# CISA Urges Attacker-Centered Cyber Testing

CISA is urging federal agencies to use attacker-centered penetration testing and rank vulnerabilities by exploitability, exposure, and potential mission consequences as AI accelerates cyber threats. The signal identifies potential demand for vulnerability assessment, asset inventory, edge-device lifecycle management, and coordinated vulnerability disclosure capabilities, but names no solicitation, contract value, or procurement date.

- Agencies and contractors supporting federal cybersecurity can evaluate whether their testing and vulnerability-management offerings address attacker perspectives and prioritize risks using the factors CISA identified.
- The signal points to possible needs for capabilities spanning vulnerability assessment, asset visibility, edge-device lifecycle management, and coordinated disclosure; it does not announce a specific acquisition or mandate a procurement.
- Sam Vasquez of CISA said automation can improve visibility into agency assets and risk. Businesses can use this stated emphasis to inform relevant capability descriptions and discussions with federal customers.

**Jurisdictions:** federal
**Industries:** Information Technology, Public Safety
**Topics:** Cybersecurity
**Published:** October 28, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- U.S. Department of Homeland Security (DHS)

### Key Quotes
> As the AI starts automating a lot of this, we can know exactly what we have, what’s out there and what the risk is.
> — Sam Vasquez, Chief of Operations for Vulnerability Management at CISA

### Sources
- [CISA: Agencies Must Think Like Attackers for AI Cyber Threats | GovCIO Media & Research](https://govciomedia.com/cisa-agencies-must-think-like-attackers-for-ai-cyber-threats) - GovCIO Media & Research