America’s Cybersecurity Unraveling: Why 2026 Is the Most Dangerous Year Yet
Normally I would use this quarterly article to bring some humor and light to the more serious topics, but it didn’t feel appropriate this time around. If you’ve been keeping up with the cybersecurity world at all this past calendar year, you would see that the United States is entering 2026 in one of the most precarious digital security environments in its history. A combination of policy rollbacks, international withdrawals, budget cuts, and stalled federal protections have left all organizations, both public and private, exposed to unprecedented levels of cyber risk. This shift demands a new level of vigilance.
Taken together, these many changes mark a dramatic shift in how the United States approaches national cyber defense. What once operated as a layered, federally coordinated system is now being peeled back piece by piece, leaving gaps that adversaries are quick to notice. The rollback of standards, the loosening of oversight, and the retreat from long standing security commitments have created a landscape where organizations can no longer assume that Washington will set the pace on cybersecurity. To understand how we got to this point, here are some of the key rollbacks that have occurred over the past calendar year:
In June 2025 Donald Trump signed Executive Order 14306, which made several significant rollbacks of earlier federal cybersecurity requirements, particularly on those focused on future proofing United States systems against emerging threats. More specifically, it removed mandates for federal agencies to adopt Post-Quantum Cryptography (PQC), rolled back specific auditing and verification requests for software supplies selling to the federal government, reduced federal oversight of vendor cybersecurity practices, and narrowed the federal government’s role in setting cybersecurity baselines, or what the administration referred to as “burdensome compliance obligations.”
On September 30th, 2025, the Department of Defense issued a directive that reduced the frequency and mandatory nature of cybersecurity training across the military and DoD workforce. The stated rationale for this directive was to reduce what DoD leadership described as “administrative burden.” It scaled former required trainings (annual awareness, phishing-resistance, role-specific cyber readiness) back from “mandatory” to “as needed,” and increased commander discretion as to which modules were “necessary” and which personnel even need training.
CISA, or the Cybersecurity and Infrastructure Security Agency, briefly expired on October 1st, 2025, during the federal shutdown. Although Congress later extended its funding, first through January 2026 and now through September 2026, they did not restore the full set of programs and resources that had previously existed. Large portions of CISA’s requested FY2026 funding (reported up to 25%) has been cut, including ~73% of funding for the National Risk Management Center and funding for many of its programs (i.e. state and local governments, small businesses, critical-infrastructure operators) in an effort to eliminate nearly 30% of CISA’s positions. It also removed a large amount of funding for CISA’s mis- and disinformation offices that focused on foreign influence and election-related disinformation.
In January 2026 the current administration announced that the United States would withdraw from several international cybersecurity forums including the Global Forum on Cyber Expertise (GFCE), which focuses on critical infrastructure protection, cybercrime, and cyber skills development, and the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE), which supports EU and NATO members through expertise-sharing and coordination on cyber and hybrid risks, stating that they were “duplicative” and “misaligned with US interests.”
With all of these changes, the burden of security is shifting squarely onto private companies, which demands an entirely new level of vigilance. So what can your organization be prepared and watching out for based on these rollbacks?
- Expect more sophisticated attacks, especially from Nation-State actors. Organizations should anticipate more targeted ransomware campaigns (especially against hospitals, utilities, and manufacturing), supply chain compromises exploiting weakened federal software auditing requirements, disinformation-driven attacks, and credential theft and espionage operations aimed at defense, energy, and tech sectors.
- Prepare for reduced Federal support during incidents. With CISA facing budget cuts and staffing reductions, response times and hands on assistance may be slow. It’s time to strengthen your internal Incident Response teams, establish mutual aid agreements with industry peers, and build relationships with state-level cyber units, which may become more important as federal capacity shrinks.
- Re-evaluate your organizations’ cryptography and long term data protection. Executive Order 14306’s rollback of Post Quantum Cryptography (PQC) requirements leaves a gap in national preparedness, and organizations that hold long lived sensitive data (i.e. healthcare, finance, defense, biotech) should not wait for federal mandates to return. Start PQC migration planning now by identifying vulnerable systems and prioritizing data that must remain secure for 10+ years.
- Strengthen your Supply Chain security despite a lack of Federal auditing standards. The supply chain is now one of the most attractive attack surfaces for adversaries, so now organizations must take on the due diligence burden themselves. Removing software auditing requirements reduces visibility into things such as third party code and vendor security practices, which creates more opportunities for adversaries to compromise federal systems through suppliers, a tactic Russia, China, and Iran have repeatedly used. Start implanting zero trust architectures and conduct more frequent third party risk assessments.
- Prepare for a surge in Disinformation targeting your organization. With CISA’s disinformation-tracking efforts scaled back, organizations should expect more fake press releases, deepfake executive videos, manipulated financial news, among others. Organizations, especially those in critical infrastructure, healthcare, and elections-adjacent industries, should start building rapid response communications teams and look into investing in brand monitoring tools to detect and count false narratives quickly.
- Invest in your Organization’s cyber hygiene like there’s no tomorrow because at the rate everything is going, you never know if there is going to be another chance tomorrow! In a country where federal protections are thinning, the fundamentals matter more than ever. Have Multifactor Authentication everywhere, have aggressive patching cycles, employ network segmentation, invest in continuous monitoring and threat hunting, employ MORE cybersecurity and role-based trainings (look at Digital Beachhead’s website comfor more information on how a Cybersecurity Consulting Company can help you meet these goals!)
The United States is entering 2026 with a cybersecurity posture defined less by technological advancements and more by policy choices that have reshaped the country’s security foundation. The rollback of federal standards, the reduction of training, the weakening of CISA, and the withdrawal from international cyber alliances have collectively shifted the burden of protection onto organizations that were never meant to shoulder it alone. Adversaries are already adapting to this new reality, probing for weaknesses created by these gaps and exploiting the uncertainty that follows.
But this moment also clarifies what comes next. Organizations that invest now in stronger internal defenses, deeper partnerships, and long term modernization will be far better positioned to withstand the turbulence ahead. The federal retreat has made one truth unavoidable: cybersecurity is no longer something that can be outsourced to Washington. It is now a core business function, a strategic priority, and a daily operational responsibility. Threats are rapidly evolving and the landscape is shifting, and the question for every organization now is whether they will evolve fast enough to meet the moment.
The Record by Recorded Future News. (2025, June). Trump signs cybersecurity executive order rolling back federal requirements. https://therecord.media/trump-cybersecurity-executive-order-june-2025
The National CIO Review. (2024). Congress extends expired cyber laws in new government spending deal. https://nationalcioreview.com/articles-insights/extra-bytes/congress-extends-expired-cyber-laws-in-new-government-spending-deal/
CSO Online. (2024). Senate moves to restore lapsed cybersecurity laws after shutdown. https://www.csoonline.com/article/4088018/senate-moves-to-restore-lapsed-cybersecurity-laws-after-shutdown.html
Information Technology & Innovation Foundation (ITIF). (2026, February 9). America’s cyber withdrawal needs a replacement. https://itif.org/publications/2026/02/09/americas-cyber-withdrawal-needs-a-replacement/
CPO Magazine. (2025). Trump’s 2026 budget would cut nearly a quarter of CISA’s funding. https://www.cpomagazine.com/cyber-security/trumps-2026-budget-would-cut-nearly-a-quarter-of-cisas-funding/
Cybersecurity Dive. (2025). CISA faces major cuts under Trump’s 2026 budget proposal. https://www.cybersecuritydive.com/news/cisa-trump-2026-budget-proposal/749539/
Federal News Network. (2026, January). DHS spending bill bolsters staffing at CISA, FEMA, Secret Service. https://federalnewsnetwork.com/hiring-retention/2026/01/dhs-spending-bill-bolsters-staffing-at-cisa-fema-secret-service/