CISA funding cuts expose the limits of ATT&CK-dependent defence

At a glance

What this is: This Delinea analysis says funding pressure around CISA and MITRE is exposing how dependent threat-informed defence has become on public ATT&CK and CVE infrastructure.

Why it matters: IAM, SOC and detection teams need to treat ATT&CK and CVE as versioned dependencies, because taxonomy drift or service disruption can quietly erode detections, playbooks and coverage reporting.

Context

CISA funding cuts are not just a public-sector budget story. They matter because many detection, hunting and response programmes have built their operating model around public ATT&CK mappings, CVE identifiers and related guidance that assume continuity.

The core governance issue is dependency management. If the public taxonomy layer slows, fragments or becomes harder to maintain, defenders still have to preserve internal consistency across detections, playbooks, threat models and reporting.

Key questions

Q: What should security teams do when ATT&CK or CVE updates become unreliable?

A: Treat public taxonomies as versioned dependencies. Keep local snapshots, maintain internal mappings to the ATT&CK version you actually use, and mirror CVE and related feeds into your own environment so slow updates or short outages do not break detections, prioritisation or reporting.

Q: Why do public funding cuts matter to detection engineering and threat modelling?

A: Because those programmes rely on shared reference points that make detections, playbooks and incident reports comparable. When funding pressure slows updates or weakens support, teams have to do more internal mapping work and cannot assume external taxonomies will stay complete for every new behaviour.

Q: What breaks when organisations rely on ATT&CK as the only taxonomy layer?

A: Coverage drift becomes harder to spot. New cloud, SaaS or AI-assisted techniques may be forced into old buckets, vendor-specific labels may diverge, and leadership may overestimate coverage if reports do not state the ATT&CK version and any extensions in use.

Q: How should teams govern their internal mappings to ATT&CK and CVE?

A: Use a change-controlled catalogue with clear ownership across detection engineering, threat intel, red or purple team and GRC. Record version baselines, approve extensions, and keep crosswalks between internal technique IDs and public identifiers so reports stay consistent.

Technical breakdown

Why ATT&CK works as a shared detection language

MITRE ATT&CK is a curated behaviour vocabulary, not a detection product. Its value comes from stable technique IDs, matrices and mappings that let security teams connect SIEM rules, EDR telemetry, SOAR playbooks and threat intel to the same adversary behaviour. When ATT&CK remains current, teams can compare incidents, tune coverage and align purple-team exercises without translating every tool's terminology. The article's point is that this usefulness depends on a maintained reference model, not on the assumption that the model updates itself. Practical implication: preserve your own ATT&CK version baseline and map internal detections against it deliberately.

Practical implication: preserve your own ATT&CK version baseline and map internal detections against it deliberately.

How CVE dependency creates a hidden governance risk

CVE is a public identifier system, but many asset, vulnerability and prioritisation workflows treat it as an always-available upstream service. When MITRE warned that its DHS contract could expire, the risk was not only a temporary outage. It was the possibility that the identifier backbone used by scanners, ticketing and remediation processes could become less predictable under short budget cycles. That makes CVE a governance dependency, not just a reference list. Practical implication: mirror the identifiers you rely on and avoid designing remediation workflows that fail if the public feed is delayed.

Practical implication: mirror the identifiers you rely on and avoid designing remediation workflows that fail if the public feed is delayed.

What happens when ATT&CK coverage drifts from attacker behaviour

If framework updates slow, the problem is not that current mappings disappear. The problem is coverage drift. New behaviours, especially in cloud, SaaS and AI-assisted intrusion paths, are forced into older technique buckets or left described only in vendor-specific language. Over time, that weakens comparison between teams and makes confidence statements about 'coverage' less reliable unless they specify the ATT&CK version and any extensions used. Practical implication: maintain an internal TTP catalog that extends ATT&CK where necessary and records the version behind every report.

Practical implication: maintain an internal TTP catalog that extends ATT&CK where necessary and records the version behind every report.

Threat narrative

Attacker objective: The practical objective is to exploit governance fragility in public security dependencies so defenders lose consistency, freshness and comparability in their threat-informed defence programmes.

1. Entry occurs through ecosystem dependence, where defenders consume ATT&CK and CVE as upstream public services for detection and prioritisation.
2. Escalation happens when funding cuts, layoffs and shutdown furloughs reduce the capacity to maintain, update and support those services at the pace teams expect.
3. Impact appears as taxonomy drift, delayed guidance and weaker confidence in coverage reporting, which can obscure emerging attacker behaviours and slow response alignment.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Public threat taxonomies have become operational dependencies, not background references. ATT&CK and CVE are now embedded in detection engineering, incident triage and exposure management workflows. When those services face funding turbulence, the issue is not inconvenience, it is control-plane uncertainty for the defenders who built process, reporting and tooling around them. Practitioners should treat taxonomy continuity as part of security architecture, not just content maintenance.

ATT&CK drift is a governance problem before it is a content problem. The article shows that ATT&CK itself remains active, but its surrounding ecosystem is less stable. That means organisations can no longer assume the public taxonomy layer will remain fast enough or detailed enough for every new cloud, SaaS or AI-driven behaviour. The implication is that internal extension and version control become necessary governance functions, not optional tuning.

CVE continuity illustrates a broader fragility in public cyber infrastructure. A short extension saved the programme, but only temporarily, which exposes how much enterprise operations depend on services that sit outside organisational control. That is a structural dependency risk across the security stack, from vulnerability management to threat modelling. Practitioners need to recognise that the failure mode is not just delayed updates, but loss of predictable reference points.

Identity and detection teams should think in terms of taxonomy resilience. If ATT&CK mappings underpin privilege escalation detection, identity abuse hunting and response playbooks, then the real question is whether those mappings still hold when the public source changes pace or shape. The field needs local governance for external taxonomies, including controlled snapshots, crosswalks and change approval. That is how a programme stays coherent when the reference layer becomes less dependable.

Internal TTP catalogues are becoming the practical control boundary. Once an organisation depends on public ATT&CK and CVE feeds, it needs a local reference layer that can absorb delays, version changes and vendor-specific extensions without breaking reporting. That is the named concept here: taxonomy resilience. It is the ability to preserve analytical continuity when upstream security taxonomies are unstable, and it should now be treated as a core programme design requirement.

What this signals

Taxonomy resilience: defenders now need the same discipline for ATT&CK and CVE that they already apply to code and infrastructure dependencies. Version control, local snapshots and change approval are becoming part of operational security, not just administration.

Public reference models still matter, but the article shows that organisations should plan for a future in which the external layer moves more slowly than attacker behaviour. That makes local extension, governance and cross-mapping the practical answer for detection, vulnerability management and threat modelling.

For practitioners

• Snapshot your ATT&CK dependency Export the ATT&CK version you use, store the STIX or JSON bundles internally, and tie them to detection content, tabletop scenarios and reporting templates so analysts can prove which snapshot underpins each decision.
• Build an internal TTP catalogue Create a governed catalogue that maps local detections, incident patterns and control tests to ATT&CK techniques, while adding internal technique IDs where ATT&CK is too broad or incomplete for your environment.
• Mirror external identifiers and advisories Keep local copies of CVE, CISA KEV and other feeds you depend on, then route them through your own stores so a public service delay does not halt prioritisation or ticketing.
• Assign taxonomy ownership Give threat intelligence, detection engineering, purple team and GRC a shared change process for ATT&CK updates, internal extensions and vendor mappings.

Key takeaways

• CISA funding pressure is exposing how much modern defence programmes depend on public ATT&CK and CVE infrastructure.
• The main risk is not immediate collapse but taxonomy drift, delayed guidance and weaker confidence in coverage reporting.
• Organisations should maintain internal versioned mappings and local control over the reference data their security operations depend on.

Key terms

• Taxonomy Resilience: Taxonomy resilience is the ability of a security programme to keep detections, reporting and threat modelling consistent when an external reference model changes pace or availability. In practice, it means versioning, local snapshots and controlled extensions so the programme does not depend on a live public taxonomy remaining stable.
• Threat-Informed Defense: Threat-informed defense is the practice of shaping controls around known adversary behaviours rather than generic assumptions. It uses intelligence about attack techniques, such as credential access or privilege escalation, to test whether controls can actually interrupt realistic attack paths before impact occurs.
• CVE Dependency: CVE dependency describes operational reliance on the public vulnerability identifier system for scanning, ticketing, prioritisation and remediation workflows. When that dependency is unmanaged, delays or uncertainty in the upstream feed can disrupt internal triage even if the vulnerabilities themselves have not changed.
• Internal Ttp Catalogue: An organisation-owned catalogue of tactics, techniques, and procedures that extends public frameworks with local behaviours seen in the environment. It gives teams a controlled reference for detections, playbooks, and mappings when external taxonomies are too broad or too slow.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.