CISA Halts Billion-Dollar Cybersecurity Deal, Shakes Up Digital Defense Strategy
At a glance:
- The Department of Homeland Security has canceled a $2.4 billion cybersecurity contract that supported the Cybersecurity and Infrastructure Security Agency (CISA).
- The contract would have brought outside technology and engineering support into federal cyber defense.
- Critics worry about lost momentum, while supporters see a chance to rethink what CISA buys.
- The decision changes how CISA works with private contractors.
The U.S. Department of Homeland Security has canceled a $2.4 billion cybersecurity contract that supported the Cybersecurity and Infrastructure Security Agency (CISA). The contract, known as Agile Cybersecurity Technical Solutions (ACTS), had been awarded to Leidos. The termination took effect on May 8, 2025, and it has started a debate about where federal cyber spending goes next.
Why DHS pulled ACTS
ACTS was meant to give CISA technical and engineering support for its cyber defense work. A rival bidder, Nightwing, had protested the award. DHS told the court that its IT and cybersecurity requirements had changed because of organizational changes and new priorities, and that the cancellation was not because of the protest. Nightwing dropped its protest on May 12. DHS said it would start new acquisition planning instead of re-awarding the contract.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Mixed reactions
Opinion is split. Some worry the cancellation will slow work that was under way and leave gaps in CISA’s capabilities while the agency shrinks. Others see a chance to rebuild the agency’s contracts around what it actually needs now.
Effects on contractors
The decision raises questions about how CISA will work with private contractors. ACTS was one of the agency’s largest planned support vehicles. Companies that bid on it, and those hoping to subcontract, now have to wait for whatever replaces it.
What comes next
The cancellation arrives as CISA faces staff cuts and a reorganization. How it fills the gap will show what the agency’s priorities have become. Some observers see the moment as a chance to align new contracts with the threats CISA now faces.
Leaner contracts ahead
Federal technology contracts may get smaller and more targeted after this. That could bring better use of money, or it could leave work undone. Contractors should watch DHS procurement notices for the new acquisition plan.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What to watch
DHS’s decision to scrap ACTS resets one of CISA’s biggest support contracts. The next steps will show whether the agency can buy what it needs while it shrinks, and how quickly it can do so.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.