FBI speed pledge puts the exercise burden on industry
A faster FBI warning is only as useful as the recipient's ability to act on it, and that handoff is the part nobody tests.
TL;DR
FedScoop's Kathy Hsu argues that the FBI's new Cyber Strategy (which aims to compress the interval between threat detection and partner notification from days to hours, then minutes) forces an uncomfortable question onto critical infrastructure operators: how fast can they actually act on an incoming warning? Hsu makes the case for joint government-industry exercises built around a single essential service and a single threat scenario, with agreed criteria for what counts as a successful handoff. CISA already offers the Federal Incident Response Evaluation service for federal entities and runs the biennial Cyber Storm exercise series, but neither is designed to test one specific federal-to-operator notification cycle end to end.
The FBI's new Cyber Strategy sets an ambitious tempo: compress threat-to-partner notification from days to hours, hours to minutes. That's a meaningful operational commitment from the bureau. But it shifts the burden onto the recipient, and FedScoop's Kathy Hsu is right to point out that nobody's testing whether critical infrastructure operators can keep up.
Hsu's argument is simple enough that it's surprising it needs making. When an FBI warning lands, someone at the receiving organization has to determine whether the activity is actually present, assess what containment will break, find a mission owner who can authorize the response, and decide what evidence to share back. Each of those steps is a handoff. Each handoff is a potential stall. And the FBI's faster-notification promise means exactly nothing if the operator takes days to act on it.
Her proposed fix is joint exercises, but not the kind CISA already runs. Cyber Storm is biennial, multi-sector, and national in scope, Cyber Storm IX in April 2024 drew over 2,200 participants across federal, state, international, and private-sector organizations. It's invaluable for testing national coordination, but it doesn't drill into one specific handoff path: FBI-to-operator, for one service, under one threat scenario, with a stopwatch on every step.
CISA does offer the Federal Incident Response Evaluation (FIRE), which assesses a federal entity's incident management against a benchmark of leading practices. That's the right impulse (measurable, repeatable, comparable across agencies) but it's scoped to federal entities, not to the cross-boundary handoffs Hsu is talking about.
What Hsu is describing sits in a gap: narrower than Cyber Storm, more operational than FIRE, and bilateral rather than federal-only. A single essential service. A single threat scenario. Agreed criteria for what "successful response" means before testing begins, one team may count an alert as success while another requires investigation and containment. Documented results that record how long each decision took, whether containment stopped the adversary, and whether partners received evidence they could use.
The piece doesn't claim CISA or FBI are formally pushing this. It's an argument, not an agency action. But it's an argument that lands at a useful moment. The FBI has set a speed target. The question of whether industry can meet it is now operational, not theoretical.
Published ·Deep Fathom