CISA Revamps Security Approach: Red Team Restructuring and Downsizing

Summary

• CISA cut more than 100 red team and support staff in early 2025 when it ended a set of contracts.
• CISA said it was ending redundant or inefficient contracts, not laying off its red team.
• The cuts were tied to DOGE-driven contract reviews.
• Critics worry about losing hands-on testing skills.

CISA’s Red Team Loses Its Contractors

The Cybersecurity and Infrastructure Security Agency (CISA) lost much of its red team in late February and early March 2025. More than 100 red team and support staff who worked under contracts were let go when those contracts ended, according to former penetration tester Christopher Chenoweth and reporting at the time. The cuts came amid DOGE-driven reviews of federal spending.

An Overview of the Red Team Restructuring

Red teams are skilled testers who simulate real attacks to find weak spots before adversaries do. CISA’s teams probed federal networks and critical infrastructure systems. Losing a large share of that capacity at once raised questions about how the agency would keep testing at the same pace.

CISA’s Explanation

In a public statement, CISA said it was terminating redundant or inefficient contracts and that the action did not change the employment status of CISA personnel. It said it was not laying off its red team. (An earlier version of this article attributed a statement about AI and “future-proofing” to Jen Easterly as CISA director; Easterly had left the agency in January 2025, and we could not find that statement, so it has been removed.)

Can Automation Fill the Gap?

Automated scanning and AI tools can sift large amounts of data and flag patterns that point to attacks. They help. They do not replace a human tester who chains small flaws into a real breach path.

Where Tools Help

Automation is fast. It never sleeps, so 24/7 coverage is easier. It can also cut costs by taking over repetitive checks, which frees analysts for harder work.

Industry Concerns and Mixed Reactions

Job security is one worry. Effectiveness is the bigger one. Critics question whether federal systems will get the same depth of testing without experienced red teamers.

Many practitioners argue the right answer is balance, using tools to extend people instead of replacing them. (A quote attributed to a named expert in an earlier version has been removed because we could not confirm it.)

Future Prospects and Implications

Other agencies may face similar contract cuts. How CISA handles testing from here will be watched closely.

Retraining and redeploying skilled staff would help keep that expertise in public service.

What Comes Next for CISA Testing

The red team cuts mark a turning point for CISA’s hands-on assessment work. Whether the agency rebuilds that capacity, or leans on tools and fewer testers, will shape how well federal systems are checked against real attackers. That is a question for policymakers, not just security staff.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.