CISA 2030 Describes the Right Defense... It Leaves Out Where the Adversary Gets In.

TL;DR: What CISA 2030 Gets Right—and What It Needs to Address

The Cybersecurity and Infrastructure Security Agency's new strategy, CISA 2030: Defend, Harden, Prevail, calls for anticipatory cyber defense, consequence-based risk prioritization, and faster action to eliminate adversary footholds in critical infrastructure.

It's the right direction. But a critical implementation challenge remains: How can organizations identify and eliminate threats already developing inside the third parties they depend on?‍

According to Verizon's 2026 Data Breach Investigations Report, 48% of breaches involved a third party, compared with approximately 30% the previous year.

Recent incidents involving Change Healthcare, telecommunications networks, and MOVEit demonstrate how a compromise or vulnerability in one organization or technology can create consequences across many others.

To turn CISA's strategy into operational reality, security leaders must extend intelligence beyond their own networks, determine which third-party threats pose immediate business risk, and coordinate remediation before those threats disrupt essential services.

What's missing isn't more threat intelligence. Many organizations already receive plenty of it. The harder problem is turning third-party intelligence into coordinated action before a compromise becomes a crisis.

CISA 2030Gets the Direction Right

On October 26, 2026, the Cybersecurity and Infrastructure Security Agency released CISA 2030: Defend, Harden, Prevail, its strategy for strengthening national cyber defense and the resilience of America’s critical infrastructure.

The strategy marks an important shift in emphasis.

Instead of relying primarily on defensive preparedness, CISA is calling for a more anticipatory approach: identifying adversaries, disrupting their operations, removing their footholds, and prioritizing infrastructure whose disruption would cause the greatest consequences.

Three commitments deserve particular attention.

First, CISA recognizes that defending against compromise requires more than preventing initial intrusion.‍

Sophisticated adversaries will find ways into networks. Effective defense requires discovering that access quickly, removing the adversary, and ensuring that critical operations continue.

Second, CISA wants to connect intelligence directly to operations.‍

The agency calls for stronger intelligence-to-operations capabilities that enable real-time decisions and faster responses. That is exactly where cybersecurity must evolve.

A threat report sitting in an inbox doesn’t stop anything. Intelligence becomes useful when someone can judge whether it applies to them and act on it.

Third, CISA is prioritizing consequence over generalized risk.‍

The strategy favors risk-informed, consequence-based analysis, directing attention toward infrastructure whose disruption would have the greatest impact on national security, economic stability, public health, and safety.

Not every threat is equally important. Not every vulnerability represents an imminent danger. The objective is to understand which threats matter, why they matter, and what should happen next.

I agree with that direction.

But it raises a question that becomes more important as adversaries exploit the connections between organizations:

How do we eliminate an adversary foothold when that foothold exists outside the organization we’re trying to protect?

The Missing Operational Layer: Third-Party Threat Intelligence

CISA’s strategy recognizes software supply chain security, interconnected infrastructure, and the importance of vendors. Its October 26 announcement explicitly calls on critical infrastructure owners, operators, vendors, and technology manufacturers to act.

CISA has also addressed third-party risk in more focused guidance, including its September 23, 2026 fact sheet with the FBI for critical infrastructure operators working with third-party industrial control system integrators.

These are important steps.

But recognizing supply chain risk is different from operationalizing the detection and remediation of threats across an extended enterprise ecosystem.

A securely developed software product does not guarantee that the company delivering it is secure.

A service provider can operate legitimate, well-maintained technology and still have its credentials stolen, its systems compromised, or its trusted access abused.

An attacker does not necessarily need to breach a hardened critical infrastructure operator directly. It may be easier to compromise a managed service provider, cloud administrator, business partner, or other trusted organization with legitimate access.

That changes the security question.

Traditional third-party risk management asks:

Is this vendor secure?

Operational third-party threat intelligence asks:

Is this vendor under attack or already compromised? Does that compromise create a credible threat to our organization? What do we need to do right now?

These are different questions requiring different capabilities.

Security questionnaires, periodic assessments, and risk ratings remain useful. They help establish security posture and identify weaknesses.

But they cannot, on their own, determine whether an adversary has gained access today, whether stolen credentials are being traded, or whether a compromised provider creates an immediate threat to critical operations.

A vendor’s security posture tells you something about its preparedness. Live threat intelligence helps determine what may be happening now.

Both matter. But if the objective is eliminating footholds before weaponization, the second must drive an operational response.

The Evidence: Nearly Half of Breaches Now Involve a Third Party

Verizon’s 2026 Data Breach Investigations Report found that third parties were involved in 48% of breaches, a 60% increase in the share from the previous year.

That is more than a third-party risk management statistic.

It points to a fundamental change in how attackers exploit interconnected enterprises.

Organizations increasingly depend on external providers for cloud infrastructure, identity management, software, telecommunications, payment processing, operational technology, and business-critical services.

Those relationships create enormous efficiency. They also create pathways for adversaries.

One compromised service provider can expose multiple customers. One vulnerable shared technology platform can put data from numerous organizations at risk. One trusted network connection can become an avenue for unauthorized access. And the organization experiencing the consequences may not be the organization initially compromised.

This is why the traditional concept of an enterprise security perimeter is increasingly incomplete.

An organization’s true attack surface includes not only the systems it owns, but also the relationships, dependencies, and trusted access pathways through which an adversary can affect its operations.

CISA’s consequence-based strategy should account for those relationships.

Three Cyber Incidents That Illustrate the Third-Party Challenge

The consequences are not hypothetical. Several major incidents demonstrate how an adversary’s access to one part of an interconnected ecosystem can create widespread exposure or disruption.

1. Change Healthcare: When One Provider Disrupts an Entire Sector

In February 2024, the cyberattack against Change Healthcare disrupted healthcare claims processing, payments, and related services across the United States.

Hospitals, physician practices, pharmacies, and other healthcare organizations experienced operational and financial consequences despite not necessarily having their own systems compromised.

The disruption became serious enough that the Centers for Medicare & Medicaid Services established accelerated and advance payment options to help affected providers maintain operations.

For CISA 2030, the lesson is this: a provider’s importance isn’t just about its revenue, headcount, or internal security. It’s also about who depends on it.

The most consequential compromise may not occur at the most visible organization. It may occur at the provider everyone depends on.

For healthcare security leaders, the relevant question is not simply whether a critical vendor has passed an assessment.

It is whether they have sufficient visibility to detect credible evidence of compromise, understand which services depend on that vendor, and initiate protective action before patient care and essential operations are affected.

Source: CMS, Change Healthcare/Optum Payment Disruption, March 2024.

2. Salt Typhoon: Trusted Connections Can Extend an Adversary’s Reach

The Salt Typhoon cyber espionage campaign demonstrated the strategic importance of trusted telecommunications infrastructure.

The FBI confirmed that PRC-affiliated actors compromised multiple U.S. telecommunications companies as part of a broader campaign targeting victims globally.

The activity included theft of call data logs and certain private communications.

Salt Typhoon is not simply an example of a conventional vendor breach. It illustrates a broader dependency problem: trusted infrastructure and interconnected networks can provide adversaries with access and intelligence far beyond a single compromised environment.

Telecommunications networks connect businesses, government agencies, emergency services, and critical infrastructure operators.

When these networks are compromised, the consequences can extend across organizations and sectors.

For CISA, the lesson is that critical infrastructure defense must account for shared dependencies and trusted connectivity—not just the security of isolated networks.

Source: FBI, PRC Targeting of U.S. Telecommunications, April 2025.

3. MOVEit: How Shared Technology Creates Cascading Exposure

The 2023 exploitation of MOVEit Transfer demonstrated another form of systemic exposure.

The CL0P ransomware group exploited a vulnerability in the file-transfer software, enabling data theft from vulnerable systems used across numerous organizations.

The FBI and CISA issued a joint cybersecurity advisory documenting the campaign and providing guidance for defenders.

The incident showed how widely deployed technology can create simultaneous exposure across multiple enterprises.

For downstream organizations, the difficult question was not only whether MOVEit was vulnerable.

It was whether their information was held or processed by an affected provider, whether exploitation had occurred, and what action was required to contain the consequences.

This is where threat intelligence must be connected to business relationships.

Knowing that a vulnerability is being exploited is useful.

Knowing which critical providers are affected, what those providers can access, and which downstream organizations face consequences is actionable intelligence.

Source: CISA and FBI, CL0P Ransomware Gang Exploits MOVEit Vulnerability, June 2023.

What These Incidents Have in Common
‍

The attack mechanisms differ. The consequences share a common theme.

An organization can face significant disruption from a compromise or vulnerability it does not directly control.

That reality has to become part of how anticipatory cyber defense is implemented.

From Intelligence Sharing to Intelligence-Driven Action

The next evolution of cybersecurity is not simply collecting more intelligence or sharing it faster.

It is making intelligence operational across organizational boundaries.

Picture this: threat intelligence shows administrator credentials for a cloud provider being sold on a criminal forum. That provider supports 12 critical infrastructure organizations, including healthcare systems, banks, and telecom operators. A standard monitoring tool would flag the provider as high risk, but that label doesn’t say what to do next. Which customers use the affected service? What could those credentials reach? Has the activity been confirmed? The question that matters most is whether the threat has actually been removed.

A static vendor score cannot resolve those questions.

A threat intelligence report alone cannot either.

What is needed is a process that connects intelligence collection to evidence validation, organizational relevance, decision-making, and coordinated response.

That’s what intelligence-led security looks like in practice. It also gives CISA a chance to build a more measurable way of defending critical infrastructure ecosystems.

Five Capabilities CISA 2030 Should Measure Across Third-Party Ecosystems

As CISA develops its implementation plan, one opportunity is to establish measurable outcomes for threats involving critical third-party dependencies.

The following five capabilities could form the foundation of a third-party threat-to-action framework.

1. Discover Critical Dependencies

Identify the third parties, service providers, technologies, and external access relationships that support essential operations.

Not every vendor requires the same level of attention.

The priority should be organizations whose compromise could interrupt essential services, expose sensitive information, or provide access to critical systems.

Where appropriate and legally authorized, shared dependency analysis can also identify providers whose compromise could create consequences across multiple critical infrastructure operators.

2. Detect Active Threats

Move beyond periodic security reviews to identify evidence of emerging or active threats.

Relevant indicators may include exposed credentials, confirmed data leaks, malicious infrastructure, ransomware activity, exploited vulnerabilities, or credible indications of unauthorized access.

Not every signal is proof of compromise. Detection must be followed by validation.

The objective is to identify threats early enough for protective action to matter.

3. Determine Enterprise Consequence

Connect validated threat intelligence to actual business relationships and operational dependencies.

Does the affected provider have privileged access? Does it process sensitive data? Is it involved in essential services? Could disruption affect public safety, economic activity, or national security?

This is the difference between knowing a provider has a security problem and knowing that the problem threatens a specific organization.

Consequence—not simply the presence of a threat—should determine priority.

4. Coordinate Response

Establish who must act, what evidence they need, and which containment or remediation steps are appropriate.

Depending on the threat, that may involve revoking exposed credentials, restricting third-party access, isolating affected connections, applying mitigations, engaging the provider, or activating continuity procedures.

Where multiple critical infrastructure operators depend on the same compromised provider, coordination becomes particularly important.

One organization’s remediation may not eliminate the exposure for everyone else.

5. Verify Remediation

Measure whether action actually reduced the threat.

A notification is not remediation. A completed ticket is not necessarily proof that malicious access has been removed.

The process should include evidence of corrective action, confirmation that relevant exposure has been addressed, and continued monitoring for recurring threats.

The objective is a closed loop: intelligence, determination, action, and verification.

The Metrics That Matter

If anticipatory defense is the national goal, success should be evaluated by operational outcomes.
‍

These measures would need consistent definitions and trusted evidence to be comparable. Some outcomes will depend on the actions of third parties outside the reporting organization’s control.

Still, they provide a more useful starting point than counting alerts, questionnaires, or intelligence reports.

Judge intelligence-led defense by one thing: how quickly intelligence turns into verified protective action. How much intelligence an organization collects matters far less.

An Opportunity for CISA: Shared Threat Intelligence, Shared Defense

There is another opportunity worth considering.

Critical infrastructure sectors often share the same providers.

Large telecommunications companies may depend on overlapping cloud platforms, network equipment manufacturers, managed services, software suppliers, and infrastructure partners.

Financial institutions, healthcare systems, and energy providers also rely on common technologies and service providers.

That creates systemic risk. But it also creates the potential for more effective collective defense.

Imagine validated intelligence about a compromised critical provider being matched against known dependencies across participating organizations, with strict controls on security, confidentiality, and legal compliance.

A threat discovered by one organization could help others assess their exposure and take protective action.

This would require careful governance. Sensitive customer relationships, proprietary information, incident details, and investigative intelligence cannot simply be distributed without restriction.

But the underlying principle is compelling.

If multiple critical infrastructure organizations depend on the same provider, intelligence about a credible threat to that provider may be valuable to all of them.

Instead of treating each organization as an isolated defender, we could use appropriately shared threat evidence to accelerate protection across an entire sector.

That is a meaningful extension of CISA’s ambition to move from reactive defense toward coordinated, anticipatory action.

For CISA’s implementation work, the practical question is this: can the time between spotting a threat against a shared provider and taking coordinated protective action become a number the country tracks?

What This Means for Enterprise Security Leaders

CISA is not the only organization that must operationalize these ideas.

Critical infrastructure owners and operators have a direct responsibility to understand the external dependencies that create risk for their businesses.

Three actions are especially important.

First, identify the third parties whose compromise would have the greatest operational consequences.‍

Do not begin with the entire vendor inventory. Begin with the providers that support essential operations, hold sensitive data, or maintain privileged access.

Second, determine whether your organization can recognize active threats against those providers.‍

Can your security team distinguish between a provider with general security weaknesses and one exhibiting credible evidence of compromise?

Can it connect that evidence to your organization’s actual exposure? Can it make that determination quickly enough to act?

Third, establish a response process before a crisis occurs.‍

Who contacts the provider? What evidence is required? When should access be restricted? Who can authorize containment? How do you confirm that the threat has been resolved?

These questions should be answered before intelligence identifies an active threat—not during an incident that is already disrupting operations.

Operationalizing the Model: iCOUNTER’s Perspective

This intelligence-to-action model is the foundation of what we are building at iCOUNTER.

iCOUNTER helps protect your organization by finding and helping resolve active threats at the third parties you depend on.

Our Counter Threat Operating System (CTOS™) is designed to identify threats across an organization’s extended ecosystem, including third parties, subsidiaries, portfolio companies, and brands.

Rather than treating intelligence as the final product, CTOS connects collection with Ecosystem Risk Determination—evaluating threat evidence and its relevance to the enterprise—and managed remediation.

Our approach focuses on three questions:

1. What is happening across the ecosystem?
2. Which threats pose a credible risk to the enterprise?
3. What action is required to reduce that risk?

The managed service helps coordinate remediation with affected third parties and track corrective action, reducing the operational burden on internal security teams.

This is one way to put CISA’s intelligence-to-operations objectives into practice beyond the enterprise perimeter.

Technology alone will not solve the challenge. What matters is the combination of credible intelligence, enterprise context, clear accountability, and verified action.

The Federal Role Is Evolving. The Operational Challenge Remains.

CISA’s strategy comes amid ongoing debate about agency resources, priorities, and the balance of responsibility among federal government, state and local partners, and private-sector infrastructure operators.

The administration’s FY2027 budget request proposed approximately $2.49 billion in gross discretionary funding for CISA. According to CISA’s FY2027 Congressional Justification, that was approximately $386 million below the FY2026 continuing-resolution level, although above the administration’s FY2026 request.

The precise budget outcome remains a matter for the appropriations process.

The operational challenge exists regardless of that outcome.

No federal agency can directly monitor, assess, and remediate every external business relationship supporting America’s critical infrastructure.

Owners, operators, service providers, and government partners will need to translate shared priorities into practical, coordinated defense.

CISA has committed to beginning a review of its services within 60 days of the strategy’s release, producing an implementation plan and measures of success within 180 days, and reporting progress within a year.

Those milestones present an opportunity to define the role of live third-party threat intelligence in anticipatory defense.

The goal should not be additional reporting for its own sake. It should be reducing the time between discovering a credible threat to a critical dependency and taking action that protects essential services.

Conclusion: The Next Foothold May Not Be Inside Your Network

CISA 2030 describes the right direction for national cybersecurity.

Anticipate threats. Prioritize by consequence. Remove adversary access. Maintain operational resilience.

But the next adversary foothold threatening a critical infrastructure operator may not be inside that operator’s environment.

It may be inside a cloud provider, telecommunications partner, managed service provider, software supplier, or another organization with trusted access or operational importance.

Defending only what an organization owns is no longer sufficient to protect everything it depends on.

The next phase of intelligence-led security must extend across the enterprise ecosystem, connect threat evidence to operational consequence, and coordinate action before an external compromise becomes an internal crisis.

CISA has defined the mission: eliminate adversary footholds before they’re weaponized.

Now we need to make sure we’re looking for those footholds everywhere they can threaten us.

About the Author

Jason Brown is Director of Customer Advisory and Counter Fraud Lead at iCOUNTER, where he focuses on translating threat intelligence into actionable security outcomes for enterprise organizations. His work examines emerging adversary behavior, enterprise ecosystem risk, and the operational decisions needed to reduce exposure to active threats.

Sources and Further Reading

1. CISA, CISA 2030: Defend, Harden, Prevail (October 2026)

2. CISA, New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security (October 26, 2026)

3. The White House, Cyber Strategy for America (March 2026)

4. Verizon, 2026 Data Breach Investigations Report

5. CMS, Change Healthcare/Optum Payment Disruption (March 2024)

6. FBI, PRC Targeting of U.S. Telecommunications (April 2025)

7. CISA and FBI, CL0P Ransomware Gang Exploits MOVEit Vulnerability (June 2023)

8. Congressional Research Service, DHS Budget Request Analysis: FY2027 (June 2026)

9. CISA and FBI, fact sheet for critical infrastructure operators working with third-party industrial control system integrators (September 23, 2026)

10. CISA, FY2027 Congressional Justification