CISA-Nightwing Insider Leak Case; An Instructive Reckoning

By June 8, 2026

Hello again. In this edition we examine the CISA-Nightwing data leak – a third-party contractor incident with important lessons for government and enterprise senior executives, CISOs, and their teams.

Our analysis follows the AIA™ framework (Awareness-Impact-Action), a decision intelligence model developed for senior cybersecurity practitioners. We cover:

  • Awareness of the key facts in the CISA-Nightwing case
  • Impact and lessons for government, contractor, and industry CISOs, and cybersecurity risk and compliance teams
  • Actions CISOs can take to prepare for insider leaks of this type

We close with an outlook on trends and potential solutions for human and non-human identity (NHI) leaks.

BLUF: Data leaks enable breaches. This leak is not the result of a system breach, nor is it believed to be malicious. It is likely a ‘leak of convenience’ by a third-party contractor; a failure of training, governance, and oversight. Egregious, but not uncommon. Technology is moving faster than security and governance teams can track. Static GRC frameworks and traditional DLP tools are necessary but inadequate for the complexity and pace of modern DevOps pipelines, contractor-managed cloud infrastructure, and non-human identities. The results are predictable: credential exposures go undetected for months or years. We do not know what adversaries may have already gained, but we should assume they have acquired sensitive intelligence and will use it to plan future operations.

Awareness 

On May 18 and 22, Brian Krebs published details of the CISA-Nightwing leak, triggering calls for congressional investigation. [1-3] Primary sources for Krebs’s reporting included researchers from GitGuardian, Truffle Security, and Seralys. [4-6]

The leak involved a ‘Private-CISA’ repository of AWS GovCloud keys on GitHub containing 844 MB of CISA/DHS credentials and files – cloud keys, AWS tokens, plaintext passwords, logs, certificates, and other sensitive assets. The repository had been exposed since November 2025. Six months later, some credentials were still valid.

The repository was maintained by Nightwing, a 2,200-person government contractor spun out of Raytheon (RTX) in a May 2025 leveraged buyout by BlackRock and Garland Capital Group.

Timeline: [5]

  • November 13, 2025 –  Private-CISA repository created on GitHub by Nightwing contractor
  • May 15, 2026 – Guillaume Valadon (GitGuardian) alerts KrebsonSecurity 
  • May 18, 2026 – Krebs publishes; repository taken offline; CISA acknowledges
  • May 20, 2026 – Truffle Security confirms GitHub App key still active
  • May 21, 2026 – GitHub App key revoked; other tokens remain active

Technical experts called this the “worst leak” they had seen, citing “poor security hygiene”, a ‘”catalogue of unsafe practices”, and generally lax internal practice. Selected findings:

  • GitHub commit logs show the CISA administrator (Nightwing) disabled the default GitHub setting that blocks users from publishing secrets in public repositories
  • The repository was used to synchronize files between a work machine and a home machine since November, using both a CISA-associated and a personal email address
  • The private-CISA repository contained easily-guessed passwords

Both houses of Congress have requested urgent classified briefings. As of June 4, CISA had not responded. CISA’s public statement that “there is no indication that any sensitive data was compromised” lacks supporting detail. Nightwing has issued no statement, referring inquiries to CISA.

Impact

Without disclosure of specifics, we can only speculate about potential damage. The exposure window is the starting point: from November 13, 2025 to May 21, 2026 – six months during which the repository provided a detailed view into CISA’s cloud infrastructure, deployment workflows, software supply-chain tooling, and internal operational practices. Exposed data included IAM credentials, Amazon RDS database passwords, Wiz FedRAMP API credentials, TLS private keys, backups, network topology and configurations, registry locations, and security group rules.

It is difficult to overstate the potential damage to CISA’s mission. Yet, despite losing 30% of its staff to budget cuts, CISA remains central to U.S. critical infrastructure protection through vital programs like the Joint Cyber Defense Collaborative (JCDC), and the KEV (Known and Exploited Vulnerabilities) Catalog. [8]

Attackers who archived the repository before it was taken offline possess a comprehensive map of CISA’s internal architecture along with valid credentials. They are pre-positioned for future operations with the knowledge to move laterally. While CISA and network administrators for impacted networks have or will revoke and reprovision affected credentials, the intelligence value of this leak to adversaries endures regardless.

Action

The title ‘instructive reckoning’ reflects the range of lessons this case raises. Four areas warrant executive and CISO attention.

Technical Complexity: Cloud adoption and the exponential growth of autonomous agents have made the attack surface effectively unmanageable by traditional means. Identity sprawl – human and non-human – and tool proliferation are defining characteristics of the current environment. AI-assisted coding is a leak accelerant. GitGuardian reports a 34% increase in secrets leaked on GitHub last year, bringing the total to nearly 29 million exposed credentials. Sixty-four percent of valid secrets identified in 2022 remain unrevoked in 2026, largely because organizations lack the governance capacity to manage them. Gartner and Forrester estimate that NHIs now exceed human identities by several orders of magnitude in large enterprises. [9-12]

Governance Complexity: When policies and compliance requirements are too complex, people take shortcuts. Most organizations are blind to their exposure from Shadow AI and identity sprawl. Compliance and DLP frameworks were built for a different threat environment. Check Point’s 2026 Cloud Security Report finds that while AI adoption is widespread, only 5% of organizations have the architectural capability to enforce AI security, and only 14% actively enforce and audit AI security policies. [13]

Verizon’s Data Breach Report quantifies the ‘Shadow AI’ problem, finding that 67% of employees use non-corporate accounts on their corporate devices to access AI platforms. Shadow AI access is now the third most common non-malicious insider action detected in their DLP service dataset, a fourfold increase from the previous year. In 766 confirmed data disclosure incidents, 60% were motivated by ‘convenience’ as opposed to maliciousness. Verizon finds that privileged access, convenience-driven policy violations, AI data leakage are growing insider-related risks that organizations must monitor closely. [7]

Operations Response Priorities: The foremost priority is recognizing the GRC failures in this case. At the most fundamental level, the incident represents clear non-compliance with NIST SP 800-53 Rev. 5 (applicable to CISA as a federal agency) and NIST SP 800-171 Rev. 3 (applicable to Nightwing as a federal contractor). [14, 15]

Specific control violations include: 

  • NIST SP 800-53 Rev. 5: IA-5(7) prohibiting plaintext credentials; AC-20 governing external system use; CM-6 covering configuration settings; AC-17 covering remote access
  • NIST SP 800-171 Rev. 3: Controls 3.1.20 and 3.1.21 requiring authorization before federal data is processed on external systems – directly violated by the work-to-home GitHub synchronization

As NIST SP 800-53 is foundational to GRC, these violations also carry implications for CMMC 2.0 Level 2, FedRAMP, SOC 2, and the NIST CSF.

Threat hunting is a second operational priority. A credential leak of this type – high-value attack surface, known credentials, known systems (AWS GovCloud, Kubernetes), and a defined exposure window (November 2025 through May 2026) – provides a concrete starting point. Hunters have specific indicators to work against rather than hypotheses to generate, and can structure investigations around credential use, persistence, and lateral movement. [16]

Executive Commitment: Effective security requires resources – skilled personnel, advanced tooling, and continuous training – at a level that only senior leadership can fund. Cyber threats now rank as the top business risk among U.S. blue-chip CEOs, according to a May 28 Wall Street Journal survey of 100 executives. [17] A June 2 WSJ report, citing Fortinet research, found that over the past 18 months approximately 80% of organizations experienced some form of insider-related data loss, at costs ranging from $1 million to $10 million, with nearly 20% reporting more than 20 incidents. [18, 19]

CISOs face formidable challenges: alongside the volume of cyberattacks, they must navigate an overabundance of security news – much of it redundant, vendor-driven, irrelevant, or even AI-generated slop. While there is no shortage of AI-cyber solutions for security operations teams, there is a real scarcity of tools that help CISOs anticipate executive questions, maintain situational awareness, and quickly generate defensible action plans.

Figure 1 shows a partial report generated by VectorBlack, ThreatShare.ai’s CISO Decision Intelligence system, for the CISA-Nightwing case on May 31, 2026. The report assigns a 60% CEO interest probability, cites five sources, and delivers an executive summary, impact assessment, and recommended course of action – representing the AIA framework in operational form.

Outlook 

The CISA-Nightwing case is one instance of a growing category: convenience-motivated insider leaks of human and non-human identities by third-party contractors. On May 14, CMI Management, a government contractor, acknowledged a leak of 70,000 sensitive U.S. Army files  – first reported in 2024 but still open as recently as May 2026. [20]

With Gartner and Forrester projecting that large enterprises will struggle to manage millions of NHIs, and Check Point reporting that AI production vastly outpaces AI visibility and governance, organizations should plan for material increases in training and tooling budgets calibrated to AI and hybrid cloud environments. [9, 13]

Four priorities are recommended now.

Security awareness training needs to reach all users – developers, administrators, executives, and end-users across all lines of business – and must be updated for contemporary environments including AI coding tools and cloud-native workflows. The CIS Security Controls offer a sound model, particularly Control 14 (Security Awareness and Skills Training). Verizon specifically recommends Controls 14.4 (data handling best practices) and 14.5 (causes of unintentional data exposure).

Secrets sprawl governance requires treating exposed credentials as a systemic challenge, rather than an incident response task. This requires enforcing clear ownership, adopting short-lived credentials, and extending security controls across the full software development lifecycle. Risk leaders are shifting from static GRC toward Continuous Controls Monitoring (CCM), including red team exercises and penetration testing services such as IBM’s ‘Red Teaming for FedRAMP’. [21]

NHI security platforms are an emerging but necessary investment category. Three tool categories merit evaluation:

  • Dedicated NHI Security Platforms: e.g.,  Entro Security, Veza (from ServiceNow)
  • Secrets Detection and Leak Prevention: e.g., GitGuardian (pre-commit scanning and policy enforcement), Truffle Security (TruffleHog — open source and enterprise secrets scanning), Aqua Security (full lifecycle secrets management)
  • External Exposure and Threat Intelligence: e.g.,  SpyCloud (dark web monitoring for credentials, exposures, service accounts)

AI governance must move from policy to enforcement. Check Point’s finding that only 5% of organizations can enforce AI security controls is less a technology gap, than a leadership priority gap. Tools exist and many more are emerging. The commitment to deploy and audit them is what most organizations lack.

NOTES: 

·      

·      

References

  1. KrebsOnSecurity – CISA Admin Leaked AWS GovCloud Keys on GitHub, 18-May-2026 | https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/#more-73607
  2. KrebsOnSecurity – Lawmakers Demand Answers as CISA Tries to Contain Data Leak, 22-May-2026 | https://krebsonsecurity.com/2026/05/lawmakers-demand-answers-as-cisa-tries-to-contain-data-leak/#more-73638
  3. CyberScoop – Senator Maggie Hassan Request to CISA, 19-May-2026 | https://cyberscoop.com/wp-content/uploads/sites/3/2026/05/2026-05-19-cisa-briefing-request-1.pdf
  4. GitGuardian – How We Got a CISA GitHub Leak Taken Down in Under a Day, 14-May-2026 | https://blog.gitguardian.com/how-we-got-a-cisa-github-leak-taken-down-in-26-hours/
  5. Truffle Security Co – CISA’s Leaked Admin GitHub Token Remained Live 2 Days After Krebs Reported It Leaked, Dylan Ayrey · May 22, 2026 | https://trufflesecurity.com/blog/cisa-leaked-admin-github-token-remained-live-2-days
  6. Seralys Information Security – https://seralys.com/
  7. Verizon – 2026 Data Breach Investigations Report  | https://www.verizon.com/business/resources/reports/dbir/?CMP=OOH_SMB_OTH_22222_MC_20200501_NA_NM20200079_00001
  8. Cybersecurity Dive – CISA’s Joint Cyber Defense Collaborative takes major personnel hit, 30-July-2025 |  https://www.cybersecuritydive.com/news/cisa-joint-cyber-defense-collaborative-contract-lapse/756231/
  9. CSO Online – Think agentic AI is hard to secure today? Just wait a few months, 3-Feb-2026 | https://www.csoonline.com/article/4123246/think-agentic-ai-is-hard-to-secure-today-just-wait-a-few-months.html
  10. CSO Online – AI Coding Is Fueling a Secrets-Sprawl Crisis Few CISOs Are Containing, 18-May-2026 | https://www.csoonline.com/article/4171954/ai-coding-is-fueling-a-secrets-sprawl-crisis-few-cisos-are-containing.html
  11. SC World – Non-Human Identities Are Outgrowing Your Governance Model, 29-May-2026  | https://www.scworld.com/analysis/non-human-identities-are-outgrowing-your-governance-model?
  12. SC World – Cheap AI has changed the economics of hacking, 29-May-2026 | https://www.scworld.com/perspective/cheap-ai-has-changed-the-economics-of-hacking?
  13. Check Point – 2026 Cloud Security Report: Why Traditional Network, Cloud, and Security Architecture Are Lagging Behind the AI Transformation, 26-May-2026 | https://blog.checkpoint.com/securing-the-cloud/2026-cloud-security-report-why-traditional-network-cloud-and-security-architecture-are-lagging-behind-the-ai-transformation/
  14. NIST SP 800-53 Rev. 5: csrc.nist.gov/pubs/sp/800/53/r5/upd1/final 
  15. NIST SP 800-171 Rev. 3 (May 2024): nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html
  16. SANS 2025 Threat Hunting Survey: Advancements in Threat Hunting Amid AI and Cloud Challenges, 13-March-2025   | https://www.sans.org/white-papers/sans-2025-threat-hunting-survey-advancements-threat-hunting-amid-ai-cloud-challenges
  17. The Wall Street Journal – Cyber Threats Top CEO Business Fears, 28-May-2026 | https://www.wsj.com/pro/cybersecurity/cyber-threats-top-ceo-business-fears-7141c6c9?st=izv58r
  18. The Wall Street Journal – Turncoat AI Agents Emerge as the New Inside Hackers, 2-June-2026  | https://www.wsj.com/pro/cybersecurity/turncoat-ai-agents-emerge-as-the-new-inside-hackers-b0021e11
  19. Fortinet – 2025 Insider Risk Report: The Hidden Cost of Everyday Actions, 16-Oct-2025 | https://www.fortinet.com/blog/industry-trends/insider-risk-report-the-hidden-cost-of-everyday-actions
  20. Military.com – Army Defense Contractor Leaked 70,000 Files Containing Sensitive Information, 14-May-2026 | https://www.military.com/70000-plus-army-files-claimed-to-contain-sensitive-information-leaked
  21. IBM – Red teaming redefined: How FedRAMP is raising US cybersecurity standards, 1-June-2026 | https://www.ibm.com/think/x-force/red-teaming-redefined-fedramp-raising-us-cybersecurity-standards

Leave a Comment

Your email address will not be published. Required fields are marked *

Pin It on Pinterest