Former NSA chief Nakasone calls the reported five-part agency overhaul 'probably necessary'
Former NSA director Paul Nakasone called a reported five-part reorganization of the agency 'probably necessary' but said execution will decide it. He tied the case to attacker speed, citing CrowdStrike figures that put average lateral movement at 29 minutes.
The Watch · Security desk
What happened
- The Washington Post reported last month that the NSA is creating five organizations, for AI, China, cybersecurity, combat support and global intelligence, each under a newly elevated mission director.
- Nakasone gave his view on Tuesday at VulnCheck's ThreatCon1 conference, in response to that report.
- He said large institutional change takes time, especially in an agency carrying intelligence, cyber and military responsibilities at once.
- He put the national security workforce's average age at 47, with half over 50, 10% under 30 and 13.5% able to retire right away.
- Last week DefenseScoop reported that pay for federal cybersecurity workers could be cut substantially.
Why it matters
- What it limits constraint Nakasone left the agency in 2024 and was answering a press report, so his support lends weight to the case for change without confirming the Post's five-organization design.
- Who's exposed exposure Response teams still sized for an hour-scale playbook are containing intruders who, on CrowdStrike's average, moved off the first host long before that playbook finishes.
- What it limits constraint Any new mission director hires from a workforce where more people could retire now than are under 30, and reported cyber pay cuts would make recruiting harder.
Next story · Invest · 2d ago
CrowdStrike falls about 3% on a report of OpenAI talks to buy Trail of BitsConfirmed4 publishers
Nakasone ran the NSA and U.S. Cyber Command from 2018 to 2024 [3]. He was responding to a press report [2]. What he backed was change in general. He said the world has changed so dramatically that it is hard to imagine the NSA not changing [4]. His reservation came next. "When you're a big bureaucrat, how effective is that change? I think it depends," Nakasone said. "It's not necessarily the change, because I think that's a good thing. I think it's how you implement the change." [5] The account of his remarks does not say when the new organizations take effect or how they would change the agency's work with outside partners [1].
His case for change is speed. Citing CrowdStrike data, he said an adversary in 2018 took hours to move laterally after an initial intrusion, and by 2025 the average was 29 minutes [6]. The old mantra, he said, was "one minute to be able to recognize something has happened, 10 minutes to figure out what we're going to do, and 60 minutes to really enact it." "We're well past that," he said [7]. Those three steps add up to 71 minutes. A team that hits every one of them still finishes 42 minutes after the average intruder in that data has left the first host [15]. The 29-minute figure is one vendor's average, as Nakasone cited it [6].
He said defenders have a temporary advantage in AI. "I think there's a defender's window right now within AI that really our adversaries haven't caught up and used the capacity that really could be utilized against our critical infrastructure and most sensitive organizations," he said [8]. Nakasone sits on the board of OpenAI [13].
The new organizations would need people. Nakasone said agencies compete with private companies for technical talent [11]. In the workforce figures he cited, 13.5% could retire immediately and 10% are under 30. The share able to leave today is 3.5 points larger than the share under 30 [16]. Those figures cover the government's national security workforce, not the NSA alone [14]. "I think our government has to create the atmosphere that wants to make sure that people see that their work for the government is valued," he said [10].
What to watch
- Whether the NSA itself describes the five organizations and names the mission directors the Post reported.
- Whether the pay cuts DefenseScoop reported for federal cybersecurity roles take effect.
- CrowdStrike's next average lateral-movement figure, set against the 29 minutes Nakasone cited for 2025.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
According to a Washington Post report last month, the NSA is creating five new organizations focused on artificial intelligence, China, cybersecurity, combat support and global intelligence, each led by a newly elevated "mission director."
- [2]
Speaking Tuesday at VulnCheck's ThreatCon1 conference, Nakasone addressed a recent report that the NSA is undergoing a major restructuring, and said the reported reorganization is "probably necessary."
- [3]
Nakasone led the NSA and U.S. Cyber Command from 2018 to 2024.
- [4]
"I think that the world has changed so dramatically, so it's hard to imagine [the NSA] not changing," Nakasone said.
- [5]
"When you're a big bureaucrat, how effective is that change? I think it depends," Nakasone said. "It's not necessarily the change, because I think that's a good thing. I think it's how you implement the change."
- [6]
Nakasone said CrowdStrike data showed that in 2018 an adversary took hours to move laterally through a system after an initial intrusion, and that as of 2025 that time had dropped to an average of 29 minutes.
- [7]
"Remember the old mantra, we'd say, 'Hey, we have one minute to be able to recognize something has happened, 10 minutes to figure out what we're going to do, and 60 minutes to really enact it," Nakasone said. "We're well past that, and this is the challenge that we have as we think about our opportunities to have better defense in the future."
- [8]
"I think there's a defender's window right now within AI that really our adversaries haven't caught up and used the capacity that really could be utilized against our critical infrastructure and most sensitive organizations," Nakasone said.
- [9]
DefenseScoop reported last week that federal employees in cybersecurity roles could face significant pay cuts.
- [10]
"I think our government has to create the atmosphere that wants to make sure that people see that their work for the government is valued," Nakasone said.
- [11]
Nakasone said the ability to adapt depends on personnel, pointing to agencies competing with private companies for technical talent.
- [12]
Nakasone said large-scale institutional changes can take time, especially in an agency with broad intelligence, cyber and military responsibilities.
- [13]
Nakasone sits on the board of OpenAI.
- [14]
Citing figures for the government's national security workforce, Nakasone said the average age is 47, half the workforce is older than 50, 10% is younger than 30 and 13.5% could retire immediately.
- [15]
The old one-minute, 10-minute, 60-minute response model totals 71 minutes, which ends 42 minutes after the 29-minute average lateral movement time Nakasone cited.
- [16]
The share of the national security workforce that could retire immediately (13.5%) exceeds the share under 30 (10%) by 3.5 percentage points.
Sources
2 independent publishers whose own reporting we read for this story.
- cyberscoop.comFormer NSA chief Nakasone says agency overhaul is ‘probably needed’
2 articles · October 6, 2026
- scworld.comFormer NSA director discusses agency reorganization amid evolving cyber threats
1 article · October 7, 2026
Topics and entities
Topics
- Intelligence agency reorganization
- Attacker breakout time
- AI in Cyber Defense
- Federal Cyber Workforce