When Washington fires the head of Cyber Command, threatens to slash the workforce of its lead cybersecurity agency, and pulls the security clearances of a leading security vendor in the same month, European experts start asking out loud whether allies can still rely on the United States.

British business magazine Raconteur published an analysis by journalist Tamlin Magee on 15 April 2025, examining the turbulence in US cyber policy since Donald Trump took office, with extensive commentary from Tomislav Vazdar, a lecturer and Programme Lead for the MSc Enterprise Cybersecurity programme at OPIT, who has also served as a security advisor to Europol.

Raconteur places the cybersecurity uncertainty in the wider context of the administration’s first months, marked by tariff measures that rattled markets and combative rhetoric toward allies, describing cybersecurity as just one more area where business-as-usual has been disrupted, at home and abroad.

Cuts at CISA and departures at the top

According to reports cited by Raconteur, defence secretary Pete Hegseth reportedly ordered a pause on offensive cyber operations against Russia the previous month, a claim the Pentagon later denied. Meanwhile, Elon Musk’s department of government efficiency turned its attention to the US cybersecurity and infrastructure security agency, CISA, with insiders suggesting around 1,300 employees and 40% of contractors could be cut, though full details had not yet been announced. Tim Haugh, head of Cyber Command and chief of the NSA, was dismissed in early April along with his deputy, and the administration revoked the security clearances of SentinelOne, which had previously hired former CISA director Chris Krebs, fired after publicly contradicting Trump’s false claims of 2020 election fraud. An internal memorandum described CISA under Krebs as having led “government censorship against Americans.”

Laura Houston, a partner at law firm Slaughter and May, warns in the piece that three months into the term it is increasingly clear cybersecurity is not one of the administration’s priorities: there is still no Senate-confirmed cybersecurity leader at the Pentagon, the head of Cyber Command has been fired, and CISA’s workforce is being significantly reduced. Brandon Wales, CISA’s former acting director now at SentinelOne, warns that reduced capacity could hamper the agency’s role as a central hub for threat information-sharing, on which federal agencies, state and local governments and the private sector all rely. Still, he views the nomination of Sean Plankey, a former cyber policy director from Trump’s first term, as a positive move, and expects cooperation between international bodies such as the FBI, Europol, the Secret Service and Interpol to survive the cuts, since those relationships are deeply institutionalised.

Doubts over the pause on operations against Russia

Vazdar says that if the reports of a pause on operations against Russia are accurate, it could signal a significant policy shift in which old alliances disintegrate and new ones form; he suggests the same cyber diplomacy at play with Russia could be used to redirect US offensive capabilities toward China. At the same time, he warns that a US withdrawal from engagement with Russia would “really reduce critical intelligence sharing.”

Why European allies are worried

According to Vazdar, NATO and European nations fear increased cyber aggression from Russia, which could push Europe to independently develop more robust offensive cyber capabilities. “It’s obvious that the days of the US leading the free world are gone,” he told Raconteur. He adds that by repeatedly failing to condemn Russian cyber aggression, the US has undermined international norms against cyberattacks while diluting deterrent strategies, something adversaries such as China, Iran and North Korea may read as a green light for increased activity.

Matthew Hodgson, CEO and cofounder of privacy company Element, goes further in the piece, arguing that gutting CISA will “obviously compromise the US’s ability to defend itself,” shifting the burden onto individual countries to protect their own infrastructure rather than depending on US tech companies; European nations, he notes, are already building their own digitally sovereign tech stacks.

The cost for the fight against ransomware

Vazdar specifically flags the consequences for the international fight against ransomware. Successful takedowns of groups such as Conti, LockBit and Phobos were possible precisely because of cross-border cooperation between authorities. “If you don’t have active personnel working 24/7 on monitoring what adversaries are doing, then it’s going to be really tough to rebuild everything from scratch,” he says. The point echoes his warning on intelligence sharing: institutional cooperation takes years to build and can unravel quickly the moment one side pulls back resources or attention.

What this means for Croatian and European organisations

For Croatian and European organisations, the message is clear: relying on someone else’s threat-intelligence infrastructure is no longer a safe assumption, and building an organisation’s own capacity to detect and respond to incidents matters regardless of what happens in Washington. That capacity is not optional for Croatian essential and important entities either, since the Cyber Security Act already requires them to be able to detect, report and respond to incidents on their own. Vazdar’s message to European readers boils down to one line: whoever waits for someone else to defend their network is waiting for the wrong actor.

Riskoria helps organisations build that capacity through its incident management services and support with compliance under the Cyber Security Act. The original article is available on Raconteur.net.