How the F5 breach, CISA job cuts, and a government shutdown are eroding U.S. cyber readiness

The federal cybersecurity system is weathering a series of crises that couldn’t have arrived at a worse time. The F5 security breach from Oct. 15, the proposed elimination of more than 1,000 jobs at the Cybersecurity and Infrastructure Security Agency (CISA), and the ongoing federal government shutdown have created a perfect storm that is not only leaving critical vulnerabilities exposed across the nation’s digital infrastructure, but it’s also weakening the workforce meant to defend it.

On its own, each of these events is serious, but when combined, they are threatening to push an already strained federal cyber defense posture to its breaking point.

The F5 incident was not another routine software breach. Security researchers and federal officials have called it a nation-state–level compromise that could have a cascading impact. In this incident, a China-linked espionage group  accessed F5 source code and undisclosed vulnerabilities, gaining access to a detailed blueprint for crafting custom exploits capable of bypassing traditional defenses. Because the company’s BIG‑IP software is used by many of the world’s largest enterprises, including federal agencies, defense contractors, hospitals, and utilities, the breach has national implications.

CISA’s emergency directive ordering agencies to patch affected systems reflects the severity of the threat. It also highlights a deeper issue—federal cyber defense relies too heavily on reactive approaches that are no longer effective in battling adversaries who are moving faster, hiding deeper, and automating their attacks.

Or under normal conditions, this reactive approach would be an uphill battle. But, as most of us now know, CISA is facing potential cuts of more than 1,000 positions and funding cuts totaling nearly half a billion dollars. This includes jobs directly tied to incident response, stakeholder engagement, regional operations, and election security—the very jobs that ensure resilience across the federal, state, and local cyber ecosystem. 

The timing could not be worse. Since 2018, CISA has been the connective tissue of our national cyber defense. It links intelligence from federal agencies with state governments and private-sector partners. These massive cuts will jeopardize the entire framework that coordinates national response during cyber crises.

One area to keep an eye on is election security. The proposed cuts include 14 positions responsible for protecting election systems. These jobs are specifically focused on helping state and local officials manage ransomware threats, disinformation, and potential interference. Now, as a contentious election year looms, these risks are escalating due to the growth in AI-driven misinformation and deepfake-based social engineering campaigns. Reducing federal support now creates a serious national security vulnerability.

By furloughing employees, halting procurement, and delaying guidance, agencies are operating with skeleton crews and depleted morale. For nation-state operators, this expanding attack surface and declining oversight are creating a huge window of opportunity.

The personal toll on federal cybersecurity professionals cannot be overstated.

Federal cybersecurity professionals already face high burnout due to intense operational demands. The ongoing exodus during the shutdown means that valuable institutional knowledge is being lost as experienced experts depart. This comes at a time when there is already a severe shortage of cybersecurity workers in the government sector. Recruiting them back will be difficult, especially as many are likely to pursue more stable opportunities elsewhere.

The time to react is now

These overlapping crises reveal a fundamental problem: the United States relies on a reactive cybersecurity approach built for a slower, more predictable past—not today’s rapidly evolving threat landscape. With sophisticated attacks now driven by persistent nation-states, supply chain vulnerabilities, and automated exploits, we need to prioritize prevention over mere response. While patching vulnerabilities and conducting forensic investigations after incidents remain important, they can no longer be the foundation of our national cyber defense.

 A prevention-first strategy focuses on reducing the initial attack surface, spotting anomalies before they escalate into breaches, and designing resilience directly into our systems. This shift also requires treating cyber readiness as a critical workforce and policy issue—not just a technical one. Federal defenders need stable resources, ongoing training, and consistent policies to stay effective. Cybersecurity cannot be managed as a discretionary budget line that fluctuates with political cycles.

For policymakers, the key lesson is that true cyber resilience requires both sustained capacity and continuity—not just the latest technology. An understaffed or demoralized cyber workforce cannot defend an expanding digital landscape. Meanwhile, the private sector must prepare to operate more independently, especially during government shutdowns. This means investing in preventative security measures, strengthening identity and supply chain protections, and ensuring communication channels remain open even if federal support is temporarily reduced.

As private organizations become more proactive, the federal government must also move beyond outdated cybersecurity practices, fragmented funding, and inconsistent standards. The recent F5 incident highlighted that when crucial parts of our digital infrastructure are compromised, no single agency can manage the consequences alone.

The perfect time to reset

The convergence of the F5 breach, CISA workforce cuts, and the ongoing shutdown exposes the fragility of the country’s cybersecurity approach. But let’s pause and look at the positive side of things. These events offer an opportunity to reset our defenses by moving beyond post-incident response and toward strengthening prevention, stabilizing the workforce, and ensuring interagency collaboration can continue even under fiscal strain.

Resilience must start before the breach, not after. To withstand the next wave of nation-state and supply chain attacks, the U.S. must treat cybersecurity as a readiness discipline built on prevention, continuity, and people. The perfect storm is still avoidable—but only if action replaces complacency. Time is running out.

Brad LaPorte is the Chief Marketing Officer at Morphisec.