It wasn’t much of a surprise – as expected, the Democrats had a very good showing in the midterm elections. As I’m writing this, while there are many seats still undecided, the Senate stands at 54-44 with races still being counted. The House majority could top 250 seats.
We have a divided government, and while I could give you a political mechanics dissertation (and ironically, I am uniquely qualified to do so), I wanted to concentrate specifically on some of the near-term actions in the realm of cybersecurity that may happen due to the congressional shift in polarity.
Information sharing might actually happen. The Cybersecurity Information Sharing Act of 2015 (CISA 2015, not to be confused with the agency, because, of course, they share an acronym) was designed to offer limited protection to those companies that share cyber threats. The law lapsed in 2025 and has been sort of limping along ever since (the current extension expires on December 11th). With the changes in Senate leadership, the Department of Homeland Security might finally revisit this, including some additional language around AI.
Federal AI preemption is dead. The executive order 14365 that targeted state-specific AI laws can't preempt anything on its own. Only Congress can do that, and it already rejected a moratorium twice (the Senate vote was 99-1). A Democratic Congress is extremely unlikely to revive it. So, simply put, the 50-state (and other territories) patchwork is here to stay. CISOs should build AI controls to the strictest state regime they operate in, not wait for a federal rescue. This may get resolved by the feds eventually, but not in the near term.
The money starts flowing back. I mentioned the CISA above, and the CISA (agency) has lost roughly a third of its workforce (never mind the massive brain drain at the top). The Democrats now control the purse strings, and I think we can expect to see an effort to restore CISA staffing and a multi-year grant deal for the individual state’s cyber programs. That's good news for counties, school districts, and water utilities. It's also good news for those vendors that sell into those markets.
What About Company Valuations?
I am not a stock analyst, nor would I be a particularly good one. But today, the markets jumped more than 1,000 points. I'd argue the election changes the mix, not the direction. GRC, AI governance, OT security, and SLED vendors have the potential to gain the most, while those organizations that depend on a hands-off Washington for growth should take another look. Regardless, as a rule, cyber threats care little about midterm elections, and cybersecurity fundamentals (and those vendors that address those verticals for their customers) are always going to be interesting.
________________________
The next two years won't be a regulatory revolution for cybersecurity, but there will likely be some course correction. Putting the political theater aside, cybersecurity is still as important as ever. For an industry that thrives on clear rules and steady funding, that's not a bad place to be.
