CyberScoop reported that Paul Nakasone, who led the NSA and US Cyber Command from 2018 to 2024, called a reported NSA overhaul probably necessary. He spoke on Tuesday at VulnCheck's ThreatCon1 conference. He said the result depends on how the changes are carried out. The Washington Post reported last month that the agency is creating five new organizations. They cover AI, China, cybersecurity, combat support and global intelligence. Each would be led by a newly elevated mission director.
Nakasone cited CrowdStrike data on lateral movement, which is how long an intruder takes to spread through a network after getting in. In 2018 that took hours. As of 2025, CrowdStrike's average was 29 minutes. He recalled an old rule: one minute to notice, 10 to decide and 60 to act. He said the field is well past that. He also said defenders have a temporary edge because adversaries have not yet caught up on AI. The report does not say how long that edge lasts. It carries no NSA statement and no timeline for the overhaul.
The old rule adds up to 71 minutes, more than twice CrowdStrike's 2025 average. For people who run or buy security software, the question is whether their team can detect and contain an intruder inside 29 minutes.