The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a new national cybersecurity strategy Monday, October 26, outlining a shift from largely defensive measures toward identifying, disrupting, and removing attackers already operating inside critical infrastructure networks. The strategy prioritizes systems whose compromise could have the greatest consequences for national security, public safety, and the economy.

The strategy, titled CISA 2030: Defend, Harden, Prevail, establishes three priorities: leading national cyber defense, concentrating resources on the most critical infrastructure, and strengthening the country’s ability to withstand and recover from disruptions. It aligns with the Trump administration’s broader cybersecurity and national resilience policies.

Removing attackers before they cause disruption is a central objective. CISA intends to work with government agencies, infrastructure operators, and technology providers to detect malicious activity earlier, eliminate unauthorized access, and prevent adversaries from maintaining a foothold in essential systems. The approach emphasizes coordinated threat intelligence, operational security, and rapid incident response.

Infrastructure protection will become more selective and risk-driven. Rather than applying resources uniformly across potential threats, CISA plans to prioritize systems according to the likelihood and consequences of disruption. This includes strengthening operational technology, improving visibility into vulnerable assets, securing software supply chains, and directing assistance toward infrastructure essential to national functions.

The resilience component extends beyond preventing intrusions. CISA plans to improve emergency communications, strengthen cooperation across infrastructure sectors, and support continuity of operations during cyber and physical disruptions. Telecommunications networks, including emerging 5G and 6G systems and satellite communications, are among the technologies identified for resilience efforts.

The strategy establishes three implementation milestones. Within 60 days, CISA will begin reviewing its core services and capabilities against the new priorities. An implementation plan with measures of success is due within 180 days, followed by a progress report within 365 days. The strategy does not yet specify which existing programs may lose resources as priorities change.

The announcement coincides with an emergency response to two critical PHP vulnerabilities, collectively known as PHP2Shell, that allow unauthenticated remote code execution on vulnerable web servers. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, following emergency security updates issued October 21. The incident is separate from the new strategy but illustrates the active exploitation risks facing Internet-connected systems.

CISA’s immediate implementation challenge is to translate its strategic priorities into operational changes. The planned service review and subsequent implementation report will provide the first concrete indications of how the agency intends to redistribute resources and measure improvements in national cyber defense.