Democrats’ big wins in the midterm elections are poised to transform cybersecurity policymaking and oversight on Capitol Hill, with potentially big implications for critical infrastructure operators and other businesses that work with the government.
After Democrats take control of the Senate and the House of Representatives in January, they likely will ramp up scrutiny of the Cybersecurity and Infrastructure Security Agency (CISA), accelerate efforts to solve AI security challenges and revive cybersecurity grants for struggling local utilities, experts told Cybersecurity Dive. Republican lawmakers have largely ignored those subjects, in part to avoid angering or embarrassing President Donald Trump’s administration, but Democrats — newly energized by unexpectedly sweeping gains on Tuesday — are expected to take a far more assertive approach to cybersecurity hearings, investigations and legislation.
Key figures in Congress’s new Democratic majority told Cybersecurity Dive that they viewed digital security as a top priority.
“Our government’s number one job is to keep people safe,” said Sen. Maggie Hassan, D-N.H., the likely next chair of the Senate Homeland Security Committee. “That work involves protecting against terrorism and fentanyl trafficking, but it also includes guarding against emerging threats like artificial intelligence security risks and strengthening our cybersecurity.”
As Democrats prepare to take charge in Congress, a combination of evolving threats, struggling agencies and expiring programs is already filling their cybersecurity agenda.
Saving cybersecurity information sharing
One of Democrats’ first cybersecurity priorities will be reauthorizing the Cybersecurity Information Sharing Act, which gives companies liability protections for sharing cyber threat information with each other and the federal government. That law, initially passed in 2015, expired in late 2025, before Congress temporarily renewed it several times. Lawmakers could pass another short-term renewal during the lame-duck legislative session that begins on Nov. 9. If they don’t, it will fall to the new Democratic leadership to deal with the law in January.
Whether Congress temporarily revives the information-sharing program again or passes a full 10-year reauthorization depends on Sen. Rand Paul, R-Ky. Paul, the outgoing chairman of the Senate Homeland Security Committee, who has repeatedly blocked a full reauthorization, forcing lawmakers to tuck temporary renewals into other bills. Even if Paul leaves the homeland-security panel, he could still slow down a standalone reauthorization bill on the Senate floor.
The information-sharing law is “more likely to be reauthorized under Democratic control,” but it still won’t be easy, said Sarah Beth Jansen, a partner at the Franklin Square Group and a former counsel for the Senate Homeland Security Committee.
The business community hopes Democrats will be able to end the cycle of short-term renewals.
“With geopolitical tension rising and threats growing more sophisticated, industry needs confidence this law will remain in place,” said Henry Young, senior director of policy at the software trade group BSA. “Congress should not have to repeatedly revisit a bipartisan law that has become a cornerstone of America’s cybersecurity defenses.”
Restoring a beleaguered CISA
Democrats’ biggest cybersecurity project will be helping CISA rebuild its depleted ranks and ensuring that the agency is effectively performing its dual missions of safeguarding federal networks and assisting critical infrastructure operators. CISA has lost one-third of its workforce and ended key programs and services, which has placed serious strain on its relationships with businesses and local governments. The Trump administration recently allowed CISA to resume hiring to fill important vacancies, but that process is moving slowly.
“CISA will be one of the biggest areas of focus, particularly whether the agency has the workforce, resources and capabilities needed to carry out its mission,” said Morgan Adamski, the head of PwC’s cyber and tech risk practice and a former senior official at the National Security Agency and U.S. Cyber Command.
During the first two years of the Trump administration, congressional Democrats have repeatedly pushed back against the CISA cuts. In August, key House lawmakers asked the Government Accountability Office to study the agency’s status. One month later, several of those lawmakers introduced a bill that would require a rigorous assessment of CISA’s capabilities.
Hassan said the Trump administration had “undermined our security” by “gutting CISA.”
“We need to reverse these cuts, confront these challenges, and put public safety first,” she added.
Rep. Bennie Thompson, D-Miss., the likely next chair of the House Homeland Security Committee, said Democrats were reclaiming control of Congress “at a pivotal time for CISA.” He vowed to help CISA “expedite its critical re-staffing effort” and “ensure it has the expertise necessary to support stakeholders as they defend against the scale and velocity of AI-enabled cyberattacks.” Given AI’s rapid-fire exposure of dangerous security vulnerabilities, he added, “CISA must be well-positioned to help critical infrastructure owners and operators rapidly improve their cybersecurity posture.”
Rebuilding CISA’s workforce “will definitely be a priority” for Democrats, Jansen said.
On the funding front, CISA will likely benefit from the ascension of Sen. Patty Murray, D-Wash., to the chair of the powerful appropriations committee. “She is a big supporter of CISA,” said Michael Garcia, a vice principal in Monument Advocacy’s cybersecurity practice and a former senior policy adviser at CISA.
Restaffing CISA could turn into a bipartisan project, Garcia said, as some Republicans have recently acknowledged that the Trump administration’s downsizing effort went too far. Whether that rhetoric translates into real oversight or legislation, however, is unclear, he added.
CISA’s partnerships with infrastructure operators will be under the microscope, particularly in the early phases of the government’s new framework for public-private collaboration, the Alliance of National Councils for Homeland Operational Resilience – Critical Infrastructure (ANCHOR-CI), which is replacing an older system, the Critical Infrastructure Partnership Advisory Council (CIPAC).
Thompson said Democrats will “work to ensure CISA re-establishes its cross-sector coordination capacity, which was diminished when the Trump Administration terminated CIPAC, by making sure the ANCHOR-CI is eventually up and running and meets the needs of stakeholders.”
Democrats are also expected to closely monitor CISA’s handling of its biggest current project, the creation of a cybersecurity incident reporting program for critical infrastructure operators. With CISA finalizing the regulation that will create the program, Democrats will want to know how the agency is revising an earlier draft that the business community and key lawmakers called too onerous. “Congress will be interested in whether implementation strikes the right balance between improving visibility into cyber threats and avoiding unnecessary reporting burdens,” Adamski said.
On those and other issues, “agency leaders will be regularly called to testify about CISA’s actions and priorities,” said an industry executive, who requested anonymity to speak candidly.
But while Democrats are likely to push CISA harder than Republicans have for answers to difficult questions, Jansen said the process shouldn’t become acrimonious, because Nick Andersen, CISA’s acting director, appears to have bipartisan respect.
Taming the AI whirlwind
Other than rebuilding CISA, no cybersecurity issue will consume more attention in the new Democratic-led Congress than AI, which is making it easier for advanced and amateur hackers alike to pose serious threats to U.S. critical infrastructure.
“There is a lot of focus on AI at the moment, including on how AI is fueling cyberattacks,” said Kevin Cummins, a partner at the Franklin Square Group and a former staffer for the Senate appropriations and commerce committees.
Adamski predicted that AI security would become “an increasingly important focus of congressional oversight,” with Democrats showing “greater interest in whether federal agencies and industry have appropriate safeguards in place.”
Lawmakers could push for new security regulations on frontier AI labs, including around the testing procedures that have recently enabled many autonomous hacks. So far, however, Democrats do not have a comprehensive AI strategy that would allow them to easily pass such a bill.
In the meantime, Democrats could use their oversight powers in other ways, such as pushing the Commerce Department to revitalize its AI safety center and demanding that the Trump administration include CISA in its AI task force.
Democrats plan to “make sure CISA is well-positioned to support the secure development and deployment of AI,” Thompson said.
Grants, DOGE and private hacking
A grab-bag of other cybersecurity issues has potential to attract Democrats’ attention after they take control of Congress.
Lawmakers will likely revisit the State and Local Cybersecurity Grant Program, which Democrats created as part of President Joe Biden’s infrastructure law the last time they controlled Congress. The program’s authorization and funding have both lapsed, but Democrats saw it as an effective tool for strengthening vulnerable public services.
Thompson said Democrats will “prioritize getting resources straight into the hands for defenders” by renewing the grant program and “improving support of under-resourced sectors, especially water.”
The program was Hassan’s brainchild, giving it a newly powerful backer. “Hassan, as a former governor, can make a strong case as to how this program will help empower states,” Garcia said.
Democrats are also likely to scrutinize the Department of Government Efficiency’s cuts to the federal cybersecurity workforce and pressure the government to fill vacancies at the National Institute of Standards and Technology, the State Department and the various sector risk management agencies that liaise with infrastructure communities.
Democrats are expected to maintain Congress’s bipartisan focus on regulatory harmonization, which could include seeking testimony from National Cyber Director Sean Cairncross, whose office is leading that work.
In addition, with Trump proposing to let private companies hack foreign cybercrime gangs, Democrats could try to use spending bills to place restrictions on that program.
“Given that there is a growing anti-tech/big-AI-company sentiment with the Dems, anything that looks like the private sector has unfettered control or access might be scrutinized,” Jansen said.
Democrats could even get backing in that effort from Republicans, Jansen added, some of whom “might also be skeptical of the authority private-sector companies should have for offensive cyber.”
——————————————————-
Click Here For The Original Source.
