CISA Red Team Turmoil Threatens US Cybersecurity Stability

At a glance

• DOGE-driven contract cuts reached CISA’s red team in late February 2025.
• A contractor said more than 100 people lost their roles when the contract ended.
• CISA says its red teams keep working and no CISA employees were laid off.
• Critics worry about fewer tests of federal and critical infrastructure networks.

What happened to the red team

The red team at the Cybersecurity and Infrastructure Security Agency (CISA) tests federal and critical infrastructure networks the way an attacker would, then tells defenders what it found. In March 2025, reports surfaced that contract cuts linked to the Department of Government Efficiency (DOGE) had gutted much of that work. Senior penetration tester Christopher Chenoweth wrote on LinkedIn that the contract he supported was terminated on February 28, affecting more than 100 people, and that a second CISA red team was cut days later.

CISA’s answer to the reports

CISA pushed back on March 12. In a statement, the agency said it had not “laid off” its red team and had ended contracts “where the agency has been able to find efficiencies and eliminate duplication of effort.” It said the contract action did not change the employment status of CISA personnel and that its red teams “continue their work without interruption.”

Bloomberg, citing two people familiar with the matter, reported that more than 200 CISA staff and contractors were let go starting in February. TechCrunch reported cuts that hit red team staff and the agency’s incident response team. Whatever the exact count, experienced testers were looking for new jobs.

Fewer tests, more blind spots

Red team engagements find weak spots before real attackers do. Fewer engagements mean agencies and infrastructure operators hear about problems later, if at all. Private companies that rely on CISA assessments, often smaller utilities and local governments, have few other free options.

The cuts came on top of earlier rounds of CISA staff reductions in early 2025, which made it harder to argue the agency could absorb the work in-house.

Rebuilding testing capacity

Lawmakers and former officials have called for clear answers on how much testing capacity CISA kept and how it plans to rebuild it. Hiring cleared, experienced red teamers takes time, and a steady pipeline from universities and the military would help.

Leadership matters here too. A clear plan from CISA about which assessments continue, and on what schedule, would let agencies plan their own testing.

What to watch next

The question now is whether CISA can keep up the number of assessments it ran before the contracts ended. If it cannot, agencies and operators that depended on those tests should budget for outside penetration testing in the meantime. The next CISA budget request and any congressional hearings will show how much red team work survived.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.