Who Defends America Against Cyberattacks
Key takeaways
- No single agency is in charge. CISA protects civilian federal networks and helps private companies, Cyber Command and the NSA handle military and foreign threats, and the FBI investigates attacks and catches hackers.
- Most of the country's critical systems, from power grids to hospitals, are privately owned, so the government relies heavily on voluntary cooperation.
- Major breaches include the theft of 21.5 million personnel records from OPM in 2015, the SolarWinds hack found in 2020, the Colonial Pipeline ransomware attack in 2021, and Chinese intrusions into telecom networks disclosed in 2024.
- Americans reported a record of about 20.9 billion dollars in losses to cybercrime in 2025, according to the FBI.
- CISA lost about a third of its staff in 2025 and furloughed most of the rest during the 2026 Homeland Security funding lapse.
- Rules requiring companies to report major attacks within 72 hours were passed in 2022 but are still being finalized.
Cyberattacks can shut down pipelines, lock hospitals out of patient records, steal secrets, and drain bank accounts. Defending against them involves dozens of federal agencies, state governments, and thousands of private companies that own most of the targets.
This guide explains who does what, from the civilian agency that coordinates defense to the military command that operates abroad, along with the laws companies must follow and the arguments over how the system should change.
The United States has no single cybersecurity regulator. A 2022 law will require critical infrastructure companies to report major attacks within 72 hours and ransom payments within 24 hours once final rules are issued. Since 2023, public companies must tell investors about material cyber incidents within four business days under Securities and Exchange Commission rules. The Transportation Security Administration set rules for pipelines and railroads after the Colonial attack, the Federal Communications Commission oversees telecom security, defense contractors must meet certification standards that took effect in late 2025, and the National Institute of Standards and Technology publishes a widely used voluntary framework.
The Cybersecurity and Infrastructure Security Agency, created within Homeland Security in 2018, protects the networks of civilian federal agencies, helps the owners of 16 critical infrastructure sectors defend themselves, issues warnings and emergency directives, and helps state and local officials secure elections. It has no power to order most private companies to do anything, so it works by sharing information and offering free services. Its staff fell from about 3,300 in early 2025 to about 2,300 a year later, and most remaining employees were furloughed during the Homeland Security funding lapse that began on February 14, 2026.
Foreign governments, criminal gangs, and individual hackers target federal agencies, businesses, and ordinary Americans. Russian intelligence slipped malicious code into SolarWinds software updates used by thousands of organizations, discovered in December 2020. A ransomware gang shut down the Colonial Pipeline in May 2021, causing fuel shortages on the East Coast. Chinese government hackers stole records on 21.5 million people from the Office of Personnel Management in 2015, broke into major telecom companies in a campaign called Salt Typhoon disclosed in 2024, and placed hidden access in water and power systems in a campaign called Volt Typhoon. The FBI received reports of about 20.9 billion dollars in cybercrime losses in 2025, a record.
The Office of the National Cyber Director, created in 2021 in the White House, coordinates policy and strategy. A 2015 law that encourages companies to share threat information with the government lapsed on October 1, 2025, and Congress restored it in February 2026 only through September 30, 2026. The Cyber Safety Review Board, which investigated major breaches, was disbanded in January 2025. Supporters of recent changes say they cut overlap and shift work to states and the private sector, while critics say staff cuts and lapses leave the country less prepared. Lawmakers also debate whether to require stronger security in critical industries rather than relying on voluntary steps.
The FBI leads investigations of cyberattacks inside the United States, runs the Internet Crime Complaint Center where the public reports scams, and works with foreign police to seize criminal servers and arrest hackers. The Secret Service investigates financial cybercrime. The Justice Department's National Security Division charges foreign government hackers, and the Treasury Department sanctions ransomware gangs and those who help them launder money. Under a 2016 policy, the FBI leads the response to the attackers, while CISA helps victims recover.
U.S. Cyber Command, a combatant command at Fort Meade, Maryland, defends military networks and conducts cyber operations abroad, following a strategy called defend forward that disrupts threats inside foreign networks. It shares a commander with the National Security Agency, which collects foreign intelligence and protects classified government systems. The NSA also publishes security advice for companies and warns about vulnerabilities it discovers. Debates continue over whether one officer should lead both and how far offensive cyber operations should go.
See the wider security picture in the intelligence community and homeland security agencies, or how the government buys its technology in how the government buys things.