Security1 publisher2 min readPublished
Former NSA chief Nakasone calls the reported five-part agency overhaul 'probably necessary'
Former NSA director Paul Nakasone called a reported five-part reorganization of the agency 'probably necessary' but said execution will decide it. He tied the case to attacker speed, citing CrowdStrike figures that put average lateral movement at 29 minutes.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- The Washington Post reported last month that the NSA is creating five organizations, for AI, China, cybersecurity, combat support and global intelligence, each under a newly elevated mission director.
- Nakasone gave his view on Tuesday at VulnCheck's ThreatCon1 conference, in response to that report.
- He said large institutional change takes time, especially in an agency carrying intelligence, cyber and military responsibilities at once.
- He put the national security workforce's average age at 47, with half over 50, 10% under 30 and 13.5% able to retire right away.
- Last week DefenseScoop reported that pay for federal cybersecurity workers could be cut substantially.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Nakasone left the agency in 2024 and was answering a press report, so his support lends weight to the case for change without confirming the Post's five-organization design.
- exposure Response teams still sized for an hour-scale playbook are containing intruders who, on CrowdStrike's average, moved off the first host long before that playbook finishes.
- constraint Any new mission director hires from a workforce where more people could retire now than are under 30, and reported cyber pay cuts would make recruiting harder.
Nakasone ran the NSA and U.S. Cyber Command from 2018 to 2024 [3]. He was responding to a press report [2]. What he backed was change in general. He said the world has changed so dramatically that it is hard to imagine the NSA not changing [4]. His reservation came next. "When you're a big bureaucrat, how effective is that change? I think it depends," Nakasone said. "It's not necessarily the change, because I think that's a good thing. I think it's how you implement the change." [5] The account of his remarks does not say when the new organizations take effect or how they would change the agency's work with outside partners [1].
His case for change is speed. Citing CrowdStrike data, he said an adversary in 2018 took hours to move laterally after an initial intrusion, and by 2025 the average was 29 minutes [6]. The old mantra, he said, was "one minute to be able to recognize something has happened, 10 minutes to figure out what we're going to do, and 60 minutes to really enact it." "We're well past that," he said [7]. Those three steps add up to 71 minutes. A team that hits every one of them still finishes 42 minutes after the average intruder in that data has left the first host [15]. The 29-minute figure is one vendor's average, as Nakasone cited it [6].
He said defenders have a temporary advantage in AI. "I think there's a defender's window right now within AI that really our adversaries haven't caught up and used the capacity that really could be utilized against our critical infrastructure and most sensitive organizations," he said [8]. Nakasone sits on the board of OpenAI [9].
The new organizations would need people. Nakasone said agencies compete with private companies for technical talent [13]. In the workforce figures he cited, 13.5% could retire immediately and 10% are under 30. The share able to leave today is 3.5 points larger than the share under 30 [16]. Those figures cover the government's national security workforce, not the NSA alone [10]. "I think our government has to create the atmosphere that wants to make sure that people see that their work for the government is valued," he said [12].
What to watch
- Whether the NSA itself describes the five organizations and names the mission directors the Post reported.
- Whether the pay cuts DefenseScoop reported for federal cybersecurity roles take effect.
- CrowdStrike's next average lateral-movement figure, set against the 29 minutes Nakasone cited for 2025.