Democrats’ sweeping midterm victory will give them control of both chambers of Congress in January, creating a new cybersecurity agenda centered on rebuilding the Cybersecurity and Infrastructure Security Agency, investigating federal cyber cuts and confronting the security risks of artificial intelligence. The party’s gains are expected to produce more aggressive hearings, investigations and legislation during the remaining years of President Donald Trump’s term, according to Associated Press election results and cybersecurity policy analysts cited by Cybersecurity Dive.
Sen. Maggie Hassan, Democrat of New Hampshire, is expected to chair the Senate Homeland Security and Governmental Affairs Committee after Sen. Gary Peters retires. Hassan has identified cybersecurity and AI security as public-safety priorities and said Democrats would seek to reverse what she described as the Trump administration’s dismantling of CISA. Rep. Bennie Thompson, Democrat of Mississippi, is likewise positioned to return as chair of the House Homeland Security Committee, where he has pledged to accelerate CISA’s effort to rebuild its workforce and restore the expertise needed to support critical-infrastructure operators facing increasingly AI-enabled attacks.
CISA’s staffing and operational capacity will be an early test. The agency has lost roughly one-third of its workforce since the Trump administration began downsizing it, while key public-private coordination programs have been ended or reworked. Democrats are expected to examine whether CISA can fulfill both of its core missions: protecting federal civilian networks and helping utilities, state governments and other infrastructure operators defend themselves. They are also likely to scrutinize the agency’s planned cyber-incident reporting regime, including whether its final requirements improve threat visibility without imposing excessive reporting burdens on companies.
Another immediate issue is the Cybersecurity Information Sharing Act, the 2015 law that provides liability protections for companies sharing cyber-threat information with one another and the federal government. The law expired in late 2025 after Congress repeatedly used short-term extensions, and lawmakers may attempt another temporary renewal during the lame-duck session before Democrats take power. A durable reauthorization could still face opposition from Sen. Rand Paul, Republican of Kentucky, who has resisted a long-term extension. If Congress does not act before January, information-sharing protections will become one of the new majority’s first cybersecurity legislative tests.
AI security is likely to compete with CISA restoration for attention. Lawmakers are expected to examine how frontier AI systems are tested, how they enable vulnerability discovery and cyberattacks, and whether federal agencies have adequate safeguards for adopting them. Democrats may also press the administration to give CISA a larger role in AI policy, although the party has not yet unified around a comprehensive AI-security framework. Other potential priorities include reviving the expired State and Local Cybersecurity Grant Program, directing more assistance to under-resourced water systems, reviewing Department of Government Efficiency cuts to federal cyber personnel and examining proposals that would allow private companies to conduct offensive operations against foreign cybercrime groups.
