US States Secure Midterm Vote Themselves After Federal Election Security Cuts

According to Axios, AI makes it easier for attackers to find software vulnerabilities, launch cyberattacks and spread disinformation meant to undermine trust in results. Officials are also preparing for physical threats, logistical problems and legal challenges. The report notes that a security flaw does not automatically let anyone change results, because nearly all US elections keep paper records that can be used to check electronic counts.

What Washington Scaled Back

The Cybersecurity and Infrastructure Security Agency (CISA) cut election security staff and services in 2025, and federal funding for the Elections Infrastructure Information Sharing and Analysis Center, a key network for sharing threat information among election officials, ended that year. Axios reports that officials are getting fewer election-specific threat briefings and less direct technical help, even after CISA set out plans in September to restore some services.

A CISA spokesperson said in a statement that the agency will provide state and local officials, including election officials and vendors, with "no-cost voluntary services" such as vulnerability scanning and technical expertise when they ask for them.

How States Are Filling The Gap

John Milhofer, a spokesperson for the National Association of Secretaries of State, told Axios that states prepared using homeland security agencies, fusion centres, police, National Guard units and private cybersecurity firms. His group and the National Association of State Election Directors are helping states share threat intelligence and connect with federal agencies and private experts.

Arizona shows what this looks like in practice. Michael Moore, chief information security officer for the Arizona secretary of state's office, said the state has had no dedicated CISA cybersecurity adviser since March 2025. The Arizona Department of Homeland Security has stepped in with security tools and monitoring for smaller counties. On Election Day, Moore said, the state's cybersecurity team, the National Guard, the FBI and a representative from CISA's Region 9 office will work together on responses to threats.

Moore's team has spent years running tabletop exercises on cyberattacks, AI-generated impersonations of election officials and suspicious packages. Arizona also gets threat intelligence from former CISA staff, election security nonprofits and other states. Moore said New Jersey is especially useful because officials there can warn him of threats hours before they reach Arizona.

Moore said he wants CISA restored to its 2024 staffing levels and then doubled. "If we are literally experiencing a cyberattack from a nation-state, it shouldn't be Arizona versus that nation-state," he said.

David Becker, executive director of the Center for Election Innovation and Research, said states have hired vendors and built their own networks but cannot replace everything. "They're not going to get the same bird's-eye national-level view of potential disinformation or potential cyber events," he said.

Why It Matters

The midterms are the first major US election in which generative AI is widely available to attackers and propagandists. Responsibility for defending the vote has also moved from federal agencies to a patchwork of states, vendors and informal networks. For security vendors, that means more work from state and county governments. For policymakers elsewhere, it is a test of whether decentralised defences can hold up against coordinated, AI-assisted threats. Moore described the aim as limiting damage rather than avoiding it entirely: "We're going to have some amount of disruption.... We're going to recover."