Reading the Signals: What a New Congress Means for Cyber, AI and Critical Infrastructure

Reading the signals: What a new Congress means for cyber, AI and critical infrastructure

With Election Day on November 3, a new Congress will soon shape the funding, rules and AI policies that critical infrastructure depends on. Here are five signals to watch, what they mean for your sector and where the market is headed.

On November 3, voters will choose the next Congress. Elections are usually measured in seats won and lost. For the companies that keep power flowing, networks running and payments moving, an equally important question is what the results will mean for the policies, resources and security priorities that shape how they operate.

That question carries more weight than it used to. Foreign adversaries now treat energy grids, telecommunications networks, financial systems, transportation corridors and hospitals as strategic targets. The line between economic security and national security has blurred, and so has the distance between a confrontation overseas and a cyber incident at an American company. Artificial intelligence is speeding up all of it, and Washington is moving quickly to set the rules.

The new Congress will shape how Washington responds through appropriations, legislation and oversight, and the outgoing Congress still has major decisions to make before it leaves. Election results will set the stage, and the signals that follow will matter just as much: what lawmakers fund, what they investigate and which compromises gain traction.

My argument is simple: national cyber defense and private-sector resilience are not separate goals. They depend on each other, and reading Washington's signals well is now part of managing enterprise risk.

The geopolitical landscape is fueling cyber conflict

The 2026 Annual Threat Assessment names China, Russia, Iran, North Korea and ransomware groups as continuing threats to U.S. networks and critical infrastructure. Two need attention right now.

Iran: A live conflict with a cyber front

• Where it stands: The United States has been at war with Iran since February 28. Ceasefires in April and June broke down. A U.S. naval blockade and attacks on shipping continue in the Strait of Hormuz, and talks continue through intermediaries.
• The timing: The President has said U.S. strikes will wait until after the November 3 election. He has framed the choice after that as "do I make a deal with them, or do I finish them off?"
• The cyber front: Iranian-affiliated actors have disrupted internet-facing controllers at U.S. water, energy and municipal sites, a warning federal agencies expanded in July. An Iran-linked group claimed the March attack that disrupted Stryker's global network.
• The risk: Escalation raises the odds of retaliation against U.S. infrastructure. A deal would not necessarily stop proxies and hacktivists, who go after whatever is easiest to reach.

What it means for operators: Treat the weeks after November 3 as a period of elevated risk. Take PLCs and operator interfaces off the public internet, change default credentials, check controller project files for unauthorized changes and rehearse manual operations.

China: Access before a crisis

• Pre-positioning: The assessment says China and Russia continue "pre-positioning efforts" for cyberattacks, and that U.S. intervention over Taiwan would probably bring significant but recoverable disruptions to U.S. transportation.
• Volt Typhoon: Chinese state-sponsored actors gained access to communications, energy, transportation and water systems to prepare for disruptive attacks in a crisis.
• Salt Typhoon: The campaign has targeted more than 600 organizations in 80 countries, including major telecom providers, according to the FBI.

Russia, North Korea and the race for AI

• Russia: Its asymmetric cyber capabilities create risks well beyond Ukraine.
• North Korea: It continues to use cyber operations for espionage and revenue.
• AI: The assessment names AI a critical emerging technology. "The risk of not being first is high," says Director of National Intelligence Jay Clayton, who chairs the White House AI task force. Expect AI capabilities, and the rules that govern them, to keep shifting.

Five signals to watch

Election night will tell us who holds power in Washington. What comes next will show how that power is used. Five signals will reveal where cyber and AI policy is headed and what it will demand of the organizations that keep essential services running: what Washington funds, whether its rules become more coherent, how it polices supply chains, how it governs AI and whether resilience becomes the measure of success.

Signal 1: What Washington is prepared to fund and deliver

Strategies and executive orders state priorities. Budgets and institutional capacity show whether those priorities can actually be delivered.

Most U.S. critical infrastructure is privately owned. Still, federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Energy (DOE), identify nation-state threats, coordinate responses and provide technical help that individual companies often can't replicate.

That capacity has been thin for some time. In a 2024 report, the Government Accountability Office (GAO) found that CISA's operational technology (OT) threat-hunting and incident-response service had four federal employees and five contractors. CISA officials told GAO that it was not enough to respond to significant attacks on OT systems in multiple locations at the same time. GAO's recommendation that CISA define its OT workforce needs and close the gaps remains open.

Budget decisions are the next signal. The administration's fiscal year 2027 request proposes about $2.49 billion for CISA. It includes roughly $707 million in program reductions (a net decrease of more than $385 million after transfers) and about 867 fewer positions. Congress has not finished FY2027 Homeland Security appropriations, and the department is running on a continuing resolution that expires December 11. The outgoing Congress will need to extend it or pass full-year funding in its lame-duck session, and the new Congress will inherit whatever remains unresolved.

The same stopgap carries a short-term extension of the Cybersecurity Information Sharing Act of 2015, the law that gives companies legal protections when they share cyber threat information with the government and with each other. That extension also runs out on December 11, and industry groups continue to press for a long-term reauthorization.

Total dollars tell only part of the story. The more useful question for Congress is whether federal investment matches the capabilities the threat demands. A company can be legally required to report an incident without ever receiving intelligence that helps it prevent the next one.

What it means for operators: Watch the December 11 deadline closely, and follow where federal dollars go and what capabilities they're expected to deliver. Don't build incident plans that assume federal help will arrive quickly during an event affecting several sectors at once.

Signal 2: Whether cyber and AI rules become more coherent

In July 2026, GAO identified 117 cybersecurity regulations issued by 37 federal agencies across nine critical infrastructure sectors. Eighty of them had the same kind of reporting requirement as another regulation, a pattern GAO warned may lead to duplication.

That burden lands at the worst possible moment. During an incident, the same technical and legal teams working on containment and recovery may have to satisfy several reporting processes at once, each with its own thresholds, definitions and deadlines. Consider a publicly traded bank holding company dealing with a serious cyber incident:

One incident, several clocks

State laws and other sector-specific rules can add more.

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) is nearing its next milestone: CISA sent its final rule to the White House for review on October 1, and its definition of who is covered will matter a great deal. The administration's Cyber Strategy for America commits to streamlining cyber regulations. Done well, that would cut duplication while preserving the information agencies need to spot threats that cross sectors.

AI adds a new layer. The White House's National Policy Framework for AI, released in March 2026, asks Congress to set a single national standard that would preempt state AI laws that impose "undue burdens." Congress has so far declined to enact broad preemption, and state AI laws remain in effect. Meanwhile, the new White House AI task force is developing protocols for AI labs to report breaches, hacks and other incidents. Each of these could become one more reporting stream, or a chance to build coherence in from the start.

What it means for operators: Map every reporting obligation now (who gets notified, what they need and how fast), including any that touch your AI systems and vendors, so your incident team isn't building that map in the middle of a crisis. Watch CIRCIA's final scope and any national AI standard that emerges.

Signal 3: Supply chains are becoming national security policy

Supply-chain security now reaches the equipment installed across American infrastructure. On August 26, the President signed Executive Order 14421, declaring a national emergency over security threats tied to foreign-produced equipment in the U.S. bulk-power system. The order allows the Secretary of Energy to prohibit certain acquisitions, imports, transfers or installations of that equipment when there is a link to a covered foreign entity and an undue or unacceptable national security risk. It also allows DOE, working with other agencies, to require isolation, monitoring or removal of foreign equipment already in place. DOE's request for industry input closed October 9, the first step toward a rulemaking.

Congress doesn't administer these authorities directly, but its oversight, funding and legislation will influence where supply-chain policy goes next. AI widens the question further: the models, cloud platforms and chips behind AI-enabled tools carry their own geopolitical exposure.

For operators, the challenge is timing. Grid equipment can stay in service for decades, while technology restrictions and geopolitical relationships can shift in months. A meaningful supply-chain review now has to answer four questions:

• Who can administer this technology remotely?
• Who controls its firmware and software updates?
• Which outside systems, including AI services, does it depend on?
• What happens if the supplier loses access, is compromised or becomes restricted?

What it means for operators: Assess geopolitical exposure before procurement decisions become expensive to reverse. Meeting today's requirements is only part of the test. The rest is whether you can keep operating securely if a supplier becomes unavailable, compromised or restricted.

Signal 4: AI policy is being written in real time

AI is already changing how organizations monitor networks, spot anomalies and automate security operations. It's also moving into the systems that run physical infrastructure. Federal AI policy is moving almost as fast.

The administration's approach has emphasized speed and a single national framework, from its July 2025 AI Action Plan to its March 2026 call for a national AI standard. The past three weeks have added three major developments:

• An industry accord. On September 29, six companies (all frontier labs and hyperscalers) signed the voluntary White House Accord on Super Intelligence, committing to monitor models for cybersecurity, biosecurity and chemical risks, audit those controls internally and externally and give independent board committees oversight. The same day, an executive order directed agencies to use the term "super intelligence" for AI.
• A new task force. On October 4, the President announced the Super Intelligence Force, chaired by Director of National Intelligence Jay Clayton as the White House AI czar, with FTC Chair Andrew Ferguson, Under Secretary of Defense for Research and Engineering Emil Michael and OPM Director Scott Kupor.
• A 120-day agenda. At its first meeting on October 15, the task force adopted its charter, commissioned a report from the President's science advisers on AI risk (including to cybersecurity and critical infrastructure), began building a way for AI labs to report breaches and hacks and named a critical infrastructure lead.

For critical infrastructure, the signal is direct: AI risk to essential services is now on the federal agenda, and operators should expect questions about how they use AI. Much of today's approach is voluntary. The new Congress will help decide how much stays that way. It could take up a national AI standard, codify parts of the accord, add AI provisions to defense legislation or use oversight to shape the task force's work.

Whatever Washington decides, operators face two challenges: securing AI systems themselves, from data and models to identities and interfaces, and managing what happens when AI is built into systems where reliability and safety are essential. In an industrial plant, a wrongly trusted recommendation can damage equipment, interrupt service or put people at risk.

CISA and international partners have already published principles for securely integrating AI into operational technology. Organizations need to separate AI that supports human analysis from AI that's allowed to influence or execute operational decisions. They also need clear expectations for model validation, access control, adversarial testing, human oversight and recovery when AI-enabled processes fail.

What it means for operators: Separate broad AI policy debates from the requirements that will actually reach your security tools, industrial systems and procurement. Ask your AI vendors how they're responding to the accord and the task force. Know which AI systems can act on their own, and how you'd recover if one fails.

Signal 5: Whether resilience becomes the measure of success

Traditional cyber programs focus on finding vulnerabilities, deploying patches and detecting intruders. Those capabilities remain necessary, but they aren't sufficient, especially in OT environments where maintenance windows are short, vendors are specialized and processes can't stop without physical consequences. Faster patching alone isn't a resilience strategy. Compliance works the same way: it sets a baseline of accountability, but a company can meet every reporting deadline and still be unable to restore a compromised operational environment.

Resilience starts with knowing what happens when prevention fails, and what you depend on. Utilities rely on communications networks, hospitals on power and connectivity, and banks on telecommunications, cloud and payment systems. Redundancy can mislead, too: two telecom circuits may share the same underlying infrastructure, and separate applications may rely on one identity provider. Having a backup doesn't guarantee it's independent.

What it means for operators: Measure readiness by outcomes: keeping minimum essential services running, how long it takes to restore critical functions, the integrity of recovery environments and how well teams coordinate during a disruption. Prove it through design, exercises and tested recovery procedures, not documentation alone.

What it means for your sector, and for the market

These signals land differently depending on where you sit. For operators, they shape risk and investment. For technology companies, there are market signals: each one creates new demand and new expectations for proof.

By sector

Where policy is creating demand

Technology companies also have a voice. DOE's rulemaking is likely to create more openings for industry input, and the AI task force has said it will engage industry and critical infrastructure providers.

Who in your organization should watch what

Cyber and AI policy no longer belongs to the security team alone. Here is what each leader should track, and the question to bring to the next leadership meeting.

What to watch next

My predictions. Whatever the outcome, I expect three things:

1. Another short-term fix for information sharing. The Cybersecurity Information Sharing Act has run on temporary extensions since it briefly lapsed in 2025. Expect at least one more before a long-term deal.
2. AI incident reporting becomes the next harmonization fight. With the task force designing lab reporting protocols, CIRCIA nearing final and states writing their own AI rules, overlapping AI reporting is a real risk.
3. Rules will move faster than laws. Even if new legislation becomes possible, the changes operators feel first are likeliest to come from agency rules and the AI task force.

Coming up

The policy may change. The operational responsibility doesn't.

A new Congress can reset legislative priorities, shift federal resources and redefine oversight. It can't change the operational reality facing the companies that keep essential services running: capable adversaries, fast-moving AI, complex supply chains, aging technology and tightly connected systems.

Most of the infrastructure an adversary would target in a major confrontation is owned and operated outside government. Federal agencies must be equipped to identify threats, coordinate responses and support industry. Companies must be ready to turn that intelligence into technical defenses, sound investments and tested recovery.

That should shape how Congress evaluates cyber and AI investment, and how industry reads changes in federal priorities. Reducing a federal capability doesn't remove the threat it was built to address. Expanding a federal program doesn't automatically make infrastructure more resilient. The real test is whether public and private investment, together, produce measurable gains in the nation's ability to withstand disruption.

For executives, Washington's direction is an important risk signal, but never a substitute for their own operational judgment.

In the end, national cyber policy won't be measured by the number of bills introduced, hearings held or warnings issued. It will be measured by whether the institutions and infrastructure Americans depend on are better prepared to withstand disruption and recover when defenses fail.

About the author: Madison Horn is Chief Advisor, National Security & Critical Infrastructure at World Wide Technology. A cybersecurity executive and national security strategist based in Washington, D.C., she helps organizations turn national security policy into operational decisions.