of KEV additions and the private-sector patch-prioritisation signals that depend on them.
Short term · 0.75
Opportunity
UK and EU-based cybersecurity vendors and service providers will find an expanded market among US enterprises seeking to replace federal threat-intelligence and compliance infrastructure with commercial equivalents.
Medium term · 0.6

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2017-2020 DHS cybersecurity de-prioritisation under the Trump first term, during which the National Cybersecurity and Communications Integration Center (NCCIC) was restructured and its public-private threat-sharing function reduced. The SolarWinds compromise was detected not by US government agencies but by FireEye in December 2020, partly attributed to the preceding years of reduced federal cyber capacity. The proposed FY27 cuts return to the same structural logic.

Counter-parallel: The UK's approach under the NCSC, established in 2016 with a defined technical mandate and protected budget, demonstrates that a smaller, focused national cybersecurity agency can achieve high operational credibility. NCSC operates on a fraction of CISA's proposed $2bn budget but produces advisory output that the ICO uses as a GDPR enforcement baseline. Scale does not correlate linearly with effectiveness.

The US federal cyber security services market, which includes government procurement of threat intelligence, incident response, and compliance tools, is directly affected by CISA and FBI budget reductions. Vendors like Palo Alto Networks, CrowdStrike, and Tenable that hold CISA contract vehicles or rely on CISA procurement as an anchor customer face reduced government revenues through FY27 if the cuts hold.

Private-sector CISOs will face a different economic effect: the compliance infrastructure they currently rely on (KEV deadlines, NIST frameworks, CISA vulnerability advisories) will partially migrate to private-sector equivalents, increasing enterprise spending on third-party threat intelligence subscriptions as a substitute for government-provided information.

Consensus view: RAND Corporation's cybersecurity policy research assessed in its 2025 federal cyber agency review that CISA's counter-ransomware coordination function, now cancelled under existing cuts, was the highest-return investment in US federal cyber spending, because it aggregated threat intelligence across hundreds of critical infrastructure operators that individually cannot access classified threat data; the proposed FY27 cut eliminates the remaining capability being rebuilt after earlier reductions.

Counter-view: Heritage Foundation's tech policy team argues that CISA's expansion under the Biden administration included mission creep into election security and disinformation monitoring that is outside the agency's core CNI mandate, and that a refocused CISA at a lower budget, doing fewer things better, could produce comparable outcomes in its original infrastructure-protection remit; the $707m cut is large but not categorically incompatible with effective core CISA functions.

Key tension: Whether CISA's KEV catalogue, which generates compliance deadlines that thousands of private-sector organisations use to prioritise patching, can be maintained at a credible technical standard with 860 fewer staff and reduced NIST support, or whether the catalogue's authority erodes if enforcement and updating capacity falls below a critical threshold.

Sources:UK Parliament

Mentions:Donald Trump →CISA →FBI →NIST →United States →Heritage Foundation →DHS →Prima →RAND Corporation →Citrix →NCSC →Known Exploited Vulnerabilities →Trump administration →CitrixBleed 3 →Iran →SolarWinds →Common Vulnerability Scoring System →

First Reported In

Update #1 · Stryker MDM wipe exposes identity perimeter

UK Parliament· 17 Apr 2026

Read original →

Causes and effects

Caused by

CISA deadline for PAN-OS RCE lands four days early

CISA enforcing a deadline the vendor cannot meet while operating under a proposed $707m budget cut exposes the structural limits of compliance-led cybersecurity with reduced agency capacity.

Occurred 6 May 2026

Read story →

This Event

Trump proposes $707m CISA cut, 860 jobs

US federal cyber enforcement capacity contracts just as the threat cadence, KEV additions and ransomware postings, accelerates.

Led to

Scattered Spider's Bouquet arrested in Helsinki

Finnish KRP and FBI cooperation on Stokes arrest mirrors the multinational law-enforcement template used in the E-Note seizure in ID:2554.

Occurred 28 Apr 2026

Read story →

Kimwolf botmaster held over record DDoS

Jacob Butler's arrest follows the same off-ramp logic as the E-Note exchange seizure: seize shared infrastructure first, then arrest the operator, removing downstream attack capacity at scale.

Occurred 21 May 2026

Read story →

Europol seizes First VPN in Saffron raid

The E-Note seizure (ID:2554) follows the same law-enforcement infrastructure-takedown pattern as Operation Saffron: removing a service ransomware gangs rely on without eliminating the affiliate pool.

Occurred 21 May 2026

Read story →

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.