Trump nominates Palantir’s Michael LoSapio to lead CISA | Magica
Trump picks Palantir security chief Michael LoSapio for CISA
Editorial Team
••📖6 min read
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Trump’s nominee brings years of infrastructure security work at Palantir, whose DHS contracts face Democratic scrutiny.
CISA’s reported headcount fell 28% from September 2025 to March 2026; its fiscal 2027 funding request is below the enacted fiscal 2026 level.
Senate confirmation remains pending, with Republicans’ remaining time in control running short.
President Donald Trump nominated Michael LoSapio, chief information security officer and former infrastructure and network security group leader at data and AI software supplier Palantir, to direct the Cybersecurity and Infrastructure Security Agency on November 9. The nomination sent to the Senate offers a route to filling a post without a Senate-confirmed director since January 2025.
CISA is the Department of Homeland Security’s main civilian cyberdefense agency, as described in the nomination report. It helps protect federal agency networks and works with water utilities, power grids, telecommunications operators and other critical infrastructure owners to prevent and respond to attacks. LoSapio would inherit both a diminished workforce and a review of which services the agency should provide.
His nomination also brings a security executive from a government software supplier into a confirmation process that could extend into a Democratic-controlled Senate. Palantir’s work for DHS has already drawn lawmakers’ questions about surveillance and the handling of sensitive information.
Palantir’s company-reported illustration of data integration and access controls. Examples use notional data and do not depict a DHS deployment. Source: Palantir.
What LoSapio brings from Palantir
LoSapio became Palantir’s CISO in September 2024 after leading its infrastructure and network security group from December 2017, according to his LinkedIn profile as described in the nomination report. He previously worked there as a systems engineer from 2013 to 2016, spent more than a year at database company SingleStore, and returned to Palantir.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
That career gives him experience securing a technology company’s systems. Leading CISA would add responsibility for a federal agency and its relationships with infrastructure operators across the country. He did not immediately respond to the report’s request for comment.
The administration was thought to be seeking a candidate from a high-profile technology company, a separate account of the selection said. Neither account sets out a detailed rationale from Trump for choosing LoSapio.
Palantir, founded in 2003, supplies software for integrating and analyzing data and deploying AI across government and commercial organizations. In its explanation of its business, the company says it was founded to support national security missions and serves customers including the Defense Department and law enforcement agencies.
Its relationship with DHS predates Trump’s current administration. Palantir says its contract with Homeland Security Investigations, the division of Immigration and Customs Enforcement that investigates transnational crime, began in 2011 under President Barack Obama. That work included supplying HSI’s case management system.
The company says the contract expanded in April 2025 to include a six-month prototype covering enforcement prioritization, self-deportation tracking and immigration lifecycle operations. Those details give substance to the political questions surrounding its government work; they do not establish what role LoSapio personally played in those contracts.
Democratic lawmakers have questioned whether Palantir’s DHS work enables surveillance of Americans, while the company has denied conducting or enabling mass surveillance, the nomination report said. In its own FAQ, Palantir says customers control their data and how its software is used, and denies selling software to enable unlawful surveillance. Those are the company’s descriptions of its practices.
Oregon Democratic Sen. Ron Wyden has said he plans to renew inquiries into Palantir’s work with the administration when he takes over the Senate Finance Committee, and that lawmakers could compel answers if the company does not cooperate, according to the nomination report.
CISA headcounts reported by the Congressional Research Service, not November staffing levels or funded positions. CRS cautions about possible inconsistencies following OPM’s reporting-system change. Source: Congressional Research Service.
Fewer staff and a lower funding proposal
The director’s post has been vacant since Jen Easterly left the agency. Trump’s previous nominee, Sean Plankey, withdrew in April after more than a year awaiting confirmation. His candidacy became entangled in a dispute with Florida Republican Sen. Rick Scott over Coast Guard contracting, the nomination report said.
Wyden had separately placed a hold on Plankey pending release of a public telecommunications cybersecurity report. He was still waiting for that report as of late October, the separate selection account said. The earlier nomination’s difficulties therefore extended beyond the choice of candidate.
The agency’s staffing losses are measurable. A June 9 Congressional Research Service (CRS) analysis, compiling federal personnel data, lists 3,178 CISA employees at the end of fiscal 2025 and 2,285 at the end of March 2026. That is a decline of 893 people, or about 28%, over six months. These are reported employees on board, not funded positions or full-time-equivalent work years, and they are not a November headcount. CRS notes that the Office of Personnel Management changed reporting systems in fiscal 2025 and that some observers have raised concerns about data inconsistencies.
CISA has since moved to refill a few hundred positions, according to the nomination report. House Democrats have pledged investigations into the workforce cuts and changes to election security work.
Funding also depends on the comparison chosen. CRS puts the administration’s fiscal 2027 request for CISA at $2.49 billion in gross annual appropriations. Its table shows the following comparisons:
Comparison baseline
Fiscal 2027 request versus baseline
Fiscal 2026 enacted annual appropriations
$118 million lower, or 4.5%
Fiscal 2026 budget request
$109 million higher, or 4.6%
Fiscal 2025 continuing-resolution funding
$386 million lower, or 13.4%
The request was prepared before fiscal 2026 DHS appropriations were enacted. These comparisons exclude transfers, mandatory spending, offsetting collections and advance or supplemental appropriations; they do not measure all resources available or establish what Congress will ultimately fund for fiscal 2027.
Nor would the increase over the previous request all represent added cyberdefense capacity. CRS identifies $41 million for pay and retirement costs, technical adjustments and annualization of earlier pay initiatives, plus $44 million in research funding driven by a proposed transfer of work from DHS’s Office of Countering Weapons of Mass Destruction.
CISA’s strategy released in October called for reviewing its services and focusing more on infrastructure whose disruption would most harm public safety, the economy and national security, according to the nomination report. Staffing and funding choices will determine what resources support that focus.
Confirmation is the next decision
Republicans control the Senate until January, but government funding and defense legislation compete for time in the remaining session. If senators do not confirm LoSapio before this Congress ends, Trump would have to nominate him again for consideration by the incoming Democratic majority, the nomination report said.
There may be a nearer-term consequence for acting leadership. Nick Andersen, who has led CISA in an acting capacity since February, was approaching the legal limit on that service. Putting forward a nominee could pause that clock, the separate selection report said; it does not itself install LoSapio as director.
The Senate’s immediate decision is whether to confirm him in the remaining session. Beyond his technical record, the evidence senators will need is how he would staff and prioritize CISA’s services—and how he would address questions arising from his employer’s work for the department he would join.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
