Palantir CISO tapped for CISA director; Democrats cry conflict

Palantir's chief information security officer, Michael LoSapio, is President Trump's pick to run the Cybersecurity and Infrastructure Security Agency — and Senate Democrats opened fire within a day. The nomination, announced Monday, would fill a Senate-confirmed post that has sat vacant throughout Trump's second term. The obstacle is not his résumé. It is his employer.

The two Democrats set to lead the homeland security oversight panels on Capitol Hill both flagged Palantir's work at the Department of Homeland Security and its subagency, Immigration and Customs Enforcement, as the problem.

Sen. Maggie Hassan of New Hampshire, in line to chair the Senate Homeland Security and Governmental Affairs Committee in 2027, said in a statement to CyberScoop: "CISA plays a critical role in protecting our nation's cybersecurity infrastructure, and the Trump-Vance administration has undermined CISA by cutting its funding, reducing agency staff, and making us vulnerable to cyberattacks from our adversaries."

She did not stop there. "Given his senior role at Palantir, which has provided tools that helped enable ICE's lawless behavior under this administration, I have serious questions about whether he has the independence and judgement needed for this position," Hassan said.

Her House counterpart, prospective Homeland Security Committee Chairman Bennie Thompson of Mississippi, raised the same worry in blunter terms. "CISA is at a critical juncture, rebuilding after a year of reckless efforts to hack up the agency," Thompson said. "Certainly his relationship with Palantir raises very serious concerns given its role in DHS surveillance programs. I'm concerned that baggage will be an unnecessary distraction from the urgent rebuilding efforts at CISA."

What does the nomination change for CISA?

For now, nothing. The Senate committee that must approve the nominee is still chaired by Rand Paul, Republican of Kentucky, whose office did not respond to a request for comment. The panel's retiring top Democrat, Gary Peters of Michigan, set the bar LoSapio must clear: "Mr. LoSapio must demonstrate that he possesses the independent judgment and qualifications to decisively place national security and the national interest above political pressure."

The current House chairman, Andrew Garbarino, Republican of New York, took a friendlier line. He welcomed having a nominee at all, praised acting director Nick Andersen's leadership, and said: "I look forward to reviewing the qualifications of Michael LoSapio and urge the Senate to do so with urgency."

Technical credentials, vendor baggage

Unlike National Cyber Director Sean Cairncross before his own confirmation, LoSapio arrives with genuine technical credentials. A former Trump administration official said his name surfaced months ago, and that his cybersecurity certifications and experience managing cyber risk at a major public company fit the role.

A cybersecurity executive who has worked with LoSapio called him an "exceptional choice." The executive's assessment, in full:

• "Mike LoSapio is an extremely competent and talented cybersecurity leader. He knows his stuff."
• "He defends one of the most targeted organizations on the planet" — a reference to Palantir's sensitive government contracts.
• He is "high-integrity," not "dogmatic or political," and not "the kind of person that would be cowed by political pressure."

CISA is primarily a technical agency, the executive argued, so "that work is best done by someone who knows how to do it." The executive conceded the Palantir criticism is understandable, given U.S. surveillance concerns, while noting LoSapio has already navigated those "thorny issues."

A customer in the house of its regulator

Patrick Eddington, a senior fellow at the Cato Institute, made the sharpest structural objection. He acknowledged LoSapio's technical background but called his lack of government experience and absence of any public record on CISA's subject matter a "thin resume." The larger problem, Eddington said, is that CISA itself buys Palantir software.

"The nominee would come from the vendor whose software is already being bought, without competition, by the office he'd run," Eddington said. "And the agency responsible for judging the security of federal civilian systems would be led by the former security chief of a vendor whose platforms now run across DHS. That's where ethics rules would normally help, yet this administration has weakened them."

Eddington's checklist for senators before any confirmation vote:

• Disclose what Palantir stock or other holdings LoSapio holds, and whether he will divest.

• Establish whether he will recuse himself from Palantir matters for longer than the administration would require.

• Determine whether he has struck bargains to return to Palantir after CISA service.

"Bottom line: Palantir's business is fusing government data at scale, and DHS has made it the default analytics vendor across the department," Eddington said. With a one-year recusal as the main safeguard, the arrangement "risks making CISA one vendor's customer, regulator and alumni network all at once. Even if LoSapio is entirely well-intentioned, that's the wrong setup."

A Palantir spokesperson did not respond to requests for comment.

The clock problem

Joshua Corman, a former CISA adviser now at the Institute for Security and Technology, noted that even a smooth confirmation leaves little runway. Andersen and his team, despite budget cutbacks, "never gave up" on the agency, Corman said, and set priorities for "the most life-safety of our critical functions."

With two years left in Trump's term, "it may be hard to have much of a dent, no matter who gets the nod," Corman said. His verdict: lean on the current steward. For CIOs watching federal cybersecurity posture, that is the practical answer — Andersen runs CISA today, and likely will for some time.