CISA has shed more than 1,000 staff—roughly a third of its workforce—since President Donald Trump returned to the White House, leaving the agency smaller and more fragile as the White House nominates Michael LoSapio to run it.
Who Michael LoSapio is
President Donald Trump has nominated Palantir security chief Michael LoSapio to lead the Cybersecurity and Infrastructure Security Agency (CISA). LoSapio has served as Palantir's chief information security officer (CISO) since September 2024, after previously leading the company's infrastructure and network security team. He first joined Palantir in 2013, spent time at database company SingleStore, and returned to Palantir in 2017. If confirmed, LoSapio would move from securing Palantir's systems to leading the federal government's main civilian cyber defense agency.
CISA's operational picture: diminished staff, shifting priorities
The nomination arrives as CISA attempts to steady itself after a prolonged period without a Senate-confirmed director. The agency has been led by acting director Nick Andersen since February and has gone nearly two years without a permanent boss following Jen Easterly's departure in January 2025. During that span, CISA has lost more than 1,000 employees—about one-third of its workforce—and is still trying to fill critical gaps. Andersen said in September that around 250 would-be recruits were waiting for security clearance before they could begin work.
With fewer people on hand, CISA has been rethinking where to concentrate its efforts. A strategy published last month prioritizes infrastructure "whose failure would do the most damage," an approach that implicitly raises questions about which systems and risks will receive less attention as the agency operates with a smaller staff.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePalantir's government role and controversies in the U.S. and U.K.
LoSapio comes from Palantir, the data analytics company co‑founded by billionaire Peter Thiel that has become a major supplier to U.S. government agencies including the Department of Homeland Security and Immigration and Customs Enforcement. Palantir's work with immigration authorities has drawn criticism from civil liberties groups and Democratic lawmakers concerned about surveillance and the handling of sensitive personal information.
The controversy extends beyond the United States. WhatsApp messages obtained by campaign group Foxglove in the U.K. indicate Palantir privately lobbied a health minister to consider extending its software into GP patient records, despite that data being expressly excluded from Palantir's £330 million NHS England contract for the Federated Data Platform. That disclosure came amid reporting that NHS England wants greater oversight of Palantir's claims about the benefits of its software, citing questions over the evidence supporting the company's performance figures.
Confirmation path and political obstacles
LoSapio is the second nominee President Trump has put forward for the job. The administration's previous pick, Sean Plankey, withdrew in April after more than a year awaiting confirmation; his nomination became caught up in a dispute involving Republican Senator Rick Scott over Coast Guard contracting. The current nomination arrives late in the congressional calendar. If the Senate does not confirm LoSapio before the current Congress ends, the president would have to nominate him again for consideration by the incoming Democratic-controlled Senate.
Several items are likely to surface during any confirmation process: whether LoSapio plans to leave Palantir, the disposition of any financial interests he holds in the company, and scrutiny of Palantir's government business given the company's high-profile contracts and controversies described above. Those questions will shape hearings at a moment when CISA can ill afford a prolonged leadership vacancy.
How technologists, policymakers, and critical infrastructure operators are likely to respond
- Technologists and security teams: Expect scrutiny on how a CISO from a major government contractor would translate product- and customer-focused security experience into federal defensive strategy, particularly as CISA redirects limited staff toward the most damaging infrastructure failures.
- Policymakers and confirmation committees: Senators will likely probe Palantir's record—its contracts with DHS and ICE and recent U.K. dealings—and seek clarity on LoSapio's financial and employment ties before a vote, repeating friction that stalled the previous nominee.
- Critical infrastructure operators (power, water, telecommunications): Operators will watch whether a confirmed director alters CISA priorities or engagement rhythms at a time when the agency has reduced capacity and is prioritizing the infrastructure sectors deemed most consequential.
The nomination is a test run for both a candidate from a contentious government supplier and for an agency stretched thin by attrition. Whether Michael LoSapio can persuade lawmakers that he can step from Palantir's security operations into the leadership of America's civilian cyber defense agency—and whether the Senate can reach a timely decision before the congressional session ends—are concrete next steps that will determine how quickly CISA regains stable, confirmed leadership.
