• The Coast Guard has a new leader. Admiral Kevin Lunday officially assumed command of the service on Thursday during a ceremony at Coast Guard headquarters. The Senate confirmed Lunday last month after his nomination was temporarily delayed due to a controversy over the service’s policy regarding hate symbols. He had been serving as acting commandant since January, following the dismissal of Admiral Linda Fagan by President Donald Trump. Lunday previously led Coast Guard Cyber Command. He also held a senior leadership role at U.S. Cyber Command.
  (Coast Guard finally gets its permanent leader - U.S. Coast Guard)
• Early-career employment in the federal workforce is trending downward. Currently, about 8% of federal employees are under age 30. That’s a 1% decrease since this time last year, likely due to the Trump administration’s workforce reductions. The federal workforce has struggled for years with its ability to recruit and retain younger employees. The average age of a federal worker is 47, and about 13% of the federal workforce is currently eligible for retirement.
  (Federal workforce age data - Office of Personnel Management)
• Lawmakers are halfway done with a comprehensive spending deal for the rest of the fiscal year. The Senate passed a “minibus” of spending bills covering the departments of Justice, Interior, Commerce and Energy, as well as the Environmental Protection Agency, the National Science Foundation and NASA. The House passed the same three-bill package last week. Congress still has other spending bills it needs to pass. The continuing resolution keeping many agencies funded at last year’s spending levels is set to run out on Jan. 30.
  (Senate Cloakroom update - Social media platform X)
• A watchdog at the Department of Veterans Affairs said generative AI tools used to help treat patients pose a potential safety risk. VA’s inspector general office said the department’s IT shop, National AI Institute and National Center for Patient Safety, lack a formal mechanism to identify, track or resolve risks associated with generative AI. The VA has approved AI chat tools to support medical decision-making when VA clinicians treat patients and to copy information into the department’s electronic health record system. The IG’s office said its review of these tools remains ongoing.
  (Review of VHA’s Use of Generative Artificial Intelligence - VA Office of Inspector General )
• Thrift Savings Plan participants will soon have the option of making Roth in-plan conversions in their TSP accounts. The Federal Retirement Thrift Investment Board has finalized regulations that will allow participants to convert money from their traditional or pre-tax TSP balances into their Roth or after-tax TSP balances. The in-plan conversion option will be available to all participants starting Jan. 28.
  (Final rule on Roth in-plan conversions - Federal Retirement Thrift Investment Board)
• The Army is updating its software policy once again. Two years after issuing its call to move to an agile approach to software development, the Army is ready to move into the second phase of this modernization effort. In the coming weeks, the service will update its policy to emphasize the use of "colorless" money for software development. Army CIO Leo Garciga said program offices and commands have met the initial goals of creating iterative development platforms outlined in the March 2024 policy. He said the new policy will now focus on improving how the Army estimates the cost of software projects and will fine tune the use of low-code/no-code platforms.
  (Army to update 2-year-old software policy - AFCEA Nova)
• The cloud security program known as FedRAMP is seeking feedback from agency and industry experts on six different framework documents. These include everything from expanding the marketplace to using external frameworks to creating machine-readable packages. Pete Waterman, the FedRAMP director, wrote in a blog post that the RFCs are the culmination of nearly a year of planning, testing and community input, marking a significant milestone in realigning FedRAMP with the FedRAMP Authorization Act and OMB implementation memo. Comments are due anytime from mid-February to early March. The PMO also will host a series of community sessions to discuss each of the documents.
  (FedRAMP in final throes of updating underlying framework documents - FedRAMP)
• The Army is chipping away at its legacy system. The service once operated more than 800 independent business systems, many of which didn’t communicate with the broader enterprise and were built with limited technology at the time. Army officials said the number of those systems has now been reduced to fewer than 300. The service however, continues to operate 58 separate human resources management systems and 42 independent training and readiness systems. Under Secretary of the Army Mike Obadal said while they are “not even close to where they need to be,” change is coming. The undersecretary said the advantage in modern conflict “does not come from having more platforms but from infusing our hardware with right technologies.”
  (Army consolidates hundreds of antiquated systems - Army IT Day)

The post The Coast Guard officially has a new leader first appeared on Federal News Network.

The past year in federal cybersecurity policy was full of uncertainty, as a change in administration, expiring authorities and the emergence of artificial intelligence converged and led to plenty of questions about the future of the cybersecurity landscape.

Going into 2026, cyber policymakers and experts are expecting some clarity, especially around the interplay of AI and cyber. Here are five things to watch when it comes to federal cyber issues as the new year gets underway:

New national cyber strategy

The White House is expected to issue a new national cyber strategy early in the new year. During an appearance at the Aspen Institute’s Cyber Summit in November, National Cyber Director Sean Cairncross said the strategy won’t be a lengthy document.

“It’s going to be a short statement of intent and policy and then it will be paired very quickly with action items and deliverables under that,” Cairncross said. “As a topline matter, it’s going to be focused on shaping adversary behavior, introducing costs and consequences into the mix.”

Cairncross said the strategy will feature six pillars. And he said the Office of the National Cyber Director is also working on a “workforce initiative” to address cyber talent gaps.

“There’s over half a million cyber jobs just on the decks now that need filling and there will be a need for more,” Cairncross said. “We need to align industry incentives, academic incentives, vocational school incentives, [venture capital] and bring them together collaboratively to better the workforce for the country.”

Morgan Adamski, a former National Security Agency leader and executive at PWC, said the cyber strategy’s expected focus on influencing adversarial behavior and offensive cyber operations points toward a shift toward “active defense.”

“Active defense is essential because it shifts security from a passive, reactive posture to a proactive one that actively reduces risk,” Adamski told Federal News Network. “Instead of waiting for threats to materialize and cause damage, active defense emphasizes continuous monitoring, rapid detection, and timely response. This approach shortens the window between intrusion and containment, limits the attacker’s ability to escalate, and protects critical assets before harm spreads. In an environment where threats evolve quickly and adversaries adapt, relying solely on static controls is insufficient.”

AI and cyber

Industry will be closely reading the strategy for what it says about the multifaceted issue of AI. Cyber experts generally divide the issue into three broad categories: securing AI systems and data; defending against AI-enabled cyber attacks; and using AI for cyber defense.

Drew Bagley, Crowdstrike’s vice president for privacy and cyber policy, pointed to how federal agencies have embraced the “zero trust” concept in recent years, as well as technologies like endpoint detection and response, and log management.

“Now it’s going to be increasingly important to think about how those same concepts are applied to AI,” Bagley told Federal News Network. “If AI is going to continue to be embraced at this rapid speed without there being visibility into what’s going out the door with AI, then you have a problem. You have another attack surface.”

Bagley said he’s watching for the Cybersecurity and Infrastructure Security Agency to provide the federal government with leadership on AI security.

“CISA can provide guidance to those who are implementing AI in federal agencies as far as what the security standards need to be to make sure that that AI is secure and that AI is not introducing a security threat in and of itself,” he said.

Meanwhile, agency chief information security officers are also considering how they can use AI to improve cyber defenses. Adamski said CISOs will have to focus on both securing AI systems and harnessing AI for cybersecurity at the same time.

“AI is becoming a genuine force multiplier for defense, especially in security operations where teams are overwhelmed and attackers move fast,” she said. “It can improve detection, speed up investigation, enhance threat hunting, and help prioritize what matters most. In many environments, that kind of leverage is the difference between containing an incident quickly and getting buried by volume.”

CISA 2015 reauthorization

While Congress typically doesn’t move major pieces of legislation during an election year, the reauthorization of cybersecurity information sharing authorities remains a pressing priority when lawmakers return from their holiday recess.

The Cybersecurity Information Sharing Act of 2015 lapsed on Oct. 1. Congress gave it a temporary revival as part of the continuing resolution to reopen the government, but the CISA 2015 authorities are set to expire again on Jan. 30.

Reauthorizing the law has broad bipartisan support, including from the White House. But House Homeland Security Committee Chairman Andrew Garbarino (R-NY) has acknowledged the path to reauthorizing CISA 2015 remains murky at best.

In the House, lawmakers have advanced Garbarino’s bill, the Widespread Information Management for the Welfare of Infrastructure and Government Act (WIMWIG Act), through the committee. The bill would extend CISA 2015 for another decade and provide key definitional updates.

“Our colleagues in the Senate have different ideas. Some of them want to do a 10-year clean [reauthorization]. I don’t know if I can get that passed in the House, with concerns from the Freedom Caucus,” Garbarino said at an event hosted by Auburn University’s McCrary Institute in December.

Meanwhile, Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul (R-Ky.) also opposes a “clean” reauthorization due to his concerns about agencies working with social media companies on disinformation, which occurred under separate authorities from CISA 2015.

“I don’t know how it gets done on its own,” Garbarino said. “I feel like we have to attach it to another piece of legislation, whether that’s government funding. But we need it passed and unfortunately I don’t think we’re close enough with the discussions on the Senate to figure out which bill will pass and what will get done.”

The upshot, Garbarino continued, is another possible short-term extension of CISA 2015.

“Which is unfortunate because we worked very hard to get our bill out of committee,” he added. “It took a lot of requests or advice from the private sector on updates. So we love our piece of legislation that we got done. When you get the trial attorneys to not object to your bill giving liability protection, that’s a pretty good thing.”

CIRCIA rule

CISA the agency, meanwhile, is set to issue a landmark cyber incident reporting rule that will apply to vast swaths of the 16 U.S. critical infrastructure sectors.

Congress passed the Cyber Incident Reporting for Critical Infrastructure Act in 2022. The law generally requires critical infrastructure organizations – in sectors like energy, water and telecommunications – to report significant cyber incidents to CISA within 72 hours.

The law represents the most far-reaching federal cybersecurity regulation ever passed by Congress.

In 2024, CISA released a proposed rule to implement the law. At the time, the agency estimated the rule will apply to some 316,000 entities across the country.

Industry has criticized the proposed rule for being overly broad and is also encouraging CISA to “harmonize” the rule with many existing cyber incident reporting mandates.

The Trump administration has delayed the release of the final rule until May 2026, providing CISA with more time to respond to those concerns.

Cyber leader gaps

Meanwhile, CISA also heads into 2026 without a Senate-confirmed leader. Trump nominated Sean Plankey to serve as CISA director in March. But Plankey’s nomination has been held up in the Senate for various reasons.

Most recently, Sen. Jacky Rosen (D-Nev.) has placed a hold on Plankey’s nomination due to concerns about the Coast Guard’s implementation of a new hate speech policy. Plankey has been serving as a senior advisor in the Coast Guard.

Meanwhile, the National Security Agency and U.S. Cyber Command is also still under acting leadership at the start of the new year.

The dual-hat role of NSA director and CYBERCOM commander is a key cybersecurity post, especially with the Trump administration’s emphasis on offensive cyber operations. The role had been held by Air Force Gen. Timothy Haugh, but Trump ousted Haugh in April, reportedly at the behest of far-right influencer Laura Loomer.

According to multiple reports, Trump now intends to nominate Army Lt. Gen. Joshua Rudd to lead the NSA and CYBERCOM.

And in Congress, Senate Homeland Security and Governmental Affairs Committee Chairman Gary Peters (D-Mich.) announced that he will not seek re-election in 2026, meaning he will retire effective January 2027. Peters has been one of the most influential members of Congress on cyber policy over the last decade.

The post Five things to watch in cybersecurity for 2026 first appeared on Federal News Network.