SignalGate Scandal: Waltz Deflects, Targets CISA in Senate Drama
Waltz’s hearing in brief
- Scandal Unfolds: Former national security adviser Michael Waltz pointed to the Cybersecurity and Infrastructure Security Agency (CISA) when pressed about the SignalGate controversy.
- Senate Hearing: The questions came at his confirmation hearing as UN ambassador nominee, where senators pressed him on security practices and the leaked chat.
- Narrative Shift: Waltz tried to recast the story around his own actions and those of the others in the chat.
- CISA’s Role: CISA’s mobile security guidance has been pulled into the argument over how the leak happened.
Waltz answers for SignalGate
The SignalGate scandal has taken over Washington, and it sits where cybersecurity, national security and foreign policy meet. Former national security adviser Michael Waltz, a central figure in the affair, has tried to move attention away from his actions and those of his associates by pointing at the Cybersecurity and Infrastructure Security Agency (CISA). Pressure is building. Senators now want to know how a chat about military operations ended up so exposed, and what systemic faults allowed it.
Questions from the Foreign Relations Committee
The questioning took place before the Senate Foreign Relations Committee, at Waltz’s July 15, 2025 confirmation hearing to be UN ambassador. Senators wanted more than an account of what Waltz and the others did. They also asked what the episode says about the security of the nation’s communications, how the leak happened and why the weaknesses existed in the first place.
Waltz points to CISA guidance
Waltz defended his use of Signal by citing CISA. He said using the app was authorized and had been recommended in Biden-era CISA guidance, which advised highly targeted individuals to use end-to-end encrypted messaging apps such as Signal. Critics see this as part of a wider effort to limit personal and political damage. CISA’s guidance was voluntary advice for the public. It does not govern military operations.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
A familiar political move
Shifting the story is a common move for politicians caught in a scandal: point elsewhere and personal blame gets diluted. By putting CISA in the spotlight, Waltz turned the debate toward systemic flaws and away from individual responsibility. That raises hard questions about whether current security practices for senior officials hold up against capable attackers.
CISA under the microscope
CISA protects the nation’s critical infrastructure, including much of its cyber defense, and it is now under intense scrutiny. People want to know what its guidance actually said and whether anything it did or failed to do could have prevented the leak. Any weaknesses in how CISA works would affect national security. They would also force a fresh look at its policies, how it writes guidance and how it coordinates with other federal agencies.
Calls for reform
Security experts and policymakers are pushing for real reforms. They want clear policies and coordinated work to improve how the government secures sensitive communications.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What the hearing leaves unresolved
SignalGate is a tangle of blame. It shows the need to reassess the security practices that protect national interests. The outcome of the Senate process could still lead to policy changes in how the government handles cyber threats, and Waltz’s mix of deflection and nods to systemic problems has given lawmakers a reason to look inward. Accountability is part of it. So is a firmer commitment to securing government communications, so the same holes do not put national security at risk again.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: GitLab’s 10.0 fix, then VeloCloud attacks, a poisoned LiteLLM release and PHP2Shell logs to check
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.