Such ties might be useful when it comes to cyberthreats targeting complex sector-specific technology, such as the machines that operate dams, energy grids and some manufacturing, Krebs said. But when it comes to the commercial IT that is the target of most cyberattacks, CISA should take the lead, he said.