Rep. Swalwell Demands CISA Accountability Amid Surprising Workforce Reductions
Summary
- Congressman Eric Swalwell raises concerns over cuts to the federal cybersecurity workforce.
- CISA’s Budgetary Shifts: Questions over how staff and funds are being moved.
- Response Required: Swalwell’s formal request for answers and a plan.
- Impact on National Security: The risks of running CISA with fewer people.
Why CISA staffing matters
Workforce reductions inside CISA matter because federal cyber resilience depends heavily on institutional expertise, continuity, and the ability to coordinate across sectors under pressure. Staffing fights are more than political theater. They decide how much defensive capacity the government can sustain when threats keep rising.
Understanding CISA’s Workforce Shifts
Reports of deep staff cuts at CISA have alarmed security experts and lawmakers. Swalwell’s letter cites about 760 people who have left the agency since January, along with reports that cybersecurity staff are being moved to other DHS components to support deportation efforts. The details of these moves remain unclear, which is why lawmakers want answers.
In an October 14, 2025 letter to acting CISA Director Madhu Gottumukkala, Swalwell, the ranking member of the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection, demanded that the agency stop the cuts, reinstate transferred or dismissed employees and explain the impact. He said an earlier request for a briefing, made in April, had gone unanswered.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Potential Risks to National Security
The impact on national security could be serious. CISA defends U.S. networks against nation-states and sophisticated criminal groups. With fewer people, it may struggle to respond quickly when attacks hit.
Swalwell and other Democrats warn that a smaller staff could weaken CISA and leave sectors such as energy, finance and healthcare more exposed. He also pointed to the recent emergency directive on attacks against Cisco firewalls and to CISA’s decision to end its agreement with the Multi-State Information Sharing and Analysis Center.
A Demand for Strategic Clarity
The letter asks for answers now and for a clear plan going forward. Swalwell wants the agency to explain its strategy to Congress.
He is pressing for a plan that balances short-term budget limits with long-term security goals, and that leaves CISA able to do its job.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What comes next
The staffing changes put CISA at a turning point. Threats are growing more complex, and lawmakers want transparency about how the agency will cope. Swalwell’s letter is an attempt to force that conversation.
CISA has defended its record, saying it remains focused on its statutory mission of protecting critical infrastructure. Lawmakers, security professionals and the public will be watching whether the agency answers the letter.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.