Threat Intelligence

Eight months after the Multi-State Information Sharing and Analysis Center lost its federal funding, the cybersecurity threat intelligence sharing group for state and local governments has lost dozens of states and more than ten thousand local jurisdictions that can no longer afford its vital cybersecurity services, even as the hacking threats they face have grown more numerous and more dangerous.

The MS-ISAC, run by the nonprofit Center for Internet Security (CIS), says it’s working hard to recruit new members, including through discounted fees, and it stresses that it’s still collecting enough data from its remaining members to produce high-quality cyber threat intelligence for that community. But the MS-ISAC’s membership drain could leave thousands of small jurisdictions and their critical infrastructure more vulnerable to nation-state sabotage and ransomware attacks — local impacts that could resonate nationally at a time when China and Iran are using cyberattacks as a tool of foreign policy in their conflicts with the U.S.

“Community security is national security,” said Sarah Powazek, program director of public interest cybersecurity at the UC Berkeley Center for Long-Term Cybersecurity. “I cannot overstate the local instability caused by critical services [being] forced offline by a cyberattack — schools close, water stops flowing and public life grinds to a halt.”

Experts say the MS-ISAC’s struggles are a stark example of how the Trump administration’s abandonment of traditional federal responsibilities is undermining U.S. cybersecurity.

“Just as the threat environment is poised to accelerate at an exceptional rate,” Samir Jain, the vice president of policy at the Center for Democracy and Technology, said at a recent House hearing, “the federal government has dramatically pulled back.”

Membership cut by more than half

For more than 20 years, federal subsidies allowed the MS-ISAC to offer free memberships to state and local governments. But after the Department of Homeland Security (DHS) abruptly canceled that funding in 2025, the group had to start charging membership fees. Between cities and counties that couldn’t afford the new fees and states that had already passed budgets for the year, the MS-ISAC’s membership roster plummeted.

As of mid-June 2026, 21 states, two territories and roughly 2,700 local jurisdictions — including cities, counties, school districts, library systems, hospitals and police departments — are members of the MS-ISAC, according to CIS. Fifteen states pay for memberships that include all of their localities, adding another 2,895 organizations to the group. That puts the current total at 5,618 organizations. On the day that the MS-ISAC lost its federal funding, it had 18,574 total members, including all 56 states and territories. Since then, it has lost roughly 70% of its membership.

Connecticut found the money to cover the unexpected new MS-ISAC expense, but “we are not sure if we will be able to continue,” said John McKay, a spokesman for the state’s administrative-services agency. Virginia is hammering out a new membership agreement but has had to “scale down our agreement due to the loss of federal funding,” said Jennifer Guild, a spokeswoman for the state’s IT agency.

Washington State’s budget deficit forced it to leave the MS-ISAC, depriving nearly 500 local entities of “a shared operating picture,” said Vickie Sheehan, the communications director for the state’s technology agency.

Meanwhile, Kentucky left the MS-ISAC after reviewing its own cybersecurity programs and determining that a membership “did not represent an effective return on investment,” said Kinsey Woodson, the communications director for the state’s finance division.

Colorado and Michigan also said they left the group.

In an interview with Cybersecurity Dive, CIS president and CEO John Gilligan said he considered it a “huge success” that the MS-ISAC had been able to retain almost half of its state members. “Given the short notice, the lack of planning for funding [and] the fact that the states and the local jurisdictions are generally under severe financial pressures, we’re not far from what our projections were.”

CIS continues to subsidize MS-ISAC fees for some of the nation’s smallest localities. The group has 1,592 “tier one” jurisdictions — those with annual operating budgets below $25 million — and 254 of them receive subsidies, in the form of either free memberships or discounted rates.

Thousands of localities still haven’t canceled or begun paying for their memberships. “In the last month, we have begun to offboard them,” Gilligan said, starting with jurisdictions that don’t use many of the MS-ISAC’s services.

Growing risks to state and local infrastructure

The MS-ISAC’s services form a major protective barrier for many U.S. states and cities. Losing those protections could dramatically weaken their cyber defenses, leading to more disruptions at local hospitals, courts, water systems and emergency-dispatch centers and increasing the risk of regional or national cyber crises.

Many local governments already struggle to fund essential services like water, trash collection and emergency services. Every new expense threatens to upend that delicate balancing act. “It’s definitely creating challenges that folks were hoping they would not have to face,” said John Matelski, chief information officer and managing director at the National Association of Counties.

Even larger counties may struggle to afford the MS-ISAC’s fees. “They may have more in their coffers, but they also have more things in their queue,” Matelski said. “This really isn’t a big-versus-small issue. It really is an issue that affects everybody.”

Organizations that leave the MS-ISAC lose access to a vast network of cyber threat data that is vital for maintaining situational awareness amid growing threats. The group publishes alerts about ransomware attacks, shares indicators of compromise for intrusion campaigns and recommends defensive measures.

“Without these types of services,” Matelski said, “we’re all just that much more vulnerable.”

Local governments that lose access to MS-ISAC services and intelligence will also struggle to maintain affordable cyber insurance or get payouts after incidents, because insurers consider factors like ISAC membership and access to third-party incident-response support.

The Cybersecurity and Infrastructure Security Agency (CISA) might be able to fill part of the void left by the loss of MS-ISAC services, but over the past 16 months, the Trump administration has dramatically downsized CISA and reorganized its partnership programs, leaving many state and local officials unsure of how much they can rely on the agency. (CISA “communicates with our state and local partners regularly and provides them with timely threat intelligence, expertise, no-cost tools and resources,” Christine Serrano Glassner, the agency’s chief external affairs officer, told Cybersecurity Dive.)

Some lawmakers want to act. Senate Intelligence Committee ranking member Mark Warner, D-Va., has drafted a bill that would require the government to resume funding the MS-ISAC. “Defunding critical infrastructure protections has led to information silos and deprived communities across the nation of the ability to collaborate on securing our critical infrastructure,” Warner wrote to DHS Secretary Markwayne Mullin

Funding loss transforms MS-ISAC

The loss of federal subsidies has sparked several changes at the MS-ISAC.

Facing a tighter budget, the Center for Internet Security reduced staff at the ISAC and began looking for ways to automate more tasks. The onboarding process now involves a self-guided tour through a portal rather than a human-led welcome session. “We’ve put a lot more emphasis” on automation, Gilligan said, “because we just don’t have as many people to do the the outreach activities.”

At the same time, the MS-ISAC says it’s still receiving plenty of threat intelligence from its members and publishing a steady stream of reports and guidance based on that data. The group collects telemetry from roughly 400,000 endpoint security devices, thousands of protective DNS users and nearly 1,100 intrusion-detection sensors, although all three of those data sources have seen slight dips as state and local governments have canceled their memberships.

“We’re getting as good quality threat information as we have in the past,” Gilligan said. “We’ve actually increased the analysis and the breadth of types of reporting that we’ve been providing to the state and local community.”

Still, the loss of federal subsidies has ratcheted up the pressure on CIS, which spent roughly $1 million per month subsidizing the MS-ISAC in 2025. Gilligan said the nonprofit still provides “some subsidies” to the ISAC, but he wouldn’t say for how long that would continue. “We’re looking at the end of this year to start seeing more stability.”

To demonstrate its value to current and prospective members, the MS-ISAC is touting its focus on the full spectrum of physical and cyber threats facing state and local governments; educating a wider range of local leaders outside of IT and security offices; and pushing a “whole-of-state” model that encourages states to extend their memberships to typically overlooked entities such as court systems and legislatures.

Pivotal summer

The summer months of 2026 will prove a crucial test of the MS-ISAC’s ability to demonstrate its value. When many states’ annual budgets take effect on July 1, CIS hopes to see them include money for membership fees.

At the local level, meanwhile, IT and cybersecurity leaders are scrambling to fund either MS-ISAC memberships or replacements. “There is still concern about, how do we maintain some level of minimum baseline cyber capability?” Matelski said.

Meanwhile, questions remain about the long-term viability of CIS’s subsidies to cash-strapped jurisdictions. If those discounts end, experts said, local governments’ cybersecurity woes will skyrocket.

With foreign adversaries constantly probing U.S. networks for weaknesses, some state leaders say the federal government’s attempts to distance itself from the MS-ISAC will only make things worse.

“No state can tackle cyber defense alone,” said Colin Ahern, New York State’s director of security and intelligence. “These moves will shrink visibility, reduce information sharing and threaten operational collaboration at a time when we can least afford it.”

As some of the organizations that run essential services in the U.S. lose faith in the federal government’s willingness and ability to help them, a few of the biggest critical infrastructure operators are taking matters into their own hands to improve coordination — and prepare for a major crisis.

In February 2026, a coalition that includes corporate titans JPMorgan Chase, Mastercard, AT&T and Berkshire Hathaway Energy launched the Alliance for Critical Infrastructure (ACI), vowing to take the lead in helping infrastructure sectors work more closely together to understand and mitigate the shared cybersecurity risks they face. Reading between the lines, the message was clear: The critical infrastructure community, increasingly alarmed at the Trump administration’s retreat from decades-long partnerships, is trying to fill the growing void of coordination and leadership.

Government budget cuts and personnel losses have made it much harder for agencies to support and advise infrastructure operators, and the White House has encouraged states to take over historically federal responsibilities for protecting local utilities. Amid those changes, infrastructure firms like the ones that founded the ACI say the private sector must step up.

Ben Flatgard, the ACI’s chairman, noted that the private sector manages the vast majority of U.S. infrastructure. “We can’t outsource that responsibility or the risk management practices that come along with it,” he said in an interview with Cybersecurity Dive. “We need to own the solution for that as well.”

Many experts say that while the government must retain a leadership role in protecting critical infrastructure, it’s a good sign that private companies want to assume more of the burden.

“If the private sector does not step up to self-organize,” said Brian Harrell, a former assistant director for infrastructure security at the Cybersecurity and Infrastructure Security Agency (CISA), “the nation faces a period of unprecedented visibility gaps in its most vital systems.”

‘Changing landscape’ after government cutbacks

The ACI is an evolution of the Tri-Sector Executive Working Group, which united energy, financial services and telecommunications industry leaders and served as a key private sector voice during both the Biden and first Trump administrations. Tri-sector leaders shaped executive-branch policies and legislation, including the influential recommendations of the congressionally chartered Cyberspace Solarium Commission. But despite helping Washington make progress, the companies continually fretted over the fact that infrastructure protection remained heavily siloed.

“We still weren’t getting to the cross-sector component, and we were [just] in our verticals,” Michele Guido, the ACI’s executive director, said in an interview.

Many infrastructure operators, especially the best-resourced ones, have “gotten really good within our silos,” said Flatgard, who leads cybersecurity policy for JPMorgan Chase. But individual corporate efforts won’t be enough to confront a truly wide-ranging crisis, he added. 

The ACI was formed “to start building those bridges between our sectors,” Flatgard said, because “there’s serious dependencies that we have on the others to operate our essential services.”

The second Trump administration’s changes to longstanding public-private partnerships also helped spur the companies to build something new.

Throughout 2025, the Trump administration purged CISA, eliminated a public-private coordination channel known as the Critical Infrastructure Partnership Advisory Council and considered shutting down the Federal Emergency Management Agency. “You just had a changing landscape,” said Guido, the strategic security policy director at the energy giant Southern Company.

Infrastructure operators saw the government stepping back and felt a new sense of urgency to move from a supporting role to a leading one.

To that end, the companies in the tri-sector restructured their group as a nonprofit that could recruit more members. The ACI is now creating working groups, defining pilot projects and reviewing membership applications. In addition to its formal members, the group will collaborate with government agencies, sector coordinating councils (SCCs), information sharing and analysis centers (ISACs) and cybersecurity think tanks.

The ACI won’t be a sprawling organization, however. Its leaders want to carefully choose a selection of infrastructure operators with the resources to contribute to its projects. At the same time, the group wants to consult with a wide range of organizations, including small utilities that may have something to teach the bigger players.

“Some of them may be less sophisticated in cyber,” Flatgard said, “but most of them are really good at responding to crises within their business and within their area of expertise. I think we have a lot to learn from those.”

Four-part strategy

Over the next 18 months, ACI members will dive into activities that support the four pillars of the group’s strategic plan.

The first pillar will focus on analyzing cross-sector dependencies — the organizations that support essential services in multiple sectors. “Within the verticals, you have all these plans, but no plans really come together to understand the cross-sector component,” Guido said. The ACI plans to publish a white paper offering a high-level overview of how each sector operates and how multiple sectors can work together, which will help infrastructure operators better understand each others’ needs.

The strategy’s second pillar will test ways to unite infrastructure sectors in responding to a “polycrisis” — a national-level emergency that simultaneously threatens a wide range of infrastructure, with both physical and digital consequences. “We want to develop an operational national response event protocol,” Guido said. “Who's making key decisions on that bad day, from the critical infrastructure perspective? We have continuity of government, but what does continuity of critical infrastructure look like?”

Success in this area would mean that infrastructure operators could “work through the fog of war” and smoothly take steps to maintain, rebuild and restart vital services, Flatgard said.

As part of this pillar, Guido said, the ACI is working with CISA to expand the agency’s cybersecurity incident-response playbooks to reflect cross-sector cooperation.

The third pillar addresses the private sector’s operational support to the government on countering adversaries’ malicious activities, including through expanded information-sharing. The fourth pillar deals with advising policymakers on legislation and regulation, which the ACI’s leaders said will remain important even as companies do more on their own.

‘That’s not how we plan’

The emphasis on cross-sector dependencies — areas of risk that no sector can fully understand or mitigate alone — distinguishes the ACI from other groups. ACI members will focus on evaluating the technologies that invisibly underpin multiple aspects of daily life, from the GPS satellites essential to smartphones, airplanes and tractors, to the undersea cables that connect AI and cloud computing data centers around the world.

The resulting analyses could help businesses across the critical infrastructure community better prepare for major cybersecurity incidents.

Natnael Habtesion, the chief security officer at ACI founding member Lumen Technologies, said the new group’s “recognition that threats to one sector rarely stay contained and can have adjacent impacts” is its unique value.

The ACI is especially focused on collaborative planning for a polycrisis. Guido conjured the image of a natural disaster that affects a region of the U.S. at the same time that it’s hit with a major cyberattack. “That's not how we plan,” she said.

In the tri-sector’s annual exercises over the past few years, infrastructure operators realized that the same strategies they used to prepare for, say, a geographically limited Category 5 hurricane weren’t very useful in a polycrisis. An environment of multiple simultaneous emergencies “stretches our capacity really thin,” Flatgard said.

Taking initiative, with allies and limitations

While the ACI is still in its infancy, it’s already thinking about how to test the ideas its members come up with. That could include regional pilot programs — on topics such as incident response, information sharing and service restoration — involving the most important organizations in a specified area, from water treatment plants to health clinics to military bases.

Partnerships with sector-specific groups will be critical to the ACI’s success. The group has already been talking to ISACs and SCCs to reassure them that it understands their role. “We don’t want this to be duplicative of existing sector functions and apparati,” Flatgard said.

Errol Weiss, the Health-ISAC’s chief security officer, said it was essential for the ACI to integrate with information-sharing groups like his. ISACs “already provide operational threat intelligence and sector‑specific context,” he said. “Duplicating or bypassing that ecosystem would risk confusion for operators.”

The ACI’s leaders also want a strong relationship with federal agencies. “We need the government’s help to be successful,” Flatgard said.

CISA recently published guidance to infrastructure operators on maintaining services during a crisis. The agency also plans to assess operators’ resilience through targeted engagements, but CISA’s staffing cuts may limit the scale of that work.

In addition, broader government-industry relationships are currently suffering in the absence of the Critical Infrastructure Partnership Advisory Council (CIPAC) framework, which let government and industry leaders meet privately without antitrust concerns. The Trump administration abruptly eliminated CIPAC with little explanation, and while DHS is developing a replacement, the government isn’t answering infrastructure operators’ questions about it.

“We still have to keep marching forward,” Guido said. The ACI wants a CIPAC replacement, “but I don’t think we can let it deter us at this point.”

The absence of strong federal partnerships will inevitably hamper companies’ work, experts said. 

“Independent industry alliances could theoretically move faster than federal bureaucracy, addressing interconnected risks,” Harrell said, but “without federal oversight, these groups lack the sovereign intelligence feeds and antitrust immunity that once anchored their operations.”

ACI leaders said they recognized those challenges. But as their group gets off the ground, they also said they saw lots of opportunities to play a productive role.

“This is a great time for this conversation about the resilience of the technology infrastructure that underpins all of the sectors that the country relies upon,” Flatgard said. “There’s gonna be some hard truths within our own companies as well in terms of what this means, but that’s why we're forming this group.”

Major U.S. telecommunications companies launched a new information sharing group on May 19 in a bid to redouble their collective efforts to combat AI-powered cyberattacks, state-sponsored espionage and other increasing threats to communications networks.

The Communications Cybersecurity Information Sharing and Analysis Center, or C2 ISAC, will give telecoms a private venue for exchanging sensitive information such as newly discovered vulnerabilities and tips about threat actor behavior. The eight founding members are AT&T, Charter, Comcast, Cox, Lumen, T-Mobile, Verizon and Zayo. Their chief information security officers will sit on the C2 ISAC’s board, while Valerie Moon, a former top official at the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI’s Cyber Division, will serve as the group’s executive director.

The group’s formation comes as major cyberattacks like China’s Salt Typhoon espionage operation highlight the growing risks facing the U.S. telecom sector — and as the Trump administration’s pullback from key cybersecurity partnerships forces the private sector to take a leading role.

“The main driver for us is our recognition that the threat environment has evolved, and we as a sector and private entities need to evolve and really keep up with the pace and velocity [at which] that's happening,” Mark Clancy, T-Mobile’s chief security officer and a C2 ISAC board member, told Cybersecurity Dive in an interview.

As telecoms scrambled to respond to Salt Typhoon, Clancy added, “the need for us to collaborate on a private-to-private basis really became amplified.”

The telecom industry already shares threat intelligence and best practices under the auspices of the Communications ISAC, also known as the National Coordinating Center for Communications. But that group, created in 1984, is unique among ISACs in that it sits within the federal government, at CISA, rather than being a private entity. That arrangement has discouraged some companies from sharing sensitive data through the group, according to Clancy.

“There’s been concerns and hesitations about it,” he said.

By excluding government agencies from discussion channels, Clancy said, the C2 ISAC hopes to encourage more candid and sensitive discussions. “When you have public-sector entities involved, there’s more review and deliberation about what gets put into that channel,” he said, “where[as] we can be a little more raw and early in sharing information.”

Telecom companies have realized over the years that they were “being too restrictive in what we were sharing” in the Comms ISAC, Clancy said, including withholding data about seemingly low-level threat activity that was “actually tethered to bigger activity.” With the C2 ISAC’s industry-only membership, he said, “we can be a little more direct.”

Telecom companies will still participate in the Comms ISAC, Moon, the C2 ISAC’s executive director, told Cybersecurity Dive in an interview — in part because the new group will focus exclusively on cybersecurity issues, leaving physical hazards to the existing ISAC.

“We really see this as a complementary effort,” she said. “When you think about each of these companies and their adherence to ensuring that the privacy of their data is very much at the forefront of their minds, they see this as a trusted space.”

How telecoms share cybersecurity intel

Information sharing has benefited the telecom sector in ways far beyond indicators of compromise, with companies using the existing ISAC and bilateral relationships to exchange data and insights about a wide range of activity that they’re seeing.

After T-Mobile uncovered telltale signs of SIM boxes — devices that hackers use to generate hard-to-block spam calls and messages — the company shared its findings with other telecoms, which helped them identify and block SIM boxes on their networks.

Collaboration is the only way to address a threat like SIM boxes, Clancy said, because while T-Mobile can identify an individual box on its network, the command-and-control server for that box may reside on a different telecom’s network. “In order to figure out what’s happening, you’ve got to look at both sides,” he said.

T-Mobile has benefited from the industrywide sharing of other best practices, too.

“I learned a technique for dealing with some of the residential proxy networks from another operator that was really clever,” Clancy said, “and I’m, like, ‘Yeah, we’re going to go do that.’”

Beyond exchanging threat data

Candid information sharing is the core of the C2 ISAC’s mission, but its leaders may want to expand its remit in the future.

“We could build automation platforms and other [technologies] that are easier to coordinate on the private-to-private side than going through some public-sector rulemaking process,” Clancy said.

For coordinated operations like botnet takedowns, companies probably won’t use the new ISAC for the foreseeable future, but Moon said board members are interested in discussing how that would work. “It just depends on what the operation is and where the authorities lie and what we are trying to accomplish.”

The group is “in its nascent stages,” she added, and some of its goals “are yet to be determined.”

Also undetermined: How quickly the group will add new members.

“There are more than eight companies in the communications sector, and so we won’t be fully effective until we increase that membership base,” Clancy said, “but we haven’t formally laid out our timeline.”

Government dysfunction looms large

The C2 ISAC will launch at a time of unprecedented cuts to government cybersecurity funding, personnel and programs, and the group’s leaders are closely tracking what those changes mean for their work.

“Obviously, what’s happening in the public sector informs what we need to do,” Clancy said, alluding to “various issues with agencies and funding and the legislative process.”

In particular, he encouraged the Department of Homeland Security to fast-track the creation of a replacement for the now-shuttered Critical Infrastructure Partnership Advisory Council framework, which facilitated candid discussions between industry and government — although he said the reauthorization of the Cybersecurity Information Sharing Act had given the private sector “sufficient capability and authorities” to exchange intelligence with the government.

While government agencies won’t sit in on C2 ISAC discussions, the group still plans to share its findings with federal agencies, whether directly or through the Comms ISAC.

“We could have a more freewheeling private-to-private conversation [and] we could distill the useful, important bits and push them … over to the government side,” Clancy said.

Salt Typhoon exposed glaring security weaknesses

The high-profile Salt Typhoon attacks underscored what previous breaches had already established: telecom companies’ networks are rife with security vulnerabilities that can open the door for major intrusions. Carriers’ networks are often full of computer systems that have been combined over decades of acquisitions, mergers and spinoffs, resulting in inadequate visibility and weak security controls. These sprawling IT environments are difficult to fully assess, let alone protect.

It remains unclear how the C2 ISAC will address that pressing issue facing the sector. But companies say they’ve made significant improvements since Salt Typhoon.

“We’ve all made huge investments in cybersecurity and improved our operational capabilities,” Clancy said. “The challenge in this space is, are you getting better faster than the environment’s getting worse? That’s the race you’re in. And the environment’s getting worse pretty fast.”

Telecom providers believe they will be better at combating hackers the more closely they work together.

“By formalizing real-time intelligence sharing among industry leaders,” Verizon CISO Nasrin Rezai said in a statement to Cybersecurity Dive, “we are building a unified defense that no single company could achieve alone.”

The AI era is forcing critical infrastructure sectors to rethink how they share information — balancing risk and opportunity with advanced technology — in situations where critical services are on the line.

“When we talk about [how] people's money or lives are at stake, that's where things get very, very real very quickly,” Pam Lindemoen, the chief security officer and vice president of strategy at the Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC), said during a panel at the RSAC 2026 Conference in San Francisco on March 23.

Speaking alongside representatives from two other ISACs, Lindemoen said the information-sharing groups were scrambling to understand how AI could help them better analyze and distribute threat intelligence, a vital service at a time when nation-state and cybercriminal hackers are becoming more sophisticated and aggressive.

“How do we balance new technology, getting things faster, without diluting the message and without it becoming noise?” Lindemoen asked.

If automated threat information-sharing led to lower-quality output, she warned, critical infrastructure organizations would lose trust in their ISACs.

“If we lose that center of trust,” she said, “that's where I think things are going to go really poorly for us and for our peers in the industry as well.”

Her colleagues from the other ISACs agreed.

“People have to see the value in the information that's being shared,” said Denise Anderson, the president and CEO of the Health-ISAC.

John Denning, the CISO of the Financial Services Information Sharing and Analysis Center (FS-ISAC), added that “trust underpins everything, but the thing that makes it valuable is converting trust into action.” He said his ISAC was focused on offering implementable advice to members.

The ISAC leaders’ conversation about preserving trust in the AI era comes as their organizations still strive to convince members to open up and share information beyond what they may initially find comfortable.

Anderson recounted the early days of the FS-ISAC, when banks and other institutions were reluctant to attach their name to the information they shared, which in turn discouraged others from sharing. “We made it easier for people to share,” she said, “and when they actually saw who was sharing, they shared more.”

AI alarm bells ring

All three ISAC leaders acknowledged that AI automation could jeopardize the quality of the threat intelligence streaming across their platforms, but RH-ISAC’s Lindemoen was the most vocal skeptic of the technology.

“When I’m in circles amongst friends,” she said, “we’re talking about the collateral damage that having AI managing your workloads could have at scale.” She expressed particular concern about AI analysis of threat data breaking the “chain of custody” of that information, undermining participants’ confidence in the integrity of the data.

“That's what we have to think about as practitioners — how we put guardrails around what access [we give to AI], what level, and its scale and its speed,” Lindemoen said. “And I'm just not seeing anything on the market right now that people trust.”

Critical infrastructure organizations are “thinking about [AI] very optimistically,” she added, “but cautiously, which I think is important in our business.”

Limited embrace of AI

Some ISACs, however, have found ways to improve their work using automation.

The Health-ISAC is looking into whether AI can speed up its distribution of threat alerts or its collation of open-source intelligence for daily reports. These current uses of AI for ISAC work involve “taking a lot of the noise out of the work and making it much more efficient,” Anderson said.

In addition to leading H-ISAC, Anderson chairs the National Council of ISACs, and she said the council was considering setting up a cross-sector AI working group to exchange information and best practices about how to responsibly use the technology.

However ISACs end up using AI, the panelists agreed that the groups need to maintain their spirit of mutual aid.

“If you're a big enterprise and you're part of a community, I almost feel like it's your duty to help the smaller teams,” Lindemoen said. Just as critical infrastructure organizations banded together to figure out the best ways to adopt cloud technology in an earlier era, she said, they will also coalesce around strategies for safely using AI.

Anderson offered a real-world example of that collective spirit.

When Iran-linked hackers launched distributed denial-of-service attacks on U.S. banks in 2012, they accidentally targeted a small Midwestern community bank that shared the name of a large financial institution. After the hackers “took them down hard,” Anderson recalled, FS-ISAC members sent personnel to the bank and helped it restart operations.

“That's the power that we have as a community to help each other out,” Anderson said, “because one day that could be you on the ropes.”

The U.S. government needs the business community’s help crafting the right cybersecurity strategy, President Donald Trump’s top cybersecurity official said on Feb. 3.

“We need input from you,” National Cyber Director Sean Cairncross said at an event hosted by the Information Technology Industry Council. “You know your regulatory scheme better than I do — where there's friction, where there's frustration with information-sharing, what sort of information is shared, the process through which it’s shared.”

Cairncross’s comments come as the White House prepares to unveil its five-page national cybersecurity strategy, which will focus heavily on streamlining regulations to reduce the burden on industry, including critical infrastructure organizations.

The White House wants to revise the current patchwork of cybersecurity regulations “so that form follows function rather than [the rules being] a compliance checklist,” said Cairncross, who has led the relatively new Office of the National Cyber Director since August.

The administration intends to work with companies “to figure out a way that industry can best align its resources with the assets that it needs to protect,” he said.

Administration officials have had “a lengthy engagement with the private sector” as they developed the strategy, Cairncross added.

Business groups, which often complained about the Biden administration’s approach to regulation, could find the Trump administration more amenable to the industry’s views as it implements the new strategy. That could mean looser rules, more corporate representation in government projects and more federal spending on tech services.

Ambitious but brief cybersecurity plan

The strategy will also focus on modernizing the federal government, securing critical infrastructure, building the cybersecurity workforce, maintaining U.S. leadership on emerging technologies and deterring foreign cyberattacks.

The deterrence pillar is likely to be a top priority for the Trump administration. Speaking at the ITI event, Cairncross bemoaned the fact that U.S. policy toward countering hackers has for decades been “very reactive,” and he said the Trump administration is interested in finding new ways to “dent the incentive to engage in that behavior.”

Cairncross did not provide a timeline for the strategy’s release, but he said the White House would publish it “sooner rather than later.” The goal of the brief document, he explained, is “to point a direction for the USG to go so resources and effort can be lined up.”

“We are looking to put points on the board to make things work efficiently, effectively and with maximum impact in all these different priority areas,” he said.

Important partnerships hamstrung

In discussing the strategy and other issues, Cairncross repeatedly emphasized the importance of working closely with industry. “We have to do this in partnership or this mission is not going to succeed,” he said. “Our administration and the President wants to be very forward-leaning and collaborate and partner with the private sector in order to do this.”

At the same time, the Trump administration’s cuts to the Cybersecurity and Infrastructure Security Agency have made that collaboration more challenging and scattershot. CISA has shed key personnel and scaled back important missions as its workforce has struggled with leadership scandals and a lack of direction.

In a similar vein, Cairncross said the administration was committed to convincing other countries to buy telecommunications equipment from Western vendors instead of Chinese competitors, but he did not acknowledge the Trump administration’s elimination of the State Department’s cyber diplomacy bureau, which led those efforts, or the Republican-led Congress’s elimination of a fund meant to subsidize allies’ purchases of Western-made gear.

Chinese technology may cost less up-front, but “there is a bigger price on the back end, and when that bill comes due, it's a problem,” Cairncross said. “We are doing everything we can do to avoid that.”

AI security policy, information sharing, and coordination

Cairncross also discussed AI, saying his team was working with the White House Office of Science and Technology Policy on “an AI security policy framework.” He offered few details but said the goal was to “ensure that security is not viewed as a friction point for innovation, but it is built into that system.”

With the fate of the 2015 Cybersecurity Information Sharing Act hanging in the balance, Cairncross said the Trump administration has “been very clear” that it wants Congress to reauthorize the sharing legislation for as long as possible. He encouraged companies to hammer that message home in meetings with lawmakers, saying “we need from industry is an echo chamber up on the Hill to make to help make that happen.”

Cairncross is only the third Senate-confirmed national cyber director in the four and a half years since Congress created the role to serve as the president's chief adviser on cybersecurity policy issues. Speaking at the ITI event, he said he wanted to use his limited authority to bring together the government’s disparate power centers and develop more coordinated policy.

“We are trying to turn a very large, decades-old ship in a new direction,” he said.

The Trump administration is making progress on creating an information sharing and analysis center for the AI industry to improve its ties with the government as AI cyber threats proliferate, a U.S. official said on Feb. 3.

“The administration is absolutely committed to making sure that we’re supporting this industry, making sure that we’re going to foster information sharing,” Nick Andersen, executive assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency (CISA), said during a talk at an event hosted by the Information Technology Industry Council. “We just want to make sure we take the opportunity to get that relationship right.”

President Donald Trump’s AI Action Plan called for the Department of Homeland Security, the Commerce Department’s Center for AI Standards and Innovation and the White House’s Office of the National Cyber Director to establish an AI-ISAC “to promote the sharing of AI-security threat information and intelligence across U.S. critical infrastructure sectors.”

It would be the first ISAC dedicated to a specific technology rather than a specific infrastructure sector, reflecting the government’s view that AI security is a cross-cutting issue spanning all sectors.

The ISAC would likely help AI companies exchange information about threats and brief the government about their findings, which could help federal agencies quickly alert businesses and infrastructure operators to new threats like sophisticated phishing attacks, autonomous malware and vulnerabilities in AI models.

There is no timeline for the creation of the ISAC, Andersen told reporters after his talk. A draft implementation memo is “working its way through” the interagency process, he said. “We’ve got a couple of different options that we want to be able to consider.”

The government wants to get the AI-ISAC right so the industry doesn’t feel the need to create “a separate, parallel group” later, Andersen said during his talk, and there is “an ongoing policy dialog about the best approach.”

CIPAC, CIRCIA and CISA hiring

Andersen also provided reporters with brief updates on other topics in CISA’s portfolio. He said the agency expected to make an announcement about its forthcoming cyber incident reporting regulation “in pretty short order — in the next couple of weeks, hopefully.” And he said CISA was working with DHS headquarters to fill its depleted ranks as part of a hiring initiative first reported by Cybersecurity Dive.

With CISA developing a replacement for the Critical Infrastructure Partnership Advisory Council framework (CIPAC), Andersen said the new program would reflect changes in the infrastructure security environment since CIPAC’s creation in 2006.

“CIPAC never made any explicit focus on cybersecurity,” Andersen said. “It just wasn’t part of what was chartered back in the day when it was originally launched.” The new framework will also let CISA convene topic-specific working groups to address issues such as the security of operational technology and undersea cables. CISA wants to be able to engage better with infrastructure operators that didn’t have a clear place under the original framework, Andersen said, and “give them a voice in the process.”

A threat actor was able to leverage AI to develop a working zero-day exploit, in what is believed to be the first such successful use of the technology, according to a report that Google’s Threat Intelligence Group (GTIG) released on June 15.

The effort was an attempt to launch a mass exploitation event, the report said, but it was ultimately unsuccessful, as Google discovered it before the attackers weaponized the vulnerability.

GTIG notified the developer of the exploit, and the developer issued a patch to address the potential threat. Researchers do not believe that the attackers used Anthropic’s Claude Mythos AI model in the development process. 

“AI can review the underlying logic, context, and flow of code at scale to discover vulnerabilities,” John Hultquist, chief analyst at GTIG told Cybersecurity Dive, via email. “It can also be used to build working exploits which are a significant hurdle.”

The incident highlights a growing trend in which state-linked and financially motivated threat groups use AI to scale and accelerate hacking campaigns and exploit flaws in widely used applications. GTIG researchers caution they have seen several other attempts to use AI to develop exploits and expect there will be other operations employing a variety of models. 

Threat groups affiliated with North Korea and China have shown significant interest in exploiting AI to discover vulnerabilities, according to the GTIG report. 

For example, a North Korea-linked hacker tracked as APT45 has used AI to analyze a wide range of vulnerabilities using thousands of repetitive prompts and validate proof of concept exploits, the report stated.  

In a recent case involving criminal actors, a group of hackers joined forces to plan a mass exploitation operation. A zero-day vulnerability was implemented in a Python script, which enabled the hacker to bypass two-factor authentication on a widely used open-source system administration tool, GTIG said. 

Researchers worked with the vendor to disclose the vulnerability and disrupt the operation. 

The report follows an attempt by an unknown hacker to breach a Mexican water utility using widely used AI tools, including Claude.