Shields Up had no end date, so vigilance needed a staffing plan

The week

In the last week of February 2022, the security world and the evening news became the same story. The week did not arrive without warning. For two months, US agencies had been telling organizations that a Russian move against Ukraine could spill into networks far from the front.

On January 11, 2022, CISA, the FBI and the NSA issued a joint advisory on Russian state-sponsored threats to US critical infrastructure. It listed software flaws that Russian actors had exploited to get into networks, and it recommended patching, multifactor authentication and incident response planning. Four days later, Microsoft disclosed WhisperGate, destructive malware found on systems in Ukraine. It was dressed up as ransomware, but paying would not have helped: the data it hit was destroyed. In mid-February, denial-of-service attacks knocked Ukraine’s defense ministry and two of its largest banks, PrivatBank and Oschadbank, offline for a time. On February 18, the White House and the UK government publicly attributed those attacks to Russia’s military intelligence agency, the GRU.

CISA, the federal Cybersecurity and Infrastructure Security Agency, had begun that month to promote its Shields Up guidance. The health sector’s federal coordination center was circulating a notice about it by February 14. The message went to every organization, large and small: prepare for disruptive cyber activity. The guidance was practical. It urged lower thresholds for reporting suspicious activity, so that odd events got flagged rather than shrugged off. It asked organizations to require multifactor authentication for remote access. It asked them to confirm their backups and logging, meaning that copies of important data existed and that systems were keeping records of what happened on them. It called for patching of known exploited vulnerabilities, the software flaws that attackers were already using in the wild. CISA had begun publishing a catalog of those flaws in November 2021, with deadlines that bound federal civilian agencies and served as a priority list for everyone else. And it asked organizations to keep their incident response contacts current, so they knew whom to call if something went wrong.

A separate page addressed corporate leaders and chief executives. It asked senior management to include the chief information security officer in decisions about risk to the company. It said reporting thresholds should sit well below normal levels during the threat period. It asked leaders to expect that signs of malicious activity would be reported to CISA even when security controls had blocked them. It urged executives to take part in exercises of their incident response plans and to focus resources on the systems that supported critical business functions.

Then events accelerated. On February 22, after Russia recognized two breakaway regions of eastern Ukraine, the US Treasury imposed sanctions on two Russian state-owned banks and restricted dealings in new Russian sovereign debt. On February 23, security researchers reported a new piece of destructive malware on systems at organizations in Ukraine. This one, later called HermeticWiper, was also a “wiper”: rather than stealing data or demanding a ransom, it is designed to erase computers so they cannot be used.

On February 24, Russia launched a full-scale invasion of Ukraine. That morning, an attack on Viasat’s KA-SAT satellite network disabled large numbers of customer modems in Ukraine and elsewhere in Europe. The spillover mattered. In Germany, thousands of wind turbines lost the satellite link used to monitor and control them remotely. Cyberattacks aimed at one country did not stay politely inside its borders. The same day, Treasury announced sweeping sanctions on Russia’s largest banks, and allied governments followed with measures of their own.

The criminal world chose sides too. On February 25, the Conti ransomware group posted a statement backing the Russian government and threatening to strike the critical infrastructure of anyone who attacked Russia. It softened the wording within hours. On February 26, CISA and the FBI issued a joint advisory on the destructive malware seen in Ukraine, describing WhisperGate and HermeticWiper and how to spot them. On February 27, someone began leaking Conti’s internal chat logs, giving defenders an unusual view of how a large ransomware operation was run.

The sanctions raised a fresh worry: retaliatory cyber activity against Western targets. Banks, hospitals, utilities and public agencies all had reason to wonder whether they might be next. So every security team in the country was asked to go on heightened alert. What nobody could say was for how long. That missing end date turned a technical request into a question for leaders about people, priorities and stamina.

Few security leaders disagreed with anything in Shields Up. The guidance was sensible, specific and free. The difficulty was its duration. A heightened posture for a long weekend is an inconvenience. A heightened posture with no end date is a change to how a team works, imposed on teams that were already short of staff after Log4Shell and the Omicron surge. (Log4Shell was a serious flaw in a widely used piece of software that had sent security teams scrambling over the December holidays; the Omicron wave of COVID-19 had thinned staffing across almost every workplace.)

The guidance said what to raise. It could not say what to lower in exchange, and that decision fell to each organization’s leaders. Whether the posture held came down to three operational questions: who watches, who decides, and how long it can last.

The sections below start with why a technical request turned into a workload problem. They then take the three questions in turn. They show how the answers combine into a single plan that an executive team can sign, and they close with questions for testing readiness before the next open-ended alert.

More alerts, the same people

A security “posture” is the state of an organization’s defenses at a given moment: what is being watched, how closely, and how quickly people react. Raising it resembles a hospital moving to a higher alert level before a major public event. Nothing dramatic happens at first. More people are on call, more things get double-checked, and the threshold for raising a concern drops.

In cybersecurity, much of that work happens in monitoring. Organizations run tools that watch computers, networks and cloud services. The tools generate “alerts” when something looks unusual: a login from an odd location, a program behaving strangely, a large amount of data leaving the network. Most alerts turn out to be harmless. Someone still has to look at each one and decide. That review is the heart of security operations, and it is labor-intensive.

How a lower threshold multiplies the work

Monitoring tools score events and raise an alert when a score crosses a line. Analysts set those lines through months of tuning, so that the alerts they see are worth their time. Lowering the line, as CISA asked, does not add a fixed amount of work. It pulls in a large population of borderline events that tuning had deliberately left out, and borderline events take longest to judge.

Each alert passes through a chain of steps. An analyst triages it, gathers context from other systems, decides whether it is benign, and either closes it or escalates it. Escalated alerts need a more senior person, sometimes a call to the business owner of the system involved, and a written record. A lower threshold adds load at every step, and the most at the senior end, where staff are scarcest.

Reporting adds its own load. Shields Up asked that malicious activity be reported to CISA even when controls had blocked it. A blocked phishing campaign that once needed only a closed ticket now needed a short write-up, indicators attached and someone to send it. None of those steps is hard. Together they add up over a quarter.

Three ways the work was organized

Many larger organizations run a security operations center, or SOC, a team whose job is to watch alerts around the clock. Others pay a managed detection provider, an outside company that does the watching for them under contract. Smaller organizations often have neither; their general IT staff handle security alongside resetting passwords and fixing printers. Many organizations mix the three, with an internal team by day and a provider overnight.

When CISA asked for lower reporting thresholds and closer monitoring, the practical effect was more alerts, reviewed more carefully, by the same people. Advisories also arrived with lists of indicators and new detection rules to deploy, each of which had to be tested so that it did not flood the queue or break a business system. Every hour spent on that work came out of something else. The guidance could not say what, and that is why the request ended up on leaders’ desks.

Who watches

Heightened monitoring means more alerts, reviewed more carefully, with lower thresholds for suspicion. That work lands on whoever reviews alerts: an internal security operations center, a managed detection provider, or an IT team doing security alongside everything else. Each faced a different version of the problem.

Internal teams: hours, not headcount

Internal teams could not hire their way through a surge. Recruiting and vetting a security analyst takes months, and a new analyst needs more months to learn an organization’s systems. The realistic choices were extended shifts, added on-call coverage, deferred projects and short-term outside help. Each had a cost. Extended shifts raised error rates late in the shift. On-call coverage interrupted sleep and family life. Deferred projects postponed improvements, and outside help needed onboarding, access and supervision before it was useful.

The better-run teams separated the surge into two kinds of work. The first was one-time hardening: patching the listed flaws, confirming multifactor authentication on remote access, checking exposed services, testing a restore. That work could be scheduled, assigned and finished. The second was continuing vigilance: reviewing the extra alerts every day for as long as the posture lasted. Mixing the two hid the fact that the second never ends.

Managed providers: what the contract said

Organizations using a managed provider had to find out what heightened monitoring meant under their contract. The open points were whether the provider would deploy new detections for the advisories’ threats, escalate at a lower threshold, or charge extra. A “detection” here is a rule that tells the monitoring tools what to look for, such as the telltale signs of a specific piece of malware. Many contracts were silent on all of this.

Silence favored the provider. Its service levels typically promised a response time for alerts it judged significant, judged by its own standards. A provider serving hundreds of customers also faced the same surge across all of them at once, with its own finite analysts. Customers who asked early got clear answers and sometimes priority. Customers who assumed their provider was handling it often learned the limits of the service only when they asked for something specific.

The useful questions were narrow. Customers needed to know which of the advisory’s detections the provider had deployed, and on which systems. They needed to know whether it had changed its escalation threshold for them, and how they would be told. And they needed a list of the log sources the provider actually received. Organizations frequently found gaps between the systems they believed were monitored and the ones sending data to the provider.

Small organizations: borrowed judgment

Small agencies, community banks and rural clinics, with no dedicated security staff, often had the least capacity and the least clarity about what to change. Their best option was borrowing judgment from shared bodies. Sector information sharing groups, state cybersecurity offices and CISA’s regional staff published indicators and short guidance through the period. “Indicators” are the fingerprints of an attack, such as suspicious web addresses or file signatures, that others can search for in their own systems.

A community bank or county that subscribed to those feeds, and named one person to act on them daily, got much of the benefit of a threat intelligence team at little cost. The trade-off was dependence on someone else’s prioritization, which suited routine changes better than unusual ones. It also depended on the shared bodies staying funded and staffed, which later proved less certain than it looked in 2022.

Many small organizations rely on a technology vendor or managed service provider for most of their IT. For them, “who watches” often meant whether the IT provider was watching at all, and whether anyone had asked it to watch harder. A two-line email asking the provider to confirm what it had changed was one of the cheapest controls available that spring.

Advisories into task lists

Whatever the model, the way through was to turn advisories into a short list of concrete changes. Examples included specific detections deployed, specific logs confirmed, and named external services checked for exposure, meaning a check that systems reachable from the internet were not left open to attack. A list with owners can be completed and verified. A general instruction to be vigilant cannot.

A good list had four columns: the action, the owner, the date and the evidence that it was done. Evidence meant something another person could check, such as a screenshot of a deployed rule, a restore log or a scan report. The list also had a fifth, often missing element: a note of what the team had chosen not to do and why. A county that decided not to deploy a detection because it lacked the relevant log source had made a defensible choice. One that never noticed had not.

How the watching differed by sector

The question of who watches played out differently by type of organization. Large banks typically had internal operations centers, sector intelligence from the financial services information sharing community, and examiners who would later ask what they had done. Their constraint was rarely tooling. It was the number of experienced analysts who could judge ambiguous alerts.

Health systems often ran lean security teams inside larger IT departments, with clinical systems that could not be patched or rebooted on short notice. Their watching had to account for medical devices and vendor-managed systems the security team could see only partially. Ambulatory networks and physician groups were thinner still, and often depended entirely on an IT services firm.

Federal civilian agencies had a different structure. They were bound by CISA’s directive on known exploited vulnerabilities, with set remediation deadlines, and by federal incident reporting rules. Their watching was more prescribed and more visible. Counties, cities and school districts had the widest range, from well-staffed state-supported teams to towns where one administrator covered everything.

Who decides

A lower reporting threshold sends more events upward. CISA asked organizations to report anomalous activity promptly, which requires criteria for what is reported, who decides and who makes the report. A heightened posture also raises the odds of a decision that cannot wait, such as disconnecting a partner connection, isolating a network segment or shutting down an exposed service.

Disruptive actions and their owners

Each disruptive action protects the organization and also disrupts it. Cutting off a partner connection might stop an attack spreading from a supplier, but it might also halt payments, deliveries or patient referrals. Isolating a network segment might contain malware but take a clinic’s scheduling system offline. Shutting down a public-facing service might close an exposed flaw but stop residents paying a bill or filing a form.

Those consequences belong to the business, not to the security team. That is why the authority to act cannot be improvised at 2 a.m. The organizations that coped well wrote a short table in advance. One column listed actions the on-call security lead could take alone, such as blocking a known malicious address or disabling a compromised account. A second listed actions that needed a named business owner, such as cutting a supplier link. A third listed actions reserved for an executive, such as taking a revenue or clinical system offline.

The table answered the most common failure in incident response: the first hours spent finding someone willing to decide. It also protected the people making the call. An analyst who isolates a system under a pre-agreed rule is following policy. One who does it on instinct, and is wrong, carries the blame alone, and learns to hesitate next time.

When the business-hours path fails

Escalation paths that work during business hours often fail at 2 a.m. on a Sunday. During a sustained posture, that gap matters more than usual. On-call rotations need to include someone with authority to take disruptive action, as well as someone who can describe the problem. Contact lists for executives, vendors, insurers, outside counsel and authorities need to be current, and many organizations found theirs were not.

Contact lists decay in predictable ways. People change roles, vendors reorganize their support lines, insurers change their breach hotlines and personal mobile numbers go stale. A quarterly test, in which someone calls each number and records who answered, catches most of the decay. Copies need to exist offline, because the systems that hold them may be the ones under attack.

Consider a county that runs its systems with a four-person IT team and a hosting company for its website and payment portal. At 1 a.m. one Saturday, the county’s monitoring tool flags unusual activity on a server that connects to the state’s benefits system. The on-call technician sees it, but is not sure whether she may disconnect the link, because doing so would interrupt a nightly data transfer the state depends on. The IT director’s phone goes to voicemail. The hosting company’s emergency number reaches a general help desk.

By the time someone with authority is found, it is 6 a.m. The activity turns out to be harmless, but the county has learned that, had it been real, five hours would have been lost to finding a decision-maker. A written list of pre-approved actions, and a tested contact sheet, closes that gap for the cost of an afternoon’s work.

Reporting decisions and regulatory clocks

Lower thresholds also meant more decisions about whether to report, and to whom. Reporting to CISA was voluntary for most private organizations in February 2022. Other obligations were not, and they differed by type of organization.

Banks were weeks away from a new federal rule. The banking agencies had finalized a computer-security incident notification rule in November 2021, with compliance required from May 1, 2022. It required banking organizations to notify their primary federal regulator within 36 hours of determining that a qualifying incident had occurred. A bank on heightened alert was therefore also building the decision process that rule required. Banks and insurers licensed in New York already had a 72-hour notice requirement under the state’s cybersecurity regulation.

Health care covered entities had HIPAA’s breach notification rule, with its own tests and timelines, and often state breach laws on top. Federal civilian agencies had to report incidents to CISA quickly under federal reporting guidelines. Each of those obligations depends on someone deciding, with incomplete facts, whether a threshold has been crossed. Organizations should check with counsel which apply to them. The operational point holds across all of them: the person who decides must be reachable, informed and named in advance.

Vendors who must act on your behalf

Decision rights also extend to vendors. Managed service providers and hosting companies may need to act on the organization’s behalf. Contracts that require their approval for emergency changes, or that leave the customer unable to reach a decision-maker at the provider, slow the response.

The fix runs both ways. The customer authorizes named provider staff to take defined emergency actions without waiting, and the provider gives the customer an escalation path that reaches someone with authority. Both commitments belong in the contract or a signed annex, not in a sales conversation. Organizations that had negotiated those terms before February 2022 found the period far easier than those negotiating them during it.

How long it can last

A team can run hot for a few weeks. Over months, attention fades, errors rise and people leave. Security staff were already scarce in early 2022, and burnout was a real risk. A heightened posture that relied on goodwill would erode without anyone deciding to lower it.

From temporary measures to normal operations

Sustaining it meant turning temporary measures into normal operations. New detections could be added to standard monitoring rules instead of being handled by manual review. Lower reporting thresholds could be written into procedures. Extra on-call coverage could be rotated fairly and paired with protected time off.

Automation helped where the work was repetitive. Enriching an alert with context, such as who owns the device, what the user normally does and whether the address appears in threat feeds, can be scripted. So can routine containment, such as disabling an account after confirmed credential theft. Each piece of automation needs testing and an owner, and badly built automation can take a business process offline at machine speed. Done carefully, it moves analysts’ time from gathering facts to judging them.

What stops

Most important, leaders had to say what the team should stop doing. Project work that added resilience moved up. Lower-value work, such as cosmetic tool migrations, discretionary reporting and some audits, could wait. A posture that only adds tasks is a posture that will fail.

Pausing work is harder than it sounds, because every paused item has a sponsor. A business unit waiting for a new integration, an auditor expecting evidence on schedule, a project manager whose milestones slip: each will push back. The decision therefore has to come from someone senior enough to absorb that pushback, and it has to be announced, with a review date. Pausing nothing in public means everything continues in private, a little worse.

Some work cannot pause. Regulatory deadlines, audit commitments with external parties and contractual deliverables carry their own consequences. The honest list distinguishes work that is genuinely deferrable from work that only feels optional to the security team.

Rotation and depth

Rotation needs the same care. Concentrating heightened duties on the two or three most experienced analysts feels efficient, because they work fastest. It is also the quickest route to losing them. Pairing senior staff with junior ones on each shift spreads the load and builds depth for the next period of alert.

Depth also means documentation. A detection that only one analyst understands, or a response step that lives in one person’s head, fails the week that person is on leave. Short written runbooks for the advisories’ main threats let a less experienced analyst act with confidence and let senior staff sleep.

Measuring whether it holds

Measurement shows whether the posture is holding. A handful of weekly indicators is enough: median alert review time, number of escalations, completion of patches for known exploited vulnerabilities, backup test results and on-call hours per person. Leaders who watched those numbers could adjust staffing before fatigue turned into missed alerts. Those who relied on general reassurance from busy teams had little warning. Busy, loyal people tend to say “we’re fine” right up to the point where they are not.

The numbers need a baseline to mean anything. A median review time of 40 minutes is good or bad only against the normal figure. Teams that had never measured their routine performance had to guess whether a heightened posture was slowing them down. Capturing a few weeks of routine figures in a calm period is a cheap form of preparation.

The cost of staying alert

Heightened posture is rarely presented as a budget item, but it is one. Extra on-call coverage often means overtime or allowances. Asking a managed provider to do more may trigger additional fees. Bringing in outside help, such as an incident response firm on standby, has a price. The projects that pause carry a cost of their own, in delayed improvements and frustrated stakeholders.

Leaders tend to underestimate these costs because they arrive in small pieces across different budgets. A useful discipline is to add them up for a typical month of heightened alert and compare the total with what the organization would expect to lose from a day of serious disruption. That comparison usually makes the case for preparation clearly. It also gives finance teams a figure to plan around the next time an advisory lands, rather than an open-ended request for “whatever it takes.”

Insurance belongs in the same conversation. Cyber policies already asked applicants about controls such as multifactor authentication and backups. State-backed attacks raised a separate question about war and state-action exclusions, which Lloyd’s later required its market to address explicitly in cyber policies from March 2023. An organization counting on insurance to cover a retaliatory attack needed to read its policy with counsel and its broker, not assume.

Stepping down on purpose

Most organizations planned how to raise their posture. Few planned how to lower it. Without criteria for stepping down, measures either lingered long after they stopped earning their cost or faded unnoticed when people got tired. Both outcomes are worse than a deliberate decision.

A workable approach sorts each measure into one of three groups at every review. Some measures should become permanent, such as the new detections, the tested contact sheet and the faster patching of listed flaws. Some can be suspended with a trigger for reinstating them, such as the extra overnight analyst, who returns if CISA or a sector body issues a new warning. Some can simply end, such as manual review of a feed that automation now handles. Recording which group each measure falls into, and who decided, turns a fading posture into a managed one.

The triggers matter as much as the measures. A sensible trigger is specific: a new joint advisory naming the organization’s sector, a credible report of attacks on a peer, or an incident at a key supplier. Vague triggers, such as rising tension in the news, keep the organization permanently on edge. Specific ones let the team rest when rest is justified.

Stamina in public bodies and small institutions

Duration bites hardest where budgets are fixed by appropriation or a small balance sheet. A county cannot authorize open-ended overtime without a budget amendment. A credit union with a two-person IT team cannot rotate on-call cover without someone working every other weekend. For these organizations, lasting meant leaning harder on shared services and providers, and making a smaller list of changes that could be sustained.

Larger institutions had the opposite risk. They could afford to sustain a posture by spending, and sometimes did so without asking whether the spending still matched the threat. A heightened posture with no review date tends to become permanent by inertia. Setting a monthly review, with the explicit option to step down some measures, kept spending tied to evidence.

Turning the three answers into one plan

The three questions fit together in a single plan. Take a regional health system with three hospitals, a dozen clinics and a security team of six. When Shields Up arrives, its chief information security officer has a choice. She can forward the guidance to her team with a note asking everyone to be extra careful, or she can turn it into a plan the executive team signs off.

Page one: the watching

She chooses the plan, and it fits on two pages. The first page covers the watching. It lists the specific changes the team will make in the next fortnight. They include new detections for the malware described in the CISA and FBI advisory and confirmation that logs from the most important systems are being kept. They also include a check of every service reachable from the internet, a test restore from backups, and patches for the flaws on CISA’s list. Each item has a name next to it and a target date. The list also notes that the health system’s managed provider covers overnight monitoring, and that the provider has been asked in writing what it will do differently during the alert period.

Page two: deciding and lasting

The second page covers deciding and lasting. It names who is on call each week and confirms that each rotation includes someone allowed to isolate a clinic network or cut off a supplier connection without waiting for approval. It lists the actions that still need the chief operating officer, because they would affect patient care, and gives the out-of-hours number to reach her. It sets out the work that pauses for the next quarter: a planned migration of the team’s ticketing tool, two discretionary internal reports and a non-urgent audit. Finally, it lists five numbers the executive team will see every Monday, and the date of the first review.

The plan needs no new technology. What it requires is a leader willing to say, in front of colleagues, that some things will not get done so that the important ones can. The executive team’s role is to back that choice when the business units whose projects slipped come asking why.

How the plan changes by organization

The same two pages look different elsewhere. At a regional bank, page two would name who can suspend a payment channel or a correspondent connection, and who decides whether an event triggers the 36-hour regulator notice. The paused work might include a digital banking feature release. At a county, page two would name who can take the tax payment portal offline and who tells the elected board. The list of shared services the county relies on would sit on page one, with the person who reads them each day.

At a broker-dealer, the hardest decisions involve trading and client access during market hours, so authority would be split between the security lead and the head of operations. An ambulatory network that outsources most IT would write both pages mostly about the provider: what it has changed, who at the provider can act, and how the network reaches that person on a Sunday.

The case against a formal plan

A reasonable objection is that all this is overhead. Many teams responded to Shields Up by working harder for a few weeks, and nothing bad happened to them. Writing plans, renegotiating contracts and tracking metrics takes time from the watching itself. A small team might fairly argue that its scarce hours were better spent patching.

The objection has force for the one-time hardening work, which needs doing rather than documenting. It fails on duration. Nobody in February 2022 knew whether the alert would last weeks or years, and it lasted years. Working harder is a plan for weeks. The two-page plan is a plan for an unknown period, and its cost is a few days of senior time against months of strain.

A second objection is that pausing work signals panic to the business. The response is framing. Pausing a ticketing migration to focus on patching is a normal prioritization decision, the kind made every quarter. Announcing it calmly, with a review date, signals control rather than alarm.

Habits of the organizations that held up

Organizations that handled the period well tended to share some habits:

• Advisories became task lists. Each piece of guidance was translated into a handful of specific actions with an owner, a date and evidence of completion.
• Contracts were clarified. Managed providers were asked, in writing, what heightened monitoring included, which logs they received and what it would cost.
• Authority was on call. Every rotation included someone able to approve disruptive action, backed by a written table of what they could do alone.
• Something was paused. Leaders named the projects and reports that would wait, said so publicly to the business and set a review date.
• Load was shared. Senior and junior staff were paired, runbooks were written and time off was protected rather than postponed indefinitely.
• A few numbers were watched. Weekly indicators, measured against a routine baseline, gave early warning of strain.

The failures were just as consistent. Leaders forwarded advisories with a note saying “please action” and assumed the work was done. Contracts with managed providers were not checked until something went wrong. Contact lists were years out of date. The most capable analysts carried the load until they left. Nobody said what could stop, so everything continued, a little worse than before.

Evidence for examiners, auditors and insurers

There is also an accountability dimension. When CISA and the FBI publish an advisory, it becomes much harder for any organization to say afterward that it did not know about a threat. Regulators, auditors and insurers can reasonably ask what was done in response. A short, dated list of changes made, with owners, is far easier to show than a general claim that everyone was being careful.

Bank examiners, for example, review how management responds to known threats as part of information security examinations. Health systems face questions from auditors and, after an incident, from HHS investigators about whether known risks were addressed. Public agencies answer to inspectors general, legislative auditors and elected boards. The same evidence file serves all of them, and it costs little to keep if it is built while the work is done.

Readiness for the next open-ended alert

• When the last major advisory came out, what specific changes did we make, who owned each one, and how do we know they were completed?
• If we use a managed security provider, what does our contract say about heightened alert periods, and who confirmed it in writing?
• Who is on call this weekend, and can that person disconnect a partner or shut down a service without waking an executive?
• What work did we pause the last time we asked the security team to do more, and who announced it?
• How many on-call hours did each person on the team work last month, and could they sustain that for another six months?

With hindsight

The large-scale retaliatory attacks on US organizations that many feared in February 2022 did not come. Destructive attacks stayed concentrated on Ukraine. On March 21, 2022, President Biden warned that, based on evolving intelligence, the Russian government was exploring options for potential cyberattacks, and urged companies to harden their defenses immediately. Officials said at the time that they had no intelligence of a specific planned attack, only an increase in preparatory activity such as scanning. The warning extended the alert rather than ending it.

Inside Ukraine, the pressure continued. In April 2022, Ukrainian responders and researchers reported that they had stopped an attempt to disrupt part of the country’s electrical grid with a new version of the Industroyer malware. On May 10, 2022, the European Union, the United Kingdom and the United States attributed the KA-SAT satellite attack to Russia. The spillover that had cut remote access to German wind turbines was officially recognized as part of a state operation.

Western organizations faced hacktivist denial-of-service campaigns (politically motivated groups flooding websites with traffic to knock them offline), continuing criminal ransomware, and persistent espionage. In late January 2023, the pro-Russian group Killnet claimed denial-of-service attacks on the websites of a number of US hospitals. The health sector’s federal coordination center warned about the group. It also noted that such attacks typically cause outages of hours or days rather than lasting damage. The threats were familiar rather than new, and they did not go away.

The Conti group did not survive its choice of sides for long. Its leaked chats and source code circulated widely, and by mid-2022 the operation had broken up, with members moving to other groups. Ransomware overall did not decline because one brand disappeared. The leak gave defenders insight, not relief.

On March 15, 2022, the Cyber Incident Reporting for Critical Infrastructure Act became law as part of a broader spending bill. It directed CISA to write rules requiring covered critical infrastructure entities to report significant incidents within 72 hours and ransom payments within 24 hours. The rulemaking proved slow. The final rule slipped past its statutory target of October 2025, and was still being worked through in 2026. Organizations that built clear internal decision rights in 2022 found it easier to plan for whatever reporting rule eventually arrived.

CISA kept its Shields Up guidance online for years and later folded it into standing guidance on nation-state threats. In effect, the heightened posture became the normal one. What was framed as a temporary emergency turned into a permanent baseline, which is exactly why the staffing and sustainability questions mattered so much.

Later flashpoints confirmed the pattern. After the conflict in the Middle East began in October 2023, Iranian government-affiliated actors operating as “CyberAv3ngers” tampered with internet-exposed industrial controllers at US water utilities, including one in Aliquippa, Pennsylvania. A joint advisory that December traced the compromises largely to devices left reachable from the internet with default passwords: basic hygiene, not exotic tradecraft. In February 2024, US agencies warned that Chinese state-sponsored actors known as Volt Typhoon had positioned themselves inside the networks of US critical infrastructure, apparently to enable disruption in a future crisis. That changed the frame. The threat was no longer tied to a single conflict with a start date.

In June 2025, after US strikes on Iranian nuclear sites, the Department of Homeland Security warned publicly of a heightened threat environment. The bulletin flagged likely low-level cyberattacks by pro-Iranian hacktivists and Iranian government-affiliated actors. In April 2026, US agencies issued another joint advisory on Iranian-affiliated actors exploiting internet-exposed industrial controllers across US critical infrastructure. Each round asked organizations, again, to watch more closely without saying for how long.

The outside support of 2022 also proved less fixed than it seemed. During 2025, CISA lost roughly a third of its workforce through layoffs, buyouts and departures, according to congressional testimony and press reporting. Organizations that had planned to borrow judgment from federal partners had reason to check what they could still count on.

The strain on security teams was real, and industry surveys in following years repeatedly reported high stress and turnover, though their methods varied. Security capacity is a human resource before it is a technical one. Tools generate alerts; people have to read them. A team that is permanently stretched will eventually miss something, and it will rarely be obvious in advance which alert that turns out to be.

By this point in 2026, the better-run security operations treat such periods as recurring events with prepared playbooks: a standard list of changes, defined decision rights and an explicit list of work that pauses. The capacity question that Shields Up raised now gets answered in advance. The next alert will come. Deciding today who watches, who decides and what stops is far cheaper than deciding it at 2 a.m. on the night it arrives.