Why It May Take a Crisis to Move Congress on Cyber Liability

Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
,
Governance & Risk Management

Report Authors Warn Federal Cyber Mandates Likely Won’t Progress Without Disaster

Chris Riotta (@chrisriotta) •
October 12, 2026    

See Also: OnDemand | How Okta and CrowdStrike Share Signals to Enforce Protection Against Cross-Domain Attacks

But they aren’t holding their breath. Adam Segal, who co-authored a September Council on Foreign Relations report urging both fixes measures, said Congress is “very unlikely” to act on either measure under current political circumstances. His warning comes as the Cybersecurity and Infrastructure Security Agency, which the report calls on to spearhead a rebuilt national cyber defense, has shed roughly a third of its workforce since January 2025.

“We tried to be realistically unrealistic,” said Segal, who directs CFR’s cyberspace program and co-wrote the report with senior fellow Rush Doshi and Matthew Ferren, a former CFR fellow and co-author of the 2023 National Cybersecurity Strategy. He added that movement on liability and regulation “may unfortunately come from a disaster of one sort or another.”

Segal told ISMG the current White House is famously against regulation, but he pointed to a shift in how it talks about the artificial intelligence industry. “We can see how much the White House has changed the tenor of its discussions about the AI companies as their agents continue to go rogue,” he said.

The report calls on Congress to create a civil liability regime for vendors that ship products with weak default settings, fail to support multifactor authentication or leave known exploited vulnerabilities unpatched. It urges lawmakers to authorize sector-specific security baselines for critical infrastructure backed by meaningful enforcement, and to require major cloud providers, internet service providers and security vendors to share threat data with the government in near real time.

Past efforts to impose vendor liability or security requirements on critical infrastructure failed because they lacked political support and a sustained focus on implementation, the authors wrote U.S. defense has instead largely relied on voluntary guidelines. The Trump administration’s 2026 cyber strategy focuses on offensive operations, which the report says have disrupted individual Chinese campaigns without meaningfully degrading Beijing’s capacity (see: Trump’s Cyber Strategy Puts Private Sector on the Offensive).

The report warns that China has moved beyond espionage to pre-positioning inside U.S. water systems, energy grids, telecommunications networks and transportation systems so it can disrupt those sectors amid a geopolitical conflict. Volt Typhoon hackers held access to U.S. critical infrastructure networks for at least five years before public disclosure, officials have said, while Salt Typhoon compromised at least nine U.S. telecommunications carriers and reached more than 200 organizations in roughly 80 countries (see: Here’s How the FBI Stopped a Major Chinese Hacking Campaign).

That access also gives Beijing deniable and reversible ways to escalate in a crisis short of war. Organizers of a separate think tank war game recently warned that China is more likely to pressure Taiwan through cyber-enabled economic warfare – including attacks on its communications – than through an outright invasion.

Under the report’s recommendations, CISA would administer a proposed National Collective Defense System for near-real-time, machine-to-machine sharing of threat indicators. The agency would also be tasked with fusing mandatory provider reporting with data from new sensors in operational technology environments while potentially gaining the authority to compel protective actions by private operators.

The report blames the Department of Government Efficiency for hollowing out the agencies that are key to federal cyber defense. Asked whether CISA could absorb the mission the report envisions, Segal said: “No, not at its current size or staffing.”

“That’s why we stressed the need to rebuild U.S. state capacity, and right now CISA is the most appropriate organization,” he added.

The authors warn that the U.S. lead over China in AI models with advanced cyber capabilities is tenuous. Chinese firm Moonshot’s open-weight Kimi K3 model, released in July, matches and in some cases outperforms advanced models from OpenAI and Anthropic.

Segal said the most important steps are scaling public-private cooperation on AI defense and increasing national laboratory support for developing AI defenses. He also pointed to the need for greater cooperation among frontier labs, and said bans on open-weight models are unlikely because “defenders need to use them.”

The White House launched its Gold Eagle initiative in July to bring federal agencies, critical infrastructure operators and frontier labs together to find and patch vulnerabilities discovered by advanced AI models (see: US Government Launches AI Vulnerability Clearinghouse). The report urges those partners to identify where federal funding could support AI-enabled vulnerability research in operational technology firmware and open-source projects that commercial efforts are unlikely to prioritize.