Following the 2026 midterm elections, attention is turning to what the next Congress could mean for U.S. cybersecurity policy, federal oversight and the regulation of emerging technologies.
Among the issues drawing attention are the future of the Cybersecurity and Infrastructure Security Agency (CISA), critical infrastructure protection, cybersecurity information sharing and the growing role of artificial intelligence in enterprise security.
As policymakers consider their priorities, organizations continue to face evolving cyber threats and new challenges associated with AI-driven automation, access controls and software security.
Ryan McCurdy, Vice President of Marketing, Liquibase
“The next Congress may bring new priorities for cybersecurity oversight and AI security, but the underlying challenge for enterprises won’t change. As AI agents take on more responsibility for developing and deploying software, organizations need to rethink how they control what those systems are allowed to do. What happens when a system with legitimate access makes a dangerous change? An agent doesn’t need to exploit a vulnerability to drop a production table. It just needs the right permissions.
“There’s growing attention on AI agent identity and authorization, including work underway at NIST. However, access is only part of the problem. Enterprises also need to enforce policies around the changes those systems make, validate them before execution, and maintain evidence of what happened.
“Regardless of where federal policy goes, organizations remain accountable for what reaches production. The same standards should apply whether a change comes from a developer, an automated pipeline, or an AI agent.”
Doc McConnell, Head of Policy and Compliance, Finite State
“Congressional Democrats are likely to take a more assertive posture on the role of the federal government in promoting cybersecurity. I expect to see three shifts:
“First, information sharing. A durable reauthorization of the Cybersecurity Information Sharing Act of 2015 is the most likely early win. The law’s liability protections give companies the confidence to share threat and vulnerability information voluntarily, and the recent string of short-term extensions erodes that confidence. A multi-year reauthorization, whether it comes in the lame-duck session or early in the new Congress, would restore the predictability that voluntary sharing depends on.
“Second, critical infrastructure. CISA has lost roughly a third of its workforce, has seen programs and partnerships contract, and has faced proposed budget cuts of hundreds of millions of dollars, all while attacks on critical infrastructure have intensified. This summer’s coordinated intrusions into water systems, which began with more than thirty Minnesota utilities in late July and reached at least a dozen states, was a stark reminder: if the intrusions are coordinated, then our defense must be as well. I expect a renewed effort to rebuild federal capacity and to get resources to the state and local operators, beginning with reauthorization and funding for the State and Local Cybersecurity Grant Program.
“Third, supply chain transparency. Concern about foreign technology in U.S. systems is bipartisan, so this is an opportunity for a continuation of current policy trends. So far, we’ve seen a piecemeal approach to supply chain protections: formal rules for connected vehicles, an executive order for the bulk power system, and FCC actions that have created sudden and sharp disruptions for consumer technology companies. The new Congress has an opportunity to streamline and harmonize these requirements across sectors, satisfying the requirement for security and transparency, while giving manufacturers the predictability they need to plan long-term investments in the U.S. market.”
AI needs a bunch of things. Oversight is high up there. Hopefully that is what we get.
Related
This entry was posted on November 6, 2026 at 12:52 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Cybersecurity policy following the midterm elections
Following the 2026 midterm elections, attention is turning to what the next Congress could mean for U.S. cybersecurity policy, federal oversight and the regulation of emerging technologies.
Among the issues drawing attention are the future of the Cybersecurity and Infrastructure Security Agency (CISA), critical infrastructure protection, cybersecurity information sharing and the growing role of artificial intelligence in enterprise security.
As policymakers consider their priorities, organizations continue to face evolving cyber threats and new challenges associated with AI-driven automation, access controls and software security.
Ryan McCurdy, Vice President of Marketing, Liquibase
“The next Congress may bring new priorities for cybersecurity oversight and AI security, but the underlying challenge for enterprises won’t change. As AI agents take on more responsibility for developing and deploying software, organizations need to rethink how they control what those systems are allowed to do. What happens when a system with legitimate access makes a dangerous change? An agent doesn’t need to exploit a vulnerability to drop a production table. It just needs the right permissions.
“There’s growing attention on AI agent identity and authorization, including work underway at NIST. However, access is only part of the problem. Enterprises also need to enforce policies around the changes those systems make, validate them before execution, and maintain evidence of what happened.
“Regardless of where federal policy goes, organizations remain accountable for what reaches production. The same standards should apply whether a change comes from a developer, an automated pipeline, or an AI agent.”
Doc McConnell, Head of Policy and Compliance, Finite State
“Congressional Democrats are likely to take a more assertive posture on the role of the federal government in promoting cybersecurity. I expect to see three shifts:
“First, information sharing. A durable reauthorization of the Cybersecurity Information Sharing Act of 2015 is the most likely early win. The law’s liability protections give companies the confidence to share threat and vulnerability information voluntarily, and the recent string of short-term extensions erodes that confidence. A multi-year reauthorization, whether it comes in the lame-duck session or early in the new Congress, would restore the predictability that voluntary sharing depends on.
“Second, critical infrastructure. CISA has lost roughly a third of its workforce, has seen programs and partnerships contract, and has faced proposed budget cuts of hundreds of millions of dollars, all while attacks on critical infrastructure have intensified. This summer’s coordinated intrusions into water systems, which began with more than thirty Minnesota utilities in late July and reached at least a dozen states, was a stark reminder: if the intrusions are coordinated, then our defense must be as well. I expect a renewed effort to rebuild federal capacity and to get resources to the state and local operators, beginning with reauthorization and funding for the State and Local Cybersecurity Grant Program.
“Third, supply chain transparency. Concern about foreign technology in U.S. systems is bipartisan, so this is an opportunity for a continuation of current policy trends. So far, we’ve seen a piecemeal approach to supply chain protections: formal rules for connected vehicles, an executive order for the bulk power system, and FCC actions that have created sudden and sharp disruptions for consumer technology companies. The new Congress has an opportunity to streamline and harmonize these requirements across sectors, satisfying the requirement for security and transparency, while giving manufacturers the predictability they need to plan long-term investments in the U.S. market.”
AI needs a bunch of things. Oversight is high up there. Hopefully that is what we get.
Share this:
Like this:
Related
This entry was posted on November 6, 2026 at 12:52 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.