America’s Cyber Shield Breaks As CISA 2015 Expires

The Cybersecurity Information Sharing Act of 2015 (CISA 2015) expired on September 30, 2025, removing the legal liability shield that enabled thousands of private sector organizations to share real-time cyber threat data with the government and each other. The Automated Indicator Sharing (AIS) program it powered processed millions of threat indicators monthly. Without the law’s protection, corporate legal teams halted sharing. The recommended action: build independent encryption and detection controls now, and join private sector threat-sharing communities while awaiting legislative renewal.

Quick Answer: Why Does CISA 2015’s Expiration Matter?

CISA 2015 was the legal foundation for America’s automated cyber threat intelligence network. It gave companies immunity from antitrust, privacy, and liability lawsuits in exchange for sharing cybersecurity threat indicators, including malicious IP addresses, malware signatures, and attack patterns, with the government and each other through the Automated Indicator Sharing (AIS) program. When it expired on September 30, 2025, the liability shield disappeared. Without it, sharing threat data became a legal risk rather than a protected activity, and the flow of intelligence into the collective early-warning system effectively stopped. The result is that thousands of organizations now defend against emerging threats without the real-time collective intelligence that previously let a detection at one bank automatically block an attack at a hospital across the country.

What Was CISA 2015?

Before 2015, companies facing cyberattacks were legally isolated. If a bank detected a novel piece of ransomware, sharing the technical details of that malware with other companies risked antitrust exposure (coordinating with competitors), privacy liability (if the indicator touched customer data), and general legal uncertainty. The rational corporate response was to keep the information internal, which meant the same attacker could strike a hospital next, then a power plant, with no one passing a warning.

The Cybersecurity Information Sharing Act of 2015 removed those barriers. It created an explicit federal liability shield for companies sharing cyber threat indicators (CTIs) and defensive measures with the government and each other, conditioned on automated scrubbing of private information unrelated to the threat. The law empowered the Cybersecurity and Infrastructure Security Agency (CISA) to run the AIS program and gave the entire framework a legal foundation that compliance and legal departments could work within.

The result was the Automated Indicator Sharing (AIS) program: a machine-to-machine network using the STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) standards to exchange threat indicators in near real time, without human intervention, across thousands of participating organizations spanning every critical infrastructure sector.

How the Automated Indicator Sharing Program Worked

The AIS program operated at machine speed, not human speed. Here is the end-to-end flow of a threat indicator through the system:

1. Detection: a bank’s security system identifies a malicious IP address or a unique hash of a new piece of malware. This data point is called a cyber threat indicator (CTI).
2. Automated scrubbing: the organization’s AIS client automatically strips any private customer information not directly related to the threat before transmission. CISA 2015 required this scrubbing as a condition of the liability protection.
3. Submission via TAXII: the clean CTI is submitted to the AIS hub using the TAXII protocol in STIX format, a standardized machine-readable structure that security tools can ingest directly.
4. Hub broadcast: the AIS hub instantly distributes the indicator to all participating organizations and government agencies, from hospital networks to power utilities to federal agencies.
5. Automatic block: each receiving organization’s security tools, firewalls, SIEM platforms, and endpoint protection automatically ingest the new indicator and block or flag it across their entire network before the attacker reaches a new target.

At its peak, the AIS program processed millions of indicators monthly. A single detection at one organization became an automatic network-wide block within minutes. That multiplier effect is what CISA 2015’s expiration eliminated.

A Double Hit: Expired Law and Reduced Government Capacity

The CISA 2015 expiration did not arrive in isolation. It coincided with a government shutdown that furloughed significant portions of CISA’s workforce. The combined effect was a simultaneous reduction in both the supply side (organizations stopped sharing) and the demand side (fewer government analysts to receive, analyze, and act on shared intelligence).

Loss of liability protection: without CISA 2015’s shield, corporate legal teams interpreted threat sharing as an unacceptable legal risk. The advice given to security teams was consistent across industries: pause voluntary sharing until legislative clarity is restored. The intelligence pipeline dried up from the source.

Reduced government response capacity: CISA’s furloughed staff meant fewer threat hunters on government networks, slower analysis of newly identified malware, and longer response times to emerging vulnerabilities. The remaining essential personnel shifted from proactive threat hunting to reactive incident response, extending the window in which attackers operate undetected.

Threat Model: What Changes When Collective Intelligence Disappears

Understanding precisely what threat vectors worsen helps organizations prioritize their independent defenses:

Threat category	Impact under AIS (CISA 2015 active)	Impact without AIS (CISA 2015 expired)	What organizations must do independently
Novel malware variants	First detection at one org blocks variant network-wide within minutes	Each organization detects independently; average detection time increases significantly	Invest in behavioral detection (EDR); subscribe to commercial threat feeds
Ransomware campaigns	Indicators from early victims alert later targets before encryption begins	Later targets have no advance warning; ransomware executes fully before detection	Immutable offline backups; network segmentation; encrypt sensitive data at rest (AES-256)
Compromised credentials and phishing infrastructure	Malicious domains and IPs blocked network-wide hours after first detection	Each organization’s DNS and email filters must independently detect and block	DMARC, DKIM, SPF enforcement; phishing-resistant MFA (FIDO2 or certificate-based)
Supply chain attacks	Malicious code signatures shared across software consumers rapidly	Detection delayed until each organization independently observes anomalous behavior	Software Bill of Materials (SBOM) tracking; CBOM Secure for cryptographic asset inventory; code signing verification
Critical infrastructure targeting	Sector-wide alerts through AIS give utilities, hospitals, energy companies advance warning	No automated cross-sector warning; sector-specific ISAC sharing is the only partial substitute	Join relevant ISAC immediately; increase OT/IT network monitoring investment
Zero-day exploitation	Early indicators from exploited organizations accelerate patch prioritization	Patch prioritization relies solely on vendor advisories and CISA KEV catalog (still active)	Subscribe to CISA KEV feed; risk-based patch management targeting KEV entries first

Encryption as the Last Line of Defense

When collective threat intelligence is unavailable, encryption changes from a compliance checkbox to an operational necessity. The core insight is that detection failures are now more likely: if an attacker breaches a network before being identified, the difference between a catastrophic breach and a contained incident is whether the data they accessed was encrypted and whether the keys were controlled by the organization.

Data at rest: AES-256-GCM is the current standard for encrypting stored sensitive data. For databases holding personally identifiable information (PII), protected health information (PHI), or financial records, column-level or field-level encryption ensures that even if an attacker extracts database files, the content is unreadable without the encryption key. Encryption Consulting’s Encryption Advisory Services assess current encryption coverage and identify data stores that are unencrypted or using deprecated algorithms.

Data in transit: all internal and external network communication carrying sensitive data must use TLS 1.3 with strong cipher suites (TLS_AES_256_GCM_SHA384 or TLS_CHACHA20_POLY1305_SHA256). Internal service-to-service communication should use mutual TLS (mTLS) so that a compromised credential in one service cannot be used to impersonate another. With slower external threat detection, attackers who gain network access have more time for lateral movement; mTLS limits the blast radius by requiring certificate-based authentication between services.

Key management: encryption is only as strong as key management. HSM as a Service provides FIPS 140-3 validated hardware key storage so that even if servers are compromised, encryption keys cannot be extracted. Key rotation schedules, access controls on key usage, and audit logging of all key operations are the operational controls that ensure encryption remains effective over time. CBOM Secure discovers all cryptographic assets across an environment, surfacing weak algorithms, unrotated keys, and unencrypted data stores that represent the highest-priority remediation targets.

Algorithm and Protocol Selection Guidance

Use case	Recommended algorithm or protocol	Minimum standard	What to avoid
Data at rest encryption	AES-256-GCM	AES-128-GCM	DES, 3DES, RC4, AES-ECB mode
Data in transit	TLS 1.3 with ECDHE + AES-256-GCM	TLS 1.2 with ECDHE (no RSA key exchange)	TLS 1.0, TLS 1.1, SSL, RC4 cipher suites, CBC mode in TLS 1.2
Internal service authentication	Mutual TLS (mTLS) with certificate-based identity	TLS 1.2 with client certificate authentication	API keys without rotation, shared secrets
Key storage	FIPS 140-3 validated HSM	FIPS 140-2 Level 2 validated HSM	Software key stores, keys in environment variables, keys in code repositories
Authentication	FIDO2 passkeys or certificate-based authentication (CBA)	TOTP-based MFA	Password-only, SMS OTP
Long-lived sensitive data (quantum risk)	Hybrid PQC: AES-256 + ML-KEM (FIPS 203) for key encapsulation	AES-256 alone (provides quantum resistance for symmetric encryption)	RSA-2048 alone for key wrapping of long-lived data (quantum-vulnerable)

Path Forward: Building Independent Cyber Resilience

Immediate Legislative Actions

• Fast-track reauthorization: Congress must pass a bipartisan bill restoring CISA 2015 with a long-term extension to prevent future lapses. The new legislation should include retroactive liability protections back to September 30, 2025, to cover any sharing that occurred during the gap and to immediately restart the flow of intelligence.
• Incentive structures: tax credits or safe harbor expansions for organizations that maintain continuous sharing through the gap period would accelerate intelligence flow before formal restoration.

Private-Sector Threat Intelligence Alternatives

• Join your sector’s ISAC immediately: Information Sharing and Analysis Centers (ISACs) operate independently of CISA 2015 and federal government status. The Financial Services ISAC (FS-ISAC), Health ISAC (H-ISAC), Energy ISAC, and others provide sector-specific threat intelligence through member-to-member sharing. Organizations not already participating should join immediately as the most direct substitute for AIS intelligence.
• Subscribe to commercial threat feeds: commercial threat intelligence services provide continuously updated indicators that do not depend on government infrastructure. These feeds can be ingested directly by SIEM platforms and firewalls in the same machine-to-machine format that AIS used.
• Cyber Threat Alliance participation: the Cyber Threat Alliance is a non-profit organization that facilitates threat intelligence sharing among cybersecurity companies, providing a private-sector alternative intelligence channel.

Organizational Security Controls

• Conduct a cryptographic inventory: use CBOM Secure to discover every cryptographic asset in your environment, identify unencrypted sensitive data stores, and surface weak algorithms or unmanaged keys that represent the highest-priority breach exposure under longer detection timelines.
• Deploy continuous monitoring: SIEM platforms, endpoint detection and response (EDR), and cloud security posture management (CSPM) must be active and generating alerts that are reviewed on a defined cadence. With external threat intelligence degraded, internal behavioral detection becomes the primary early-warning mechanism.
• Test incident response plans: assume detection times will be longer than previously experienced. Update incident response playbooks to reflect a threat environment where an attacker may have been inside the network longer before discovery, and test the plans with tabletop exercises that assume degraded external intelligence.
• Implement phishing-resistant MFA: compromised credentials are the most common initial access vector. FIDO2 hardware security keys or certificate-based authentication via CertSecure Manager eliminate the credential phishing attack path regardless of whether phishing infrastructure is blocked at the network level.

How Encryption Consulting Can Help

With collective threat intelligence degraded, the controls that previously served as a backstop must now serve as the front line. Encryption Consulting’s services directly address the gaps the CISA 2015 expiration creates:

• Encryption Advisory Services: our Encryption Advisory Services assess your current encryption coverage across data at rest, in transit, and in use; identify unprotected sensitive data stores; evaluate key management practices; and build a prioritized remediation roadmap aligned to NIST, GDPR, HIPAA, and PCI DSS. This is the foundational control that ensures breached data is unreadable even when detection is delayed.
• CBOM Secure: CBOM Secure scans your environment to produce a complete Cryptographic Bill of Materials (CBOM), surfacing every algorithm, key, and certificate in use. It identifies data that lacks encryption, flags deprecated algorithms, and provides the inventory needed to prioritize remediation by risk level. Organizations with degraded external threat intelligence need this visibility most urgently.
• HSM as a Service: HSM as a Service provides FIPS 140-3 validated hardware key storage, ensuring encryption keys cannot be extracted even under a sophisticated breach. Hardware-backed key management is the control that transforms a successful intrusion from a data breach into an attacker receiving useless ciphertext.
• Compliance Advisory Services: our Compliance Advisory Services help organizations understand how the CISA 2015 expiration affects their compliance posture under HIPAA, PCI DSS, GDPR, and SEC cybersecurity disclosure rules, and build the documentation and controls needed to demonstrate due diligence before an incident occurs.
• PQC Advisory Services: for organizations holding long-lived sensitive data that remains confidential value over the next decade, our PQC Advisory Services assess Harvest Now, Decrypt Later (HNDL) exposure and build a migration roadmap to NIST-standardized post-quantum algorithms (FIPS 203, 204, 205).

Limitations: What Individual Organizations Cannot Replace

• Speed at scale: private threat intelligence sources and ISAC participation provide meaningful coverage but cannot fully replicate the speed and breadth of the AIS program. A novel attack hitting many organizations simultaneously will spread faster without AIS’s near-instant broadcast to thousands of participants.
• Cross-sector visibility: ISACs are sector-specific. An attack that begins in financial services and pivots to healthcare or energy infrastructure loses visibility as it crosses sector boundaries. AIS provided cross-sector visibility that no private-sector alternative fully replicates.
• Encryption does not prevent intrusion: strong encryption makes breached data unusable, but it does not prevent the intrusion itself. Organizations must combine encryption governance with detection, access controls, and incident response to build a complete defensive posture.

Conclusion

The expiration of CISA 2015 removed the legal foundation that made America’s collective cyber early-warning system function. Without liability protection, voluntary sharing stopped. The AIS program’s millions of monthly indicators no longer reach the organizations that depended on them to block emerging threats. A simultaneous reduction in government cybersecurity capacity compounded the damage.

The practical consequence for enterprise security teams is that detection windows will be longer and novel attacks will spread further before being identified. The controls that reduce the impact of delayed detection are well understood: encrypt sensitive data so breaches yield ciphertext rather than plaintext, enforce hardware-backed key management so encryption keys survive a server compromise, deploy continuous behavioral monitoring to replace external early-warning signals, and join private threat-sharing communities as partial substitutes for AIS intelligence.

Legislative renewal of CISA 2015 is the systemic fix. Until it arrives, the organizations that will weather this period most effectively are those that have built their defenses to work independently of collective threat intelligence. If you want to assess your current encryption posture, identify unprotected data, or build the key management infrastructure that makes your defenses self-sufficient, contact Encryption Consulting to discuss where to start.

Frequently Asked Questions

What was the Cybersecurity Information Sharing Act of 2015 (CISA 2015)?

CISA 2015 created a federal liability shield allowing private sector companies to share cybersecurity threat indicators with the government and each other without fear of antitrust, privacy, or liability lawsuits. It established the Automated Indicator Sharing (AIS) program, which automatically exchanged threat indicators across thousands of organizations in near real time using STIX and TAXII standards.

What happened when CISA 2015 expired?

CISA 2015 expired on September 30, 2025, without renewal. Corporate legal teams advised organizations to stop sharing threat intelligence because the liability protection was gone. The voluntary flow of real-time threat indicators into the AIS program stopped, leaving security teams without the collective early-warning system they depended on to block emerging threats.

What is the Automated Indicator Sharing (AIS) program?

AIS is a machine-to-machine threat intelligence exchange operated by CISA using STIX and TAXII standards. It automatically shares cyber threat indicators including malicious IPs, domains, malware hashes, and attack patterns across participating organizations. At peak operation it processed millions of indicators monthly, turning a single detection into an automatic network-wide block.

What should organizations do to protect themselves now?

Six immediate steps: encrypt all sensitive data at rest (AES-256-GCM) and in transit (TLS 1.3); use HSM-backed key management; conduct a cryptographic inventory using CBOM Secure; join your sector’s ISAC for private threat intelligence; deploy SIEM-based continuous monitoring; and test incident response plans assuming longer detection windows.

What encryption controls most directly reduce risk when threat sharing is unavailable?

AES-256-GCM for data at rest, TLS 1.3 for data in transit, mTLS for internal service authentication, and FIPS 140-3 HSM-backed key management. Together these ensure that a successful intrusion produces unusable ciphertext rather than readable sensitive data, regardless of how long the attacker was inside before detection.

What are ISACs and how do they help?

Information Sharing and Analysis Centers (ISACs) are sector-specific, member-driven organizations that share cyber threat intelligence independently of government infrastructure. FS-ISAC covers financial services, H-ISAC covers healthcare, and other ISACs cover energy, water, transportation, and other sectors. They continue operating regardless of CISA 2015’s status and are the most direct private-sector substitute for AIS intelligence.