The US Cybersecurity and Infrastructure Security Agency (CISA) has killed many of the industry partnerships it used to enhance security, but don't tell the organization's acting director. Speaking on Tuesday at a virtual public sector cyber resilience summit hosted by infosec firm Rubrik, Nick Andersen claimed that CISA’s public-private partnerships are the most critical aspect of his agency’s mission. “We don’t see everything. We’re not a law enforcement agency, intelligence agency, or a regulator,” Andersen said during a discussion at the summit.

CISA, he added, relies on intelligence and insight not only from other government agencies and international partners, but from the private sector as well. CISA’s mission simply can’t succeed without motivating those various partners to share what they’ve seen, heard, and dealt with in order to build a comprehensive threat model. “It’s all carrots and partnerships,” Andersen added, referring to motivating partners to get on board with programs like CISA’s CI Fortify initiative for building resilient critical infrastructure.

Were that actually the case, we wouldn’t really have a story to write here, but anyone who’s been following CISA’s trials and tribulations during the second Trump administration is likely to have raised an eyebrow at Andersen’s claims. Trump returned to office riding a wave of plans to cut government spending, which included massive reductions at CISA. Among the first CISA programs axed was the Cyber Safety Review Board, a public-private body set up by the Biden administration. In addition to that closure, the Trump administration also shuttered the Artificial Intelligence Safety and Security Board, Critical Infrastructure Partnership Advisory Council, National Security Telecommunications Advisory Committee, and US Secret Service Cyber Investigations Advisory Board, all bodies consisting of government and private players working together toward cybersecurity goals.

Some of those bodies have since been stood up again or reformed under new names, wasting time and money that could have been better spent by cyber defenders doing things like, you know, advising CISA and other government agencies on security matters. CISA also terminated funding for and ties to the Center for Internet Security in late 2025. One of CISA’s bodies affected by the cut was the Multi-State Information Sharing and Analysis Center, a public-private partnership that shares threat intelligence and filters essential alerts down to the local government level.

CISA staff has also been slashed considerably, with around a third of the Agency’s headcount, about 1,000 people, departing since Trump returned to office. CISA has since committed to rehiring around 300, but the Trump administration’s most recent budget request proposes eliminating an additional 900 positions at the agency, along with slashing nearly a billion dollars from CISA’s 2027 budget. When we asked about the apparent contradiction, CISA reached out to point us to initiatives like its reformed councils, CI Fortify, and security exercises it hosted with industry partners to test cyber resilience to point to the continued priority the agency places on its public-private partnerships.

“CISA works with critical infrastructure owners and operators to assist them in securing both the physical security and cybersecurity of the systems and assets that support essential services,” an agency spokesperson told us. “Our regional teams assist industry and government partners across the country by assessing risks, helping entities bolster defenses and improve resilience, and responding promptly to threats.”But with so many outreach employees and general staff still missing, Andersen’s claims ring a bit hollow.

Either the acting administrator is misrepresenting the continued importance of private industry partnerships at CISA, or he’s in denial about the state of his agency.

Neither is great, especially with more budget and staffing cuts looming, and the price will be unprepared critical infrastructure. ®