3 Cybersecurity Policy Shifts 

McConnell continues, “First, information sharing. A durable reauthorization of the Cybersecurity Information Sharing Act of 2015 is the most likely early win. The law’s liability protections give companies the confidence to share threat and vulnerability information voluntarily, and the recent string of short-term extensions erodes that confidence. A multi-year reauthorization, whether it comes in the lame-duck session or early in the new Congress, would restore the predictability that voluntary sharing depends on.

“Second, critical infrastructure. CISA has lost roughly a third of its workforce, has seen programs and partnerships contract, and has faced proposed budget cuts of hundreds of millions of dollars, all while attacks on critical infrastructure have intensified. This summer’s coordinated intrusions into water systems, which began with more than thirty Minnesota utilities in late July and reached at least a dozen states, was a stark reminder: if the intrusions are coordinated, then our defense must be as well. I expect a renewed effort to rebuild federal capacity and to get resources to the state and local operators, beginning with reauthorization and funding for the State and Local Cybersecurity Grant Program.

“Third, supply chain transparency. Concern about foreign technology in U.S. systems is bipartisan, so this is an opportunity for a continuation of current policy trends. So far, we’ve seen a piecemeal approach to supply chain protections: formal rules for connected vehicles, an executive order for the bulk power system, and FCC actions that have created sudden and sharp disruptions for consumer technology companies. The new Congress has an opportunity to streamline and harmonize these requirements across sectors, satisfying the requirement for security and transparency, while giving manufacturers the predictability they need to plan long-term investments in the U.S. market.”

Will This Fundamentally Change Enterprise Challenges? 

Ryan McCurdy, Vice President of Marketing, Liquibase, explains, “The next Congress may bring new priorities for cybersecurity oversight and AI security, but the underlying challenge for enterprises won’t change. As AI agents take on more responsibility for developing and deploying software, organizations need to rethink how they control what those systems are allowed to do. What happens when a system with legitimate access makes a dangerous change? An agent doesn’t need to exploit a vulnerability to drop a production table. It just needs the right permissions.

“There’s growing attention on AI agent identity and authorization, including work underway at NIST. However, access is only part of the problem. Enterprises also need to enforce policies around the changes those systems make, validate them before execution, and maintain evidence of what happened.

“Regardless of where federal policy goes, organizations remain accountable for what reaches production. The same standards should apply whether a change comes from a developer, an automated pipeline, or an AI agent.”