NSA Leadership Acknowledges Need for Structural Change
Former National Security Agency Director Paul Nakasone said a reported broad reorganization of the agency is “probably necessary” as it confronts faster-moving cyberthreats, artificial intelligence, and strategic competition with China. Speaking at VulnCheck’s ThreatCon1 conference on Tuesday, Nakasone addressed recent reports detailing a major NSA restructuring initiative, emphasizing that while change is essential, its success hinges on implementation.
According to a Washington Post report from last month, the NSA is establishing five new organizations centered on artificial intelligence, China, cybersecurity, combat support, and global intelligence. Each unit would be led by a newly created ‘mission director’ role, signaling a shift toward more agile, mission-driven operations.
Change Is Inevitable, But Execution Matters
Nakasone, who led both the NSA and U.S. Cyber Command from 2018 to 2024, expressed encouragement that current agency leaders recognize the need to adapt. “I think that the world has changed so dramatically, so it’s hard to imagine [the NSA] not changing,” he stated. However, he cautioned that large-scale institutional change in a complex agency like the NSA — with overlapping intelligence, cyber, and military responsibilities — requires careful execution.
“When you’re a big bureaucrat, how effective is that change? I think it depends,” Nakasone said. “It’s not necessarily the change, because I think that’s a good thing. I think it’s how you implement the change.” His remarks underscored a broader challenge facing U.S. intelligence: modernizing to lead in emerging technologies like AI while defending against adversaries such as China, who are also seeking to exploit those same tools for strategic gain.
AI Has Shrunk Defender Response Windows to Minutes
Nakasone highlighted how artificial intelligence has drastically reduced the time available to detect and respond to cyber intrusions. Referencing CrowdStrike data, he noted that when he assumed command in 2018, adversaries typically took hours to move laterally through a compromised system after an initial breach. As of 2025, that dwell time has fallen to an average of just 29 minutes.
“Remember the old mantra, we’d say, ‘Hey, we have one minute to be able to recognize something has happened, 10 minutes to figure out what we’re going to do, and 60 minutes to really enact it,’” Nakasone said. “We’re well past that, and this is the challenge that we have as we think about our opportunities to have better defense in the future.”
He described this evolving timeline as creating a temporary ‘defender’s window’ — a period where U.S. defenders still hold an advantage before adversaries fully harness AI for offensive operations against critical infrastructure. Nakasone, who serves on the board of OpenAI, stressed that this window is narrowing and must be leveraged through proactive investment in AI-driven defense capabilities.
Personnel Challenges Thwart Modernization Efforts
The former NSA chief also tied the need for reform to persistent personnel challenges, noting that the agency struggles to compete with private-sector salaries and workplace culture. Citing federal workforce data, he revealed that the average age of the national security workforce is 47, with half of employees over 50, only 10% under 30, and 13.5% eligible for immediate retirement.
He referenced a recent DefenseScoop report indicating that federal cybersecurity roles could face significant pay cuts, warning that such trends undermine morale and recruitment. “I think our government has to create the atmosphere that wants to make sure that people see that their work for the government is valued,” Nakasone said. “I think there’s probably no one in this room that wouldn’t say that we can be more efficient in our government, but I also think there are a lot of people in this room that have had [their] government service attacked to say, ‘That’s just for people that can’t get jobs on the outside.’ That’s not right.”
Nakasone concluded by advocating for a more respectful national conversation about public service, arguing that valuing government employees is essential to attracting and retaining the technical talent needed to defend against evolving threats in AI and cybersecurity.
Source: CyberScoop