America's once-ambitious cyber defences are starting to rust, according to the latest annual report from the US Cyberspace Solarium Commission (CSC), which warns that policy momentum has slowed and even slipped backwards thanks to Trump-era workforce and budget cuts.

The commission's [1]2025 Annual Report on Implementation finds that only 35 percent of its original 82 recommendations have been fully implemented – down from 48 percent a year ago. Another 34 percent are "nearing implementation", and 17 percent "on track," but this marks the first time in the body's five-year history that the US has actually lost ground on cyber reform.

The watchdog lays much of the blame on workforce cuts and funding shortfalls at critical agencies, particularly at CISA, whose mandate to protect critical infrastructure has been "weakened by [2]steep workforce and budget cuts ." The report says the rollback has hobbled CISA's capacity to scale early-warning systems, partner with industry, and maintain trust with the private sector.

[3]

Diplomatic cyber capacity has also eroded, the report warns, citing deep cuts to the State Department's science and capacity-building programs and the continued absence of a Senate-confirmed leader for its Bureau of Cyberspace and Digital Policy. Those functions were seen as vital for projecting US cyber power abroad and coordinating with allies against hostile state activity.

[4]

[5]

"The United States faces a pivotal decision point," the commission writes. "It is up to the administration and Congress to seize this opportunity to secure the gains of the past five years; reinforce its cyber deterrence posture; and send a clear signal of capability, intent, and continuity to its adversaries."

It warns that adversaries are innovating faster than Washington can respond, and that previous gains could quickly evaporate without renewed investment.

[6]

Among its top five priorities for the administration: restore funding and staffing for CISA, boost the clout of the Office of the National Cyber Director (ONCD), rebuild diplomatic cyber capacity, reinstate the Critical Infrastructure Partnership Advisory Council (CIPAC) to improve public-private collaboration, and expand the federal cyber talent pipeline.

That last point comes with a sharp jab at the administration's hiring policies. The report argues that [7]Trump's rollback of diversity and inclusion initiatives and his introduction of "at-will" hiring mandates have narrowed the pipeline at exactly the moment when demand for skilled cyber professionals is exploding.

"The result is a growing gap in filling critical cyber positions from an already limited talent pool," the report states.

[8]Trump scrubs all mention of DEI, gender, climate change from federal websites

[9]TI CEO says some customers still wary of Trump's import tax roulette

[10]Nvidia still needs Taiwan even as TSMC ramps Blackwell production in Arizona

[11]Chamber of Commerce sues over Trump's $100K H-1B paywall

Even more worrying, the CSC notes that "nearly a quarter of fully implemented recommendations have lost that status," meaning some of the progress made since 2020 is already unravelling. "For the first time, there has been a substantial reversal of the advances made in previous years," it warns.

The overall tone of the report is one of frustration mixed with urgency. Many of the original reforms are still in motion, but the pace has faltered. The commission stresses that continuity, across administrations and political divides, is essential if the US is to keep up with adversaries such as China, Russia, and Iran.

[12]

The message is clear: the cyber threats aren't slowing down, even if Washington seems to be. ®

Get our [13]Tech Resources



[1] https://www.fdd.org/analysis/2025/10/22/2025-annual-report-on-implementation/

[2] https://www.theregister.com/2025/10/14/cisa_jettisoning_more_staff_reassigning/

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aPqlc1MPZ8BoBRDdM-tC2QAAAQY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aPqlc1MPZ8BoBRDdM-tC2QAAAQY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aPqlc1MPZ8BoBRDdM-tC2QAAAQY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aPqlc1MPZ8BoBRDdM-tC2QAAAQY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2025/02/03/trump_admin_scrubs_dei_websites/

[8] https://www.theregister.com/2025/02/03/trump_admin_scrubs_dei_websites/

[9] https://www.theregister.com/2025/10/22/tales_of_tariff_trepidation_at/

[10] https://www.theregister.com/2025/10/20/nvidia_arizona_blackwell/

[11] https://www.theregister.com/2025/10/17/chambers_of_commerce_h1b/

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aPqlc1MPZ8BoBRDdM-tC2QAAAQY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://whitepapers.theregister.com/