Shields Up had no end date, so vigilance needed a staffing plan
When Russia invaded Ukraine, CISA asked every US organization to raise its guard, with no date to lower it. Sustaining a heightened posture for months was a management problem: who watches, who decides, and what work stops to pay for it.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On February 24, 2022, Russia launched a full-scale invasion of Ukraine. The day before, security researchers reported a new destructive malware, later called HermeticWiper, on systems at organizations in Ukraine. On the morning of the invasion, an attack on a satellite communications network disrupted service for users in Ukraine and elsewhere in Europe. In the United States, CISA had begun that month to promote its Shields Up guidance, which told every organization, large and small, to prepare for disruptive cyber activity. It urged lower thresholds for reporting, confirmed backups and logging, patching of known exploited vulnerabilities, and current incident response contacts. On February 26, CISA and the FBI issued a joint advisory on the destructive malware seen in Ukraine. The United States and its allies announced sweeping financial sanctions, raising concern about retaliatory cyber activity against Western targets.
Few security leaders disagreed with anything in Shields Up. The guidance was sensible, specific and free. The difficulty was its duration. A heightened posture for a long weekend is an inconvenience. A heightened posture with no end date is a change to how a team works, imposed on teams that were already short of staff after Log4Shell and the Omicron surge. The guidance said what to raise. It could not say what to lower in exchange, and that decision fell to each organization’s leaders. We look at the posture through three operational questions: who watches, who decides, and how long it can last.
Who watches
Heightened monitoring means more alerts, reviewed more carefully, with lower thresholds for suspicion. That work lands on whoever reviews alerts: an internal security operations center, a managed detection provider, or an IT team doing security alongside everything else.
Each model faced a different version of the problem. Internal teams had to choose between extended shifts, added on-call coverage, deferred projects and outside help. Organizations using a managed provider had to find out what heightened monitoring meant under their contract. Would the provider deploy new detections for the threats in the advisories, escalate at a lower threshold, or charge for extra effort? Many contracts were silent. Small agencies, community banks and rural clinics, with no dedicated security staff, often had the least capacity and the least clarity about what to change.
The way through was to turn advisories into a short list of concrete changes. Examples included specific detections deployed, specific logs confirmed, and named external services checked for exposure. A list with owners can be completed and verified. A general instruction to be vigilant cannot.
Organizations without their own analysts had another option: borrowing judgment from shared bodies. Sector information sharing groups, state cybersecurity offices and CISA’s regional staff published indicators and short guidance through the period. A community bank or county that subscribed to those feeds, and named one person to read them daily and decide what applied, got much of the benefit of a threat intelligence team at little cost. The trade-off was dependence on someone else’s prioritization, which suited routine changes better than unusual ones.
Who decides
A lower reporting threshold sends more events upward. CISA asked organizations to report anomalous activity promptly, which requires criteria for what is reported, who decides and who makes the report. A heightened posture also raises the odds of a decision that cannot wait, such as disconnecting a partner connection, isolating a network segment or shutting down an exposed service.
Escalation paths that work during business hours often fail at 2 a.m. on a Sunday. During a sustained posture, that gap matters more than usual. On-call rotations need to include someone with authority to take disruptive action, not only someone who can describe the problem. Contact lists for executives, vendors, insurers, outside counsel and authorities need to be current, and many organizations found theirs were not. Agreeing in advance which actions the on-call lead may take alone, and which need an executive, keeps the first hour from being spent finding a decision-maker.
Decision rights also extend to vendors. Managed service providers and hosting companies may need to act on the organization’s behalf. Contracts that require their approval for emergency changes, or that leave the customer unable to reach a decision-maker at the provider, slow the response.
How long it can last
A team can run hot for a few weeks. Over months, attention fades, errors rise and people leave. Security staff were already scarce in early 2022, and burnout was a real risk. A heightened posture that relied on goodwill would erode quietly, without anyone deciding to lower it.
Sustaining it meant turning temporary measures into normal operations. New detections could be added to standard monitoring rules instead of being handled by manual review. Lower reporting thresholds could be written into procedures. Extra on-call coverage could be rotated fairly and paired with protected time off. Most important, leaders had to say what the team should stop doing. Project work that added resilience moved up. Lower-value work, such as cosmetic tool migrations, discretionary reporting and some audits, could wait. A posture that only adds tasks is a posture that will fail.
Rotation needs the same care. Concentrating heightened duties on the two or three most experienced analysts is tempting, because they work fastest. It is also the quickest route to losing them. Pairing senior staff with junior ones on each shift spreads the load and builds depth for the next period of alert.
Measurement shows whether it is holding. A handful of weekly indicators is enough: median alert review time, number of escalations, completion of patches for known exploited vulnerabilities, backup test results and on-call hours per person. Leaders who watched those numbers could adjust staffing before fatigue turned into missed alerts. Those who relied on general reassurance from busy teams had little warning.
The specific risks differed by sector. Banks faced possible retaliation linked to sanctions. Health systems worried about disruption to clinical services. Public agencies considered threats to public services and election infrastructure. The operating problem was the same everywhere: finite people asked to stay alert for an unknown period.
With hindsight
The large-scale retaliatory attacks on US organizations that many feared in February 2022 did not come. Destructive attacks stayed concentrated on Ukraine. Western organizations faced hacktivist denial-of-service campaigns, continuing criminal ransomware and persistent espionage. Shields Up remained a standing CISA message, so in effect the heightened posture became the normal one. The strain on security teams was real, and industry surveys in following years repeatedly reported high stress and turnover, though their methods varied. Later geopolitical flashpoints, including the conflict in the Middle East from October 2023, produced fresh rounds of advisories and heightened alerts. By this point in 2026, the better-run security operations treat such periods as recurring events with prepared playbooks: a standard list of changes, defined decision rights and an explicit list of work that pauses. The capacity question that Shields Up raised now gets answered in advance.