CISO Strategy

The Trump administration’s chaotic overhaul of the federal government has seriously weakened the public-private partnerships that protect U.S. critical infrastructure from cyberattacks and physical disasters.

Massive workforce cuts, widespread mission uncertainty and a persistent leadership void have interrupted federal agencies’ efforts to collaborate with the businesses and local utilities that run and protect healthcare facilities, water treatment plants, energy companies and telecommunications networks, according to interviews with 14 representatives of those four critical infrastructure sectors, four former senior government cybersecurity officials and multiple infrastructure security experts.

Government leaders have canceled meetings with infrastructure operators, forced out their longtime points of contact, stopped attending key industry events and scrapped a coordination program that made companies feel comfortable holding sensitive talks about cyberattacks and other threats with federal agencies.

“The partnership is in suspended animation,” said a healthcare industry representative, who — like most others interviewed for this story — requested anonymity to discuss sensitive matters. “The partnership, at the end of last year [2024], had reached a level of maturity that was promising, and now that’s all been pulled back.”

The result, experts and industry officials say, is reduced trust between the public and private sectors, a diminished understanding on each side of the other side’s needs and concerns, a declining capacity to plan for future attacks and a growing national vulnerability to debilitating hacking campaigns — all at a moment when the Trump administration’s intervention in Israel’s war with Iran has raised fears of retaliatory Iranian cyberattacks on U.S. critical infrastructure.

“We are seeing something unprecedented in cybersecurity — a government deliberately deciding to disinvest in its capabilities,” said Michael Daniel, the president of the Cyber Threat Alliance, who served as President Barack Obama’s cybersecurity adviser. “I don’t see how this retrenchment can do anything other than make us worse off.”

Lost cyber protections

Nation-state hackers and cybercriminals have repeatedly breached and sometimes disrupted U.S. critical infrastructure in recent years, including in the key sectors of healthcare, energy, water and telecommunications. These intrusions have heightened fears about companies’ readiness to withstand more serious attacks, as well as underscoring the urgency of government efforts to assist them.

But under the Trump administration, agencies’ engagements with their critical infrastructure partners have varied widely, with some conversations continuing while others have almost entirely stopped.

The Department of Homeland Security’s elimination of the Critical Infrastructure Partnership Advisory Council (CIPAC) framework in March 2025 has been the most seismic disruption. CIPAC allowed government and industry representatives to discuss sensitive cybersecurity information — including about companies’ security vulnerabilities — without meeting standard transparency requirements that would expose that information to the public. Without CIPAC, critical infrastructure operators have dramatically reduced their sensitive cyber conversations with the government, according to a wide range of industry representatives, all of whom described the dissolution of CIPAC as disastrous.

The absence of CIPAC “creates this big fear” and poses “a huge risk” for companies that want to share cyberthreat information with the government, said an energy industry representative. “There's that doubt of, ‘Are we sharing too much?’”

CIPAC’s demise forced the telecommunications sector to suspend or modify several projects it was working on with the government, causing a significant impact, according to a communications sector representative. The sector had to take on more responsibility for an internet routing security initiative previously led by the White House, pause research on artificial intelligence–powered threat intelligence and freeze a collaboration with the National Security Agency on nation-state attacks. The interruptions come as telecom companies reel from China’s “Salt Typhoon” campaign of extensive and alarming intrusions into their networks.

Federal agencies are working on a replacement for CIPAC that would broaden the range of private-sector participants in meetings, according to multiple industry figures, who said it was urgent that the government launch that replacement as soon as possible.

The oil and natural gas industry is currently refusing to share the products of its cyber working groups with the government “until we are assured that we have those [CIPAC] protections,” according to an energy industry representative.

In the meantime, the industry canceled its spring 2025 meeting with the government because companies didn’t know what they’d be able to safely share. Sector leaders have scheduled another meeting in anticipation of a CIPAC replacement, but if that fails to materialize, the industry doesn’t expect cyber conversations with the government at the meeting to be very productive.

DHS declined an interview request for this story, and the department did not respond to a question about the CIPAC replacement.

Sharing has ‘tapered off’

The Trump administration’s changes have also undermined some cyber information sharing, the cornerstone of the public-private partnership keeping critical infrastructure safe from hackers.

Because the private sector operates most critical infrastructure, it knows more than the government does about how that infrastructure works, what cyberattacks are occurring against it and what the impact of a successful intrusion would be, according to John Riggi, the national adviser for cybersecurity and risk at the American Hospital Association and a former FBI cyber partnerships official. The industry, in turn, relies on the government to supply both unique foreign intelligence and cyberthreat information for which it would otherwise have to pay private firms. Small infrastructure operators with threadbare security budgets are especially dependent on this free information.

But information sharing “is taking a minor hit,” according to Errol Weiss, chief security officer at the Health-ISAC, the industry’s information sharing and analysis center. The pace of alerts from the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI “definitely looks like it's slowing down a bit,” Weiss said. Riggi described a delay in receiving threat intelligence from CISA “because of the leadership change,” though he said sharing with the FBI “continues to be very robust.”

Threat briefings are still occurring, industry figures said, but their frequency has become uneven as relationships with agencies have grown strained and federal workers have retired or been laid off. “They definitely tapered off,” a water industry representative said. (EPA press secretary Brigit Hirsch said the agency has continued to provide briefings “with the same cadence” as in the past.)

Trump’s federal travel restrictions have also made it harder for government employees to attend industry events and tour infrastructure facilities. “It's difficult … to get them to meetings,” Weiss said. It took a long time for government officials to get permission to attend the industry’s annual tabletop exercise in June 2025, which will game out how the country would respond to a major cyberattack on healthcare facilities.

At the same time, Trump has continued a project that former President Joe Biden launched in 2024 to speed up the pace of briefings. The Critical Infrastructure Intelligence Initiative, run by CISA and the intelligence community, provides cleared industry officials with a classified readout on the threat landscape on the first Wednesday of every month. A second water industry representative called it an improvement over the briefings for smaller groups of industry leaders at biannual sector leadership meetings.

An unrecognizable CISA

No agency has seen more change under Trump than CISA, according to experts and industry figures.

Congress created CISA in 2018, during the first Trump administration, to serve as the hub of the government’s cybersecurity partnerships with U.S. infrastructure operators. But CISA’s efforts to counter misinformation during the 2020 election transformed it into a conservative bogeyman, and the second Trump administration quickly began targeting the agency, freezing its election security work, pushing out roughly one-third of its 3,300-person workforce, ending threat-hunting contracts and proposing even deeper cuts.

Now, infrastructure operators say they barely recognize the fledgling but ambitious agency they had gotten to know over the past six years.

“With CISA, there is no partnership. It’s gone,” said a second energy industry representative. “We can’t even seem to get meetings with the necessary folks there.”

CISA’s recent cuts “have severely affected the agency’s ability to engage meaningfully with industry stakeholders,” said Jen Sovada, general manager of the public sector at the operational technology security firm Claroty.

CISA spokesperson Marci McCarthy said the agency “remains fully committed to its core mission of securing the nation’s critical infrastructure and enhancing cybersecurity resilience,” adding that “public-private collaboration is defined by outcomes such as reduced risk, improved response, and strengthened trust, not by the number of meetings.”

But CISA employees say they’re deeply frustrated with the changes and reductions at their agency. “We are at a bit of a standstill,” said one CISA staffer, who requested anonymity to speak freely. “People are adjusting to having lost a good chunk of our workforce. … We are trying to find the new ‘normal’ given the departures and [changing] mission parameters.”

The Joint Cyber Defense Collaborative, which the agency launched in 2021 to make its public-private partnerships less conversational and more operational, has seemingly fallen dormant. “I have not heard a peep from JCDC the last few months,” said the first energy industry representative. The industry spent two years working with JCDC on a “multi-part” effort to address state-backed cyberattacks on midstream gas pipelines, this person said, but the nearly completed project hit bureaucratic snags toward the end of last year, “and now I have no idea the status of it.”

A public-private task force focused on securing technology supply chains, co-led by CISA and the IT and telecom sectors, has effectively shut down following the loss of CIPAC. The task force’s high-level meetings “have gotten canceled every week,” a telecom industry representative said.

Trump’s cuts have also forced out many of CISA’s regional advisers, who serve as field liaisons connecting infrastructure operators with the agency’s free guidance and services. As a result, CISA has “gone off the grid” in many states, the first water industry representative said. “If all your CISA folks leave in your state, who are you supposed to call? … Nobody's communicating that.”

The loss of CISA advisers undermines infrastructure operators’ readiness to fend off cyberattacks, according to industry representatives who recounted these advisers providing briefings, participating in tabletop exercises, advertising free CISA services like vulnerability scans and serving as emergency resources.

“Water system operators were trained to reach out to those CISA points of contact,” said the first water industry representative, “and now they don't know who to contact. So either information that needs to get to the government is not getting there, or it's taking longer.”

Hamstrung SRMAs

In addition to the struggles at CISA, infrastructure operators have also reported problems with the specialized Sector Risk Management Agencies (SRMAs) that help various industries deal with cyber and physical threats.

Around the time of the change in administrations, the EPA and CISA canceled a series of planned meetings with state water overseers, according to a third water industry representative. Hiccups like this have compounded what industry leaders said was the EPA’s already-anemic ability to help the sector withstand attacks. 

Hirsch, the EPA press secretary, said the agency “will continue prioritizing staffing and resources” for cyber support, adding that EPA considers cybersecurity “one of its highest priorities.”

Meanwhile, the healthcare community is deeply concerned about the future of cyber aid from the Department of Health and Human Services.

The Trump administration is demoting and restructuring the HHS wing that handles the department’s SRMA work. “It seems like they’ve taken a step back,” a healthcare industry representative said. The sector used to meet regularly — sometimes weekly — with HHS to discuss critical infrastructure cybersecurity, Weiss said, “but since the new administration, all of that’s gone.” 

HHS did not respond to multiple interview and comment requests for this story.

Members of the energy sector said their cyber partners at the Department of Energy and the Transportation Security Administration (which protects oil and gas pipelines) were trying their best but facing political headwinds. The second energy industry representative said “DOE is busting its butt” to help industry despite a lack of leadership support, while the remaining staffers at the TSA are “trying really hard to save the ship.”

DOE and TSA did not respond to requests for comment.

“There is a degradation of support that is happening,” said Caitlin Durkovich, who served as Biden’s deputy homeland security adviser for resilience and response.

‘Vacant seats’

As Trump appointees have pushed to shrink their agencies, key points of contact for infrastructure operators have left the government, leaving companies and their trade groups in the dark about who to call for cybersecurity help.

Those departures have eroded important trust relationships between the public and private sectors.

“If I get a phone call from somebody at CISA who's worked incident response efforts with me, I'll drop everything and take that call, because I know it's important … and likewise, if I call them, they’re going to answer my call,” Weiss said. “If we don’t have the ability to interact on a regular basis like this, [and] if the players change, we’re not going to have those relationships.”

And it isn’t just trust that takes time to build. Departing staffers “had built up substantial knowledge about the sectors they worked with,” said Daniel, the former White House cyber adviser, “and the government has now lost the benefit of that expertise, which will be difficult to replace.”

Worries over response to future cyberattacks

As they navigate canceled meetings and missing points of contact, industry officials say they’re not waiting around for the government to tell them how to protect their sectors.

“It's become even more evident that the private sector’s got to take an active role here because of all the cutbacks,” Weiss said.

Infrastructure operators proudly tout the fact that they, not government agencies, already have most of the technical experience necessary to operate and protect their systems. But they worry about filling any void in information sharing left by a shrinking government.

Some critical infrastructure communities are now worried about what would happen in the event of a devastating cyberattack.

“If there is a major sector incident, I worry about the response capability of the government,” Weiss said. With the current level of support from the government, one water industry representative said, a widespread intrusion into water systems “could be disastrous.” Asked about the government’s ability to help contain a major hack in the natural gas sector, the second energy industry representative said, “I no longer know.”

This industry pessimism has only exacerbated the alarm that many cyber experts feel about recent events.

“We really can’t afford to roll back the capabilities and strength that come from public-private collaboration,” said Phil Reitinger, president and CEO of the Global Cyber Alliance. “The risk is too great.”

NATIONAL HARBOR, Md. — Artificial intelligence is poised to transform the work of security operations centers, but experts say humans will always need to be involved in managing companies’ responses to cybersecurity incidents — as well as policing the autonomous systems that increasingly assist them.

AI agents can automate many repetitive and complex SOC tasks, but for the foreseeable future, they will have significant limitations, including an inability to replicate unique human knowledge or understand bespoke network configurations, according to experts who presented at the Gartner Security and Risk Management Summit in June 2025.

The promise of AI dominated the Gartner conference, where experts shared how the technology could make cyberdefenders’ jobs much easier, even if it has a long way to go before it can replace experienced humans in a SOC.

“As the speed, the sophistication, [and] the scale of the attacks [go] up, we can use agentic AI to help us tackle those challenges,” Hammad Rajjoub, director of technical product marketing at Microsoft, said during his presentation. “What’s better to defend at machine speed than AI itself?”

A silent partner

AI can already help SOC staffers with several important tasks, according to security experts in their presentations. Pete Shoard, a vice president analyst at Gartner, said AI can help people locate information by automating complex search queries, write code without “having to learn the language” and summarize incident reports for non-technical executives.

But automating these activities carries risks if it’s mishandled, Shoard said. SOCs should review AI-written code with the same “robust testing processes” applied to human-written code, he said, and employees must review AI summaries so they don’t “end up sending nonsense up the chain” to “somebody who's going to make a decision” based on it.

In the future, AI might even be able to automate the investigation and remediation of intrusions.

Most AI SOC startups currently focus on using AI to analyze alerts “and reduce the cognitive burden” on humans,” said Anton Chuvakin, a senior staff security consultant in the Office of the CISO at Google Cloud. “This is very worthwhile,” he added, but “it's also a very narrow take on the problem.” In the far future, he said, “I still want the machines to remediate, resolve certain issues.”

Some IT professionals might “freak out” about the prospect of letting AI loose on their painstakingly customized computer systems, Chuvakin said, but they should prepare for a future that looks something like that.

“Imagine a future where you have an agent that's working on your behalf, and it's able to protect and defend even before an attack becomes possible in your environment,” Microsoft’s Rajjoub said during his agentic AI presentation.

Rajjoub predicted that by the end of 2025, AI agents will be able to reason on their own and automatically deploy various tools on a network to achieve their human operators’ specified goals. Within a year and a half, he said, these agents will be able to improve and modify themselves in pursuit of those goals. And within two years, he predicted, agents will be able to modify the specific instructions they’ve been given in order to achieve the broader goals they’ve been assigned.

“It's not two, three, four, five, six years from now,” he said. “We're literally talking about weeks and months.”

Limitations and risks

But as AI agents take on more tasks, monitoring them will become more complicated.

“Do we really think our employees can keep up with the pace of how agents are being built?” said Dennis Xu, a research vice president at Gartner. “It’s likely that we are never going to be able to catch up.”

He proposed a bold solution: “We need to use agents to monitor agents. But that’s further out on the time horizon.”

Many analysts urged caution in deploying AI in the SOC. Chuvakin described several categories of tasks, some “plausible but risky” and others that he would “flat-out refuse” to believe AI could accomplish in the near- to medium-term future.

In the risky category, Chuvakin listed autonomous tasks like patching legacy systems, responding to intrusions and attesting to regulatory compliance. “I've seen people who use consumer-grade ChatGPT to fill [out] compliance questionnaires,” he said. “I wish them all the luck in the world.”

Tasks that Chuvakin said he can’t imagine AI accomplishing anytime soon include strategic risk analysis, crisis communications and threat hunting against top-tier nation-state adversaries. Fighting advanced hacker groups “is a human task,” he said, “because ultimately, as of today, humans still outsmart machines.”

Gartner’s Shoard noted that using AI to create tabletop exercises could make staffers overly dependent on AI to warn them about evolving threats, while using AI to create threat detection queries might diminish employees’ investigative skills. “You're going to end up with underdeveloped staff,” he said, “staff that over-depend on things like AI.”

Preserving ‘tribal knowledge’

AI will never replace humans in a SOC, multiple experts said, because human judgment is an essential part of analyzing and responding to security incidents.

“A lot of things we do in a real SOC … involve things that are tribal knowledge,” Chuvakin said, referring to practices that aren’t formally documented. AI will struggle to perform these activities — Chuvakin said he’s seen a lot of models recommend actions that make no sense for the specific networks in which they’re operating. In particular, he said, AI still can’t write threat-detection rules tailored to highly customized legacy IT environments “because of all the peculiarities” in how they’re set up.

Chuvakin urged companies on the receiving end of startups’ “AI-SOC-in-a-box” pitches to “ask them about how this magic would [address] things that are in human heads.”

AI also can augment SOC analysts’ skills and capabilities. Shoard called it “a massive force multiplier” for a SOC workforce, but he warned companies not to rely too much on it.

“If you think you can sack your SOC staff just because you've suddenly bought an AI function, I think you're going to be soundly disappointed,” Shoard said. “AI won't replace your security staff, so use it to enhance them [and] make them better in their jobs.”

In AI we (need to) trust

In the SOC of the future, humans won’t just work alongside AI agents, experts said. They’ll also need to monitor those agents.

“We don't want complete autonomy,” said TIAA CISO Upendra Mardikar. “We have to have a human in the loop.”

Those humans will need to ensure that AI agents’ actions are auditable and controlled by company policies, experts said. Jose Veitia, director of information security at Red Ventures, said businesses should “make sure all the actions are validated.”

Designing an automated system requires feeding it the right data. “If we allow a machine simply to make the decisions for us,” Gartner’s Shoard said, “then we've got to trust that it has all of the relevant information to make that decision effectively.”

Trust and verification were common themes in AI discussions throughout the Gartner conference this week.

“Trust has to be the fabric on which these agents are built,” Rajjoub said. “The more prevalent and capable the agents become, the more critical their security becomes for all of us.”

But as AI agents become more capable, their value in the SOC could increase significantly.

“Unfortunately, AI isn't magic. I don't think it ever will be,” Shoard said. “But it is going to improve things for us in the SOC. You should consider it with great care, but consider it experimentally and use it.”

Sponsored content

By Deepwatch

In an ideal world, every security operations center (SOC) would run 24/7, staffed by well-rested analysts with clear signals, automated playbooks, and enough budget to stay ahead of every threat.

In reality? Most CISOs are staring down an impossible tradeoff: stretch internal teams beyond capacity, or accept gaps in visibility and response.

As threats increase in both frequency and sophistication—and boards demand proof that cyber risk is under control—the traditional model of standing up and staffing a round-the-clock SOC is reaching its breaking point.

The 24/7 Coverage Dilemma

Modern adversaries don’t clock out at 5 p.m. And with cloud sprawl, distributed workforces, and AI-driven attacks, the attack surface never sleeps. A delayed response isn’t just inconvenient—it’s a liability. Dwell time drives cost. Missed signals become breaches. And internal teams, even the most committed ones, can’t operate in constant crisis mode.

Yet building a truly resilient 24/7 operation remains out of reach for many organizations. Talent is expensive—and scarce. Alert fatigue erodes morale. Hiring around-the-clock coverage requires not just people, but process maturity, continuous tuning, and the ability to sustain high performance during nights, weekends, and holiday spikes.

The cost? Not just in dollars, but in burnout, turnover, and operational instability.

Why the Old Model Doesn’t Scale

For years, the go-to answer was: just hire more analysts. Spin up a bigger team. Train harder. Work smarter.

But in 2025, that model no longer scales.

CISOs aren’t just battling attackers—they’re battling expectations. The board wants faster containment. Audit wants cleaner documentation. Internal stakeholders want minimal friction. All while the team triages an endless stream of alerts and tries to keep up with an evolving tech stack.

In this environment, throwing people at the problem is no longer sustainable. What’s needed is a model that doesn’t depend on heroics.

From Coverage to Resilience

The real goal isn’t coverage—it’s resilience. That means having the ability to detect, respond, and recover with speed and confidence, regardless of the hour or who’s on call.

That shift requires a rethink: not just how you staff, but how you architect your detection and response capability.

More CISOs are turning to managed detection and response (MDR) models—but not the bolt-on, black-box variety of yesterday. What they’re looking for is a partner who can plug into their existing telemetry, extend their team’s reach, and deliver tailored, 24/7 operational muscle without the overhead of building it all internally.

This isn’t about outsourcing. It’s about augmentation—with accountability.

What Resilient SOC Leaders Are Doing Differently

Forward-leaning CISOs are asking sharper questions:

• Can we prioritize detections based on actual exposure, not theoretical risk?
• Can we correlate across our environment to reduce noise and focus on real threats?
• Can we scale our response capability without adding 20 headcount?

The answer, increasingly, is yes—if you rethink your approach. Resilience today is powered by three key capabilities:

1. Exposure-aware detection engineering that tunes detections based on actual business risk—not just signatures.
2. Continuous response readiness, including tabletop exercises and IR support that’s available when your team isn’t.
3. Operational transparency, so you don’t lose control of your environment—you gain clarity in how it’s defended.

It’s not about replacing your SOC. It’s about making it survivable.

A Better Way Forward

The SOC of 2025 doesn’t need to be built from scratch. It needs to be architected with intent—leveraging external partnerships to create an always-on detection and response capability without burning out your internal team.

This model is already in motion. It’s showing up in how CISOs structure their teams, report to the board, and design their tech stack. It’s less about command-and-control, and more about distributed resilience, where internal strategy and external execution move in lockstep.

At Deepwatch, we call this the Cyber Architect mindset.

 If you’re rethinking how to build sustainable, scalable security operations in 2025, download The Cyber Architect Playbook—a guide for CISOs navigating the shift from traditional SOCs to resilient detection architecture.

Learn More: The Cyber Architect Playbook

The senior information security executive at JPMorgan Chase is urging the software industry to prioritize secure development practices over speed to market, warning that increasing supply-chain disruptions are weakening the global economic system. 

Patrick Opet, global CISO at JPMorgan Chase, warned in an open letter in April 2025 that global companies are dependent on interconnected technologies and warned that software needs to be secure by default. 

Opet said that because global companies are increasingly reliant on a small number of software-as-a-service providers, a hack or other disruption can disrupt critical infrastructure providers around the world.

JPMorgan Chase officials have seen the warning signs up close, Opet said. 

“Over the past three years, our third-party providers experienced a number of incidents within their environments,” Opet wrote. “These incidents across our supply chain required us to act swiftly and decisively, including isolating certain compromised providers and dedicating substantial resources to threat mitigation.”

JPMorgan Chase in 2024 disclosed a third-party software issue that impacted more than 451,800 people, according to a filing with the Maine attorney general’s office. The flaw allowed three employees to see certain records of retirement plan participants. 

The bank faced trading disruptions because of the July 2024 international IT outage created by a faulty CrowdStrike software upgrade, according to Bloomberg. The outage caused 8.5 million Windows devices to fail, leading to widespread disruptions across the airline industry, health care, financial services and other critical industries. 

Modern identity protocols like OAuth create direct connections between third-party services and sensitive internal resources at companies, making it easier for attackers to gain access to confidential data or internal communications, Opet noted in the letter.

Threat actors are increasingly targeting third-party technology providers as a method of gaining access to sensitive documents and disrupting systems. Opet cited a March 2025 blog post about efforts by the China-linked espionage group Silk Typhoon to abuse remote-access tools and cloud applications to gain initial access to target networks. 

Opet wrote the letter on the eve of the 2025 RSAC Conference in San Francisco, where nearly 44,000 members of the cybersecurity industry discussed pressing issues like software security. 

Opet said he wanted to see improved security standards and more transparency in how suppliers use privileged access. He also said technologies like confidential computing could reduce risks when suppliers use sensitive information. 

“We’re looking for the software industry to recognize the criticality of risks today and collectively work together on a number of fronts,” Opet told Cybersecurity Dive. 

Opet’s letter echoes a recent call from former Cybersecurity and Infrastructure Security Agency director Jen Easterly for the software industry to embrace secure-by-design principles.

Software security leaders welcomed the letter, although some argued for even tougher measures, including potential legal liability.

“The software supply chain is uniquely vulnerable as no one party builds the entire software up and downstream, creating opportunities for bad actors to exploit,” Brian Fox, co-founder and CTO at Sonatype, told Cybersecurity Dive via email.

Security researchers are warning that the outbreak of direct hostilities between Israel and Iran may soon lead to malicious cyberattacks against critical infrastructure sites in the U.S. from state-linked actors, hacktivist groups and cyber criminals. 

State-backed and hacktivist cyber threats against Israel and the U.S.’s Middle Eastern allies are escalating, according to researchers at Radware. Experts have seen a spike in pro-Iran threat activity on Telegram and other public channels. 

Threat actors have warned Saudi Arabia and Jordan to expect attacks on their critical infrastructure if they help Israel in its conflict with Iran, and activist groups have claimed to have disrupted Israeli radio stations. 

While cyberattacks have thus far mainly targeted entities in the Middle East, researchers say U.S. infrastructure providers should harden their defenses against both direct intrusions and supply chain attacks targeting their third-party vendors.

“Iranian cyber activity has not been as extensive outside of the Middle East but could shift in light of the military actions,” said John Hultquist, chief analyst at Google Threat Intelligence Group, in June 2025.

“Targets in the United States could be reprioritized for action by Iran’s cyberthreat capability,” Hultquist said. “Iranian cyberespionage activity already targets the U.S. government, military, and political set, but new activity may threaten privately owned critical infrastructure, or even private individuals.”

Security leaders in multiple sectors are raising concerns about a spike in Iran-linked threat activity, citing previous hacks that followed Hamas’s October 7, 2023, attacks on Israel and Israel’s subsequent invasion of Gaza. 

Google previously issued guidance on how Iran-aligned groups were targeting entities in both Israel and the U.S. in connection with the Gaza conflict. 

One of the most serious attacks, conducted by a collection of Iranian hacktivists and operatives working for Tehran, targeted the U.S. water sector by exploiting flaws in Israeli-made industrial equipment. 

“These actors are increasingly sophisticated and often overlap strategically with the goals of state-sponsored objectives,” said Scott Algeier, executive director of the Information Technology Information Sharing and Analysis Center and the Food and Agriculture Information Sharing and Analysis Center. “These hacktivist groups will leverage a variety of tactics, including the exploitation of vulnerable systems, targeted spear-phishing, and data collection, and are known to carry out both disruptive and destructive attacks.”

Critical infrastructure organizations need to harden their networks, educate themselves about Iran-affiliated threat groups and begin heightened monitoring for suspicious activity, according to a joint statement from the Food and Ag-ISAC and IT-ISAC.

Security, privacy and related trust issues remain some of businesses’ biggest concerns about generative artificial intelligence, according to a pair of reports.

As businesses face more pressure to integrate AI into their workflows, they are confronting difficult questions about the technology’s reliability and auditability.

Many companies are allocating new slices of their budgets to AI investments, including in agentic AI, which uses autonomous systems to perform complex tasks.

Two reports — one that KPMG released in June 2025 and one that Thales released in May 2025 — illustrate how generative AI is raising security concerns for business leaders.

Business leaders surveyed by KPMG reported prioritizing security oversight in their generative AI budgeting decisions, with 67% saying they plan to spend money on cyber- and data-security protections for their AI models. Fifty-two percent cited risk and compliance as a budgetary priority.

Those spending decisions reflect corporate executives’ growing worries about AI security. In KPMG’s new Q2 2025 report, 69% of leaders cited concerns about AI data privacy, a significant increase from the 43% who cited it in Q4 2024. Regulatory concerns around AI also grew, from 42% to 55%.

Andrew Lohn, senior fellow at Georgetown University’s Center for Security and Emerging Technology, told Cybersecurity Dive that companies’ security spending was “a good sign that they are serious about using AI and not just experimenting with it.”

Thales’ annual data threat report, based on a survey of 3,200 IT and security professionals in 20 countries and 15 industries, echoed similar trends. The top four risks related to generative AI among respondents were the rapid transformation of the ecosystem (which made 69% of respondents’ lists), data integrity issues (64%), trust (57%) and confidentiality (45%).

AI security ranked high on the list of respondents’ biggest security-related expenses. One in 10 respondents said it was their largest expense, 13% ranked it second and 7% ranked it third. Overall, AI security ranked second on Thales’ list of organizations’ top security expenses.

The fact that only 10% of respondents ranked AI security first, despite so many companies citing security as a top AI concern, suggests “a misalignment in how organizations purchase and maintain AI systems,” said Nick Reese, co-founder and COO of the AI company Frontier Foundry.

“To start getting real value from AI investments,” Reese told Cybersecurity Dive, “the market will need to square the lack of trust and confidence in AI with the need to stress test [AI models] in a way that dispels those fears.”

Thales also found that “73% of respondents said they are investing in AI-specific security tools with either new or existing budgets.” More than two-thirds of respondents reported buying AI security tools from their cloud vendors, 3 in 5 reported buying them from their security vendors and roughly half reported buying them from new vendors.

As agentic AI grabs the spotlight in the business community, KPMG found that corporate leaders “are showing evolving comfort levels” with the technology. 

In Q4 2025, 63% of respondents told KPMG that they were prioritizing deploying AI agents from “trusted tech providers”; in the firm’s Q2 2025 report, that number dropped to 55%. Similarly, 45% of respondents in Q2 said they were “not allowing AI agents access to sensitive data without human oversight,” down from 52% in Q4 2024. 

On the other hand, the proportion of respondents who said they weren’t yet comfortable fully turning tasks over to AI agents increased from 28% to 45%.

The threat of cyberattacks represents the most serious challenge for businesses in the coming year, the advisory firm Kroll said in a report published in June 2025.

Roughly three-quarters of respondents said their cybersecurity and privacy concerns had increased over the past year, with nearly half citing malware and more than a third citing data extortion as specific fears.

Kroll’s survey of 1,200 respondents from more than 20 countries, conducted in February 2025, provides some measure of how businesses are thinking about and dealing with cyber worries as global tensions escalate.

Governments around the world have responded to cyber-risks by imposing new security and privacy regulations on businesses, but Kroll’s report finds that many businesses remain uncertain about their ability to comply with these new rules.

“When it comes to addressing the patchwork of global data privacy laws and the impact on their businesses, just 12% of respondents globally ranked their organizations as ‘extremely prepared,’” Kroll said in its report. The average business gave itself a 7.4 score out of 10.

The European Union has enacted some of the strictest privacy regulations, but European companies were the least confident, on average, in their compliance capabilities, with an average score of 6.7. Kroll said the lower score “likely reflects a greater awareness of compliance challenges,” as multinational companies study “new U.S. privacy requirements [coming] online at the state level.”

“European companies operating internationally are increasingly concerned about the changes they’ll need to make to their existing privacy programs to stay compliant,” Tiernan Connolly, a managing director in Kroll’s Europe, Middle East and Africa cyber- and data-resilience practice, said in the report.

Financial-services firms and technology companies reported the highest level of preparedness among industries, with an average score of 7.7, which Kroll attributed to the fact that they both regularly handle sensitive data.

Kroll’s survey contains an important and worrying data point about companies that reported compliance concerns: “Of those concerned, less than half have increased budgets, expanded teams, upskilled their workforce or hired external experts to prepare for the cyber and data privacy challenges ahead,” the report said.

When it comes to companies’ growing adoption of artificial intelligence, 93% of respondents in the survey said they had integrated AI into their businesses, with 50% saying they were using it for cybersecurity and IT. 

But many of these companies are still improvising when it comes to adding AI to their systems. “Of those already using AI, 63% do not have AI transparency or explainability efforts in place,” Kroll said, “and 59% have not implemented any AI policies and guidance for employees.”

Nearly 30% of cybersecurity executives say privacy and security issues related to artificial intelligence represent their top concern, surpassing ransomware and other forms of malware, according to a 2025 report from Arctic Wolf.

The report, based on a survey of more than 1,200 leaders in 15 countries, highlighted trends such as ransomware negotiators reducing payouts, the widespread nature of breaches and attitudes about companies’ perceived returns on their cyber investments.

Another interesting data point: Nearly 85% of security leaders said they used next-generation endpoint security software, but only 40% said the tools gave them full visibility into their networks.

Arctic Wolf’s report captures the opinions of the security profession at a pivotal moment, as threat actors adapt to changes in the capabilities of AI and the profitability of different kinds of attacks. Companies are eager to use AI in some form, with 86%of them having established AI use policies, according to the report. But AI-driven security solutions still aren’t generating a significant return on investment — those technologies topped the list of devices creating “the least value” in corporate security programs, with 18% of respondents citing them. 

“While AI devices are great during demonstrations,” Arctic Wolf’s report observed, “they tend to underperform in the real world. This discrepancy is at least somewhat due to impractically high false positive rates. … [I]t will likely be a long time before the accuracy improves enough to put more trust in these devices.”

At the same time, AI is a major driver of companies’ cybersecurity planning. 

“Data transformation and secure AI adoption” topped the list of factors driving respondents’ strategic decision-making, earning a mention from 45% of respondents. Privacy and data protection came in second, followed by risk management. Arctic Wolf bemoaned this mismatch between strategic motivators and real-world threats, noting that AI-generated attacks pale in comparison to breaches that rely on common weaknesses. 

“Training staff to recognize phishing lures, MFA bombs, and other common — and unfortunately effective — techniques is a cost-effective way to improve an organization’s resilience,” the report said. “However, ‘building a culture of security awareness’ was only selected by 31% of respondents [as a strategic driver].”

Rich Campagna, senior vice president of product management at Palo Alto Networks, said it's understandable that companies want to focus so much on AI threats, given that the AI space is complicated and rapidly changing. But, he added, “Overemphasizing on future threats like AI can lead to gaps in defending against the more routine, yet still highly effective, attack vectors that adversaries continue to exploit daily.”

While ransomware receives significant public attention, business-email compromise scams remain equally potent. Twenty-three percent of respondents reported suffering a ransomware or data-exfiltration attack in 2024, but 35% said they had experienced a BEC attack. Another 35% said they experienced a “significant malware infection.” Seventy percent of respondents said their companies experienced at least one significant cyberattack, and 64% of those attacks led to at least three months’ worth of lost productivity.