Riffing on a conversation @cR0w and I had elsewhere, I want to pose the question to the community: Is CISA trustworthy today? I think there are varying shades to this, most of which are captured by the Admiralty Code, but more nuance is probably warranted.
How are we feeling about the info coming from them today? Is it trust-but-verify? Dismiss? Suspect?
It’s also probably not uniform across subject areas, or even claimed attribution. What are your thoughts?
Since the initial gutting of CISA was a big pusher for IFIN in the first place, it seems weird to me to consider them reliable or credible now. I also haven’t heard much change or updates since then. How were parts of CISA affected and how are they still affected?
I am inclined to agree with @cR0w about cyber bogeyman-ing, however I think it’s still worth verifying anything coming from them.
I’m not a threat hunter/intel professional by any means though so I’m not as in tune with the details.
It is the case that CISA’s jeopardy was part of the founding motivation. I also don’t want to be so binary about the situation. Initial funding cuts for CISA were reduced in FY26. Hopefully, that is also true for FY27, because the proposed budget is dire.
So that’s a question about CISA’s capacity, but not necessarily its credibility. While DHS mouthpiece Tricia McLaughlin was frequently a spouter of lies, that’s a separate issue from whether advisories/alerts from CISA should be trusted.
I think for right now “trust but verify” is a reasonable position, but with very little margin for error.
As far as their KEV goes, companies are still watching it widely. I honestly feel that trust but verify is normal for any threat intel feed (even here to a degree). CISA overall looks like parts of it are just being absorbed into other agencies, at a lower fidelity level.
That said, I don’t get much from it right now but KEV updates which are usually stuff that I see in normal threat intel/news feeds.
It is worth noting that there are still Good People at CISA. That doesn’t mean the organization itself is still credible or reliable, but there are indeed people still there that are.
Caught this in the feed reader. A possible data point when thinking about the future of CISA
Yeah the brain-drain on CISA is happening at both ends. Career folks are bolting, and I don’t see a lot of interest in joining up.