The Same Week Russia Stole Tokens from 18,000 Routers and Fortinet Dropped Its Second Zero-Day in Two Weeks, the White House Proposed Cutting CISA's Budget by $707 Million.

WHAT IS BEING PROPOSED

The White House Office of Management and Budget released the FY2027 budget proposal late last week. The document calls for reducing CISA's budget by $707 million, which would bring the agency's discretionary funding to slightly over $2 billion. For context, CISA's budget was approximately $3 billion at the start of the current administration. The proposed cut represents roughly a 30% reduction from the FY2025 level.

The budget document frames the cuts as a return to CISA's "core mission" of federal network defense and critical infrastructure protection. It accuses the agency of having been "more focused on censorship than on protecting the Nation's critical systems" and describes prior programs as "weaponization and waste." The specific reference is to CISA's work with technology companies to counter misinformation during the 2020 presidential election.

Beyond the topline number, the proposal targets specific functions. It would eliminate CISA's election security program entirely, including funding for information-sharing with state and local election officials and dedicated election security advisors across the country. It would end support for the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC). It would shut down stakeholder engagement offices that serve as the primary conduit between CISA and the state, local, and private-sector organizations that own and operate the majority of the nation's critical infrastructure.

The proposal would also cut roughly 867 positions. That comes on top of the nearly 1,000 employees CISA has already lost since January 2025 through voluntary resignations and layoffs. Combined, those numbers represent a workforce reduction of more than half from where the agency stood less than two years ago.

THE TIMING

This blog has published seven posts in the last two weeks. Every single one documented an active, ongoing attack against systems that CISA is responsible for helping to defend.

On March 25, we covered the TeamPCP supply chain cascade that compromised Trivy, Checkmarx, and LiteLLM. On April 2, we documented Cisco's breach via that same supply chain. On April 3, we covered CERT-EU confirming the European Commission was breached through the same vector. On April 4, we published on the Cisco IMC CVSS 9.8 authentication bypass. On April 6, we analyzed the 37x surge in device code phishing. Yesterday morning, we covered the Fortinet EMS CVSS 9.1 zero-day that CISA itself added to its KEV catalog with a three-day remediation deadline. Last night, we published on APT28 hijacking 18,000 routers across 120 countries to steal Microsoft Office tokens.

That is the operational reality CISA is facing right now. State-sponsored actors from Russia, China, Iran, and North Korea are all running active campaigns against U.S. critical infrastructure and enterprise systems simultaneously. The proposal to cut the agency's budget by 30% during this threat environment is not an abstract policy debate. It has direct, measurable consequences for the organizations and communities that depend on CISA's advisories, threat intelligence sharing, and incident response coordination.

WHAT THE CUTS ACTUALLY MEAN

The most consequential cuts are not to CISA's own network defense capabilities. They are to its connective tissue. The stakeholder engagement offices being targeted for elimination are the mechanism through which CISA shares threat intelligence, coordinates incident response, and provides technical assistance to state and local governments, water districts, power utilities, hospitals, and the private sector organizations that run the infrastructure communities depend on every day.

Those are exactly the organizations in the Atarus target portfolio. Water districts. Local government IT. Healthcare systems. Mid-size critical infrastructure operators. These entities do not have dedicated threat intelligence teams. They do not subscribe to premium feeds from Mandiant or Recorded Future. For many of them, CISA's advisories, its Known Exploited Vulnerabilities catalog, and its regional engagement staff are the primary source of actionable cybersecurity guidance they receive from anyone, anywhere.

When CISA added Fortinet's CVE-2026-35616 to the KEV catalog on Sunday and gave federal agencies three days to patch, that same advisory reached thousands of non-federal organizations that use the KEV catalog as their patch prioritization framework. If the offices that disseminate those advisories, coordinate with sector-specific ISACs, and provide hands-on support during incidents are eliminated, the information still exists somewhere in the federal system. It just stops reaching the people who need it.

WHAT HAPPENED LAST TIME

This is not the first attempt. The FY2026 budget proposed cutting CISA by approximately $491 million. Congress pushed back. Democrats and Republicans both opposed the scale of the cuts. The final number landed somewhere between $130 million and $300 million after negotiations, a significant reduction from the proposal but still a meaningful cut.

The FY2027 proposal is a 44% increase over last year's opening bid. Whether it meets the same congressional resistance depends on the political dynamics of this particular budget cycle. Nextgov/FCW reported that the budget document itself contains discrepancies. The summary cites $707 million in cuts, while the appendix shows a reduction of approximately $360 million. The difference appears to stem from baseline comparisons complicated by the fact that CISA has been operating under continuing resolutions rather than a full-year appropriations bill.

Regardless of which number Congress ultimately settles on, the direction is clear. The agency's operational capacity has been declining for over a year. Its workforce is down by roughly a third. It has no permanent director. And the proposed budget would accelerate that trajectory.

WHAT PRACTITIONERS ARE SAYING

WHAT THIS MEANS FOR YOU