FOLLOW US

PART II: IMPLICATIONS FOR U.S. BUSINESS AND CRITICAL INFRASTRUCTURE

A Nation’s Vulnerabilities Laid Bare

The United States has constructed much of its critical infrastructure on systems that were designed for operational reliability and real-time control, not cybersecurity. Water treatment plants, electrical substations, hospital networks, and pipeline control systems often run on legacy hardware that may be decades old, connected to modern networks through interfaces never contemplated by their original designers. This creates a profound and largely unresolved structural vulnerability.

Alex K. Jones, Chair of Electrical Engineering at Syracuse University, explains that water systems, power grids, and industrial control systems are typically designed first and foremost for safety-critical and real-time operation, not for constant software updates or rapid security patching. These environments contain hardware that often remains in service for decades, and many control devices were designed before modern cybersecurity threats were fully understood.

Sectors Under Siege

The threat is not theoretical and is not evenly distributed. CyberCube, the leading provider of cyber risk analytics for the insurance industry, conducted a comprehensive analysis of approximately 975 large U.S. companies with revenues exceeding $1 billion across seven critical industries. Its findings are alarming: 12% of those firms — representing 119 companies — were classified as facing the highest likelihood of being targeted by Iranian cyber threat actors. The sectors with the greatest concentrations of high-risk firms are financial services and healthcare.

Among those 119 high-risk entities are 28 U.S. health organizations and 13 U.S. energy and utilities companies. These are not peripheral actors — they are the backbone of American economic and physical security.

The Defender is Stretched Thin

At the very moment when America needs its cybersecurity infrastructure to be at peak readiness, its primary defense agency has been significantly weakened. CISA — the Cybersecurity and Infrastructure Security Agency — is operating under a partial government shutdown and dealing with major leadership changes simultaneously as Iranian cyberattacks escalate.

Senator Dave McCormick publicly warned that over half of CISA’s workforce has been furloughed, with 2,000 personnel cut down to approximately 800, and that critical cybersecurity and infrastructure assessments have been paused while the threats of Iranian cyberattacks are rising. The agency reportedly lost about a third of its employees since the start of 2025. CISA’s temporary director was reassigned to another division of DHS last week.

"When the government shuts down, cyber threats do not. And our adversaries work 24/7. Even a brief lapse can have lasting consequences on small businesses, federal networks, and American taxpayers."

— Madhu Gottumukkala, Former CISA Acting Director

House Appropriations Committee Chairman Tom Cole separately warned that a shutdown would hinder the country’s ability to protect critical infrastructure and hospitals. Georgetown University cybersecurity professor Dr. Frederic Lemieux was direct: “Diminishing of resources here on cybersecurity at this particular juncture is absolutely dangerous. In a conflict with a known enemy that uses cyber weapons to inflict damage on its opponents, I think it will be tested.”