Cybersecurity bill expands federal threat-sharing to rural operators

What it does

This bill updates the Cybersecurity Act of 2015 to modernize how federal and non-federal entities share cyber threat information and defensive measures. It adds definitions for artificial intelligence and critical infrastructure, expands the types of entities that can receive federal cybersecurity assistance (including smaller and rural infrastructure operators), requires DHS to conduct outreach to help these entities understand how to share threat data, and permits the use of AI tools developed specifically for cybersecurity purposes in threat detection and response.

Why we flagged it

The bill's core function is reauthorizing and updating the 2015 Cybersecurity Act to expand threat-information sharing, improve outreach to underserved infrastructure operators, and permit AI-assisted cybersecurity tools. It is a technical modernization of existing federal cybersecurity coordination mechanisms, not a new regulatory regime or private-sector carve-out.

What the text implies

• The bill permits use of AI 'developed or strictly deployed for cybersecurity purposes' without defining 'strictly deployed' or establishing oversight mechanisms for AI tool validation, potentially allowing deployment of AI systems with limited transparency into their decision-making.
• Expansion of 'Sector Risk Management Agencies' as recipients of federal threat data and technical assistance may shift cybersecurity responsibility to entities whose governance and accountability structures differ from traditional federal agencies.
• The 90-day outreach mandate to small and rural operators is aspirational but lacks enforcement mechanisms or appropriations; compliance depends on DHS resource allocation and political priority.
• Permitting 'one-time read-ins' to select individuals at non-federal critical infrastructure entities creates a new channel for classified or sensitive threat information to flow outside traditional security clearance frameworks.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill strengthens cybersecurity information-sharing infrastructure and explicitly mandates outreach to small and rural critical infrastructure operators who lack dedicated cybersecurity staff, improving their defensive posture. The expansion of federal technical assistance on a voluntary basis and the requirement for clearer, more accessible guidance benefits ordinary citizens by reducing vulnerability to cyberattacks on infrastructure they depend on.

Who stands to gain

• Cybersecurity software and services vendors (AI-enabled threat detection platforms)
• Critical infrastructure operators (water, energy, transportation) receiving federal technical assist
• Managed security service providers serving small and rural infrastructure

Named in the bill

Department of Homeland Security (DHS), Department of Justice (DOJ), Sector Risk Management Agencies, Critical infrastructure operators (non-federal), National Artificial Intelligence Initiative Act of 2020, Homeland Security Act of 2002, Office of Science and Technology Policy

Where it stands

1 cosponsor: 1 Republicans.

• Sep 2, 2025 — Introduced · Congress.gov: “Introduced in House”
• Sep 2, 2025 — Referred to House Committee on the Judiciary and House Committee on Armed Services · Congress.gov: “Referred to the Subcommittee on Cybersecurity and Infrastructure Protection”
• Sep 3, 2025 — Markup held in committee · Congress.gov: “Committee Consideration and Mark-up Session Held”
• Sep 3, 2025 — Reported out of committee · Congress.gov: “Ordered to be Reported (Amended) by the Yeas and Nays: 25 - 0”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

51 lobbying clients named this bill on 76 disclosure filings across 3 quarters, Dec 2025 to Jun 2026. Those filings disclosed $113,519,598 in lobbying spend. A filing names 19 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 99% of bills with at least one filing.

Andrew Garbarino, the sponsor, reported $1,954,500 in PAC receipts in the 2026 cycle. $51,500 of that came from 7 PACs tied to these lobbying clients.

• Chamber of Commerce of the U.S.A. — $54,660,000 on 3 filings
• Business Roundtable Inc — $6,950,000 on 1 filing
• Google Client Services LLC — $6,920,000 on 2 filings
• American Bankers Association — $5,210,000 on 2 filings
• American Property Casualty Insurance Association — $3,540,000 on 2 filings

Lobbying Disclosure Act filings through Jul 23, 2026. A filing shows who paid to lobby on a bill it names, not what changed.