CISA Hits Pause on Plan to Shift Cybersecurity Alerts Off Website Following Backlash
In a move that sparked widespread concern across the cybersecurity landscape, the Cybersecurity and Infrastructure Security Agency (CISA) announced on May 12, 2025, its intent to discontinue publishing standard cybersecurity alerts and advisories on its official website. Instead, CISA planned to deliver these updates solely through email subscriptions and social media channels.
Under the proposed shift, the “Cybersecurity Alerts & Advisories” section of the website would be refocused to highlight only critical, time-sensitive threats or high-impact cyber incidents.
“This change is aimed at spotlighting the most pressing risks and improving information accessibility,” the agency stated.
However, the announcement sent shockwaves through the cybersecurity community, which voiced strong concern over the implications for operational security workflows. Many practitioners depend on the existing structure to integrate threat intelligence into automated monitoring and response tools.
Among the key resources impacted by the plan were:
- The Known Exploited Vulnerabilities (KEV) Catalog in JSON and CSV formats
- RSS feeds delivering timely vulnerability alerts
- GitHub repositories used by analysts for real-time data
- CISA’s centralized online advisory system
Especially troubling for defenders was the shift from open RSS tracking of the KEV catalog to a more closed model requiring subscription via GovDelivery. Since its inception in 2021, the KEV list has become indispensable to security teams tracking active threats in the wild.
The move raised alarms for smaller organizations and under-resourced teams, which often rely on automated feeds and public repositories rather than curated email lists or social media monitoring.
Less than 24 hours later, on May 13, CISA responded to the mounting feedback by announcing a hold on the rollout. The agency acknowledged the confusion and said it would revisit its plans to avoid disrupting critical cybersecurity workflows.
The KEV catalog and associated feeds are deeply woven into the fabric of many security infrastructures—frequently ingested into tools using the CSAF (Common Security Advisory Framework) standard. Any interruption in availability or format risks undermining threat visibility and response capability across the sector.
