Key Takeaways
- CISA is actively rebuilding its workforce after significant personnel cuts in 2025, with Acting Director Nick Andersen leading hiring efforts.
- The agency is “ruthlessly prioritizing” its activities, focusing limited resources on essential services such as telecommunications and water infrastructure.
- Recent cyber‑attacks believed to originate from Iranian threat actors have targeted programmable logic controllers (PLCs) in drinking‑water and wastewater systems across at least seven U.S. states.
- State officials in Minnesota and Michigan have confirmed that dozens of utilities were affected, prompting CISA to conduct on‑site assessments, including a visit to a water district in the Las Vegas area.
- CISA’s response includes providing technical assistance and other resources to local communities, reflecting its renewed emphasis on direct engagement and support.
- Andersen’s remarks were delivered at Allegiant Stadium in Las Vegas during a panel hosted by the Alliance for Digital Innovation, held just before the Black Hat USA conference opening sessions, alongside acting Federal CISO Michael Duffy.
CISA’s Workforce Recovery Efforts
The Cybersecurity and Infrastructure Security Agency (CISA) is in the midst of a rebuilding phase after enduring substantial staff reductions in 2025. Acting Director Nick Andersen confirmed that the agency is actively hiring to replenish its ranks and restore the capacity needed to fulfill its mission. This recruitment drive aims to address the gaps left by earlier budget‑driven layoffs, which had strained CISA’s ability to monitor, defend, and respond to emerging cyber threats across the nation’s critical infrastructure sectors.
Ruthless Prioritization of Limited Resources
Andersen emphasized that, given the current constraints, CISA must be “ruthlessly prioritizing” the initiatives it undertakes. Every dollar invested and every hour of staff time is being scrutinized to ensure maximum impact on national security. This disciplined approach forces the agency to concentrate on the most vital functions—those whose disruption would pose the greatest risk to public safety, economic stability, and national resilience.
Focus on Essential Services: Telecommunications and Water
In line with its prioritization strategy, CISA has directed considerable attention toward safeguarding two cornerstone sectors: telecommunications and water. Andersen noted that telecommunications networks remain a top priority because they underpin virtually all other critical services, from emergency response to financial transactions. Simultaneously, the water sector has consumed a substantial portion of the agency’s recent efforts, reflecting heightened concerns over its vulnerability to cyber intrusion.
Iranian‑Linked Threats to Water Infrastructure
Recent intelligence indicates that hackers suspected of operating from Iran have launched a series of attacks against drinking‑water and wastewater utilities in at least seven U.S. states. These intrusions specifically targeted programmable logic controllers (PLCs)—the specialized computers that monitor and control physical processes such as chemical dosing, pump operation, and flow regulation. By compromising PLCs, adversaries could manipulate treatment processes, potentially contaminating water supplies or disrupting service delivery.
State‑Level Confirmations of Impact
Officials in Minnesota and Michigan have publicly confirmed that dozens of water utilities within their states experienced the effects of these cyber campaigns. The disclosures underscore the geographic breadth of the threat and highlight the need for coordinated federal, state, and local responses. While the exact nature of the impact varied—ranging from anomalous sensor readings to temporary loss of remote‑monitoring capabilities—the incidents collectively demonstrate that even modestly sized utilities are attractive targets for sophisticated cyber actors.
On‑Site Assessment in the Las Vegas Area
To better understand the operational realities facing water providers, CISA officials conducted a site visit to a water district in the Las Vegas metropolitan area. The visit allowed agency personnel to observe firsthand the infrastructure configurations, security postures, and resource constraints that local utilities contend with. Such field engagements are integral to CISA’s strategy of tailoring technical assistance to the specific needs of each facility rather than applying a one‑size‑fits‑all approach.
Delivering Technical Assistance and Resources
Following the assessment, CISA outlined plans to provide targeted technical assistance, including vulnerability scans, configuration reviews, and incident‑response guidance, to the visited water district and analogous facilities nationwide. The agency also intends to share best‑practice guidance on securing PLCs, enhancing network segmentation, and implementing robust monitoring solutions. By coupling direct support with broader advisory products, CISA seeks to empower local operators to harden their defenses against future intrusions.
Engagement with Local Communities as a Core Mission
Andersen reiterated that community engagement remains a cornerstone of CISA’s revitalized approach. The agency’s renewed focus on listening to and collaborating with state, local, tribal, and territorial partners reflects a recognition that cybersecurity is most effective when it is rooted in the realities faced by those who operate critical services on the ground. This shift toward partnership aims to bridge the gap between federal capabilities and local operational constraints.
Panel Appearance at Allegiant Stadium
The Acting Director shared these insights during a panel discussion held at Allegiant Stadium in Las Vegas, hosted by the Alliance for Digital Innovation. The event took place just before the opening sessions of the prestigious Black Hat USA conference, a gathering that draws cybersecurity professionals, researchers, and policymakers from around the world. Andersen appeared alongside acting Federal CISO Michael Duffy, underscoring the high‑level coordination between CISA and the broader federal cybersecurity leadership.
Context Within the Black Hat USA Conference
Speaking at a venue adjacent to Black Hat USA provided Andersen with a platform to communicate CISA’s current challenges and priorities to an audience deeply versed in offensive and defensive security techniques. The timing allowed the agency to highlight its efforts to recover from resource shortages while also signaling its commitment to staying abreast of cutting‑edge threat intelligence and mitigation strategies that emerge from conferences like Black Hat.
Outlook: Balancing Recovery with Resilience
While CISA is making measurable progress in rebuilding its workforce and refocusing its efforts, Andersen acknowledged that significant challenges remain. The agency must continue to navigate a threat landscape characterized by increasingly sophisticated state‑sponsored and criminal actors, all while operating under tighter fiscal and personnel constraints. Nevertheless, the renewed emphasis on prioritization, direct technical support, and community partnership suggests a trajectory toward greater resilience for the nation’s critical infrastructure.
In summary, CISA is emerging from a period of severe cuts by actively hiring, ruthlessly prioritizing its mission‑critical work, and concentrating resources on safeguarding telecommunications and water systems. Recent Iranian‑linked PLC attacks on water utilities across multiple states have prompted on‑site assessments and the delivery of targeted technical assistance, reinforcing the agency’s commitment to local engagement. These efforts were articulated by Acting Director Nick Andersen at a high‑visibility panel in Las Vegas, setting the stage for CISA’s continued recovery and enhanced cybersecurity posture as the nation confronts evolving threats.