A decade in the making, passed without a single objection
On June 8, 2026, the Knesset approved the National Cyber Defense Bill, 5786-2026, in its first reading with zero opposing votes — a rare feat of consensus for a bill that has been drafted, shelved, and redrafted for more than ten years (Jerusalem Post). Yossi Karadi, head of Israel's National Cyber Directorate (INCD), called it "a historic step," arguing that "the cyber threat is evolving at an extremely rapid pace and the State of Israel must ensure a uniform, professional level of protection based on the most advanced standards" (Jerusalem Post). The bill now moves to the Foreign Affairs and Defense Committee for the markup that will shape its second and third readings (Knesset legislation database).
The timing is not incidental. The bill advanced amid intensified cyberattacks tied to Israel's ongoing confrontation with Iran, and just weeks after State Comptroller Matanyahu Englman published an audit — covering February 2023 through June 2025 — that catalogued years of institutional drift: prime ministers convened dedicated cabinet discussions on cyber policy only once between 2018 and mid-2025, the government skipped national cyber drills for six years before October 7, 2023, and among 21 surveyed economic bodies, a third scored 60 or below on organizational readiness while 90.5% carried no cyber insurance at all (Jerusalem Post; State Comptroller of Israel). The INCD says it handled more than 26,000 serious incidents in 2025, a 55% jump from 2024, at an estimated annual cost to the economy of NIS 12 billion (Jerusalem Post).
What the bill actually does
Stripped of politics, the bill has three moving parts, per legal analysis of the text: mandatory defense thresholds and risk-management obligations, a duty to report significant cyberattacks in real time, and a supervision structure in which sector-specific units inside government ministries — communications, energy, healthcare, transportation, food supply, digital and hosting services — enforce compliance under the INCD's professional guidance (Gornitzky GNY). A "significant" attack is defined as one that disrupts or could disrupt a service's availability or reliability, compromises a major information asset, or risks spreading beyond the organization itself.
Enforcement has real teeth: administrative fines run up to NIS 640,000, doubling for repeat violations, with officers facing personal liability for supervisory failures, and criminal exposure — including up to two years' imprisonment — for refusing an emergency directive during a live attack (Gornitzky GNY; Pearl Cohen). The INCD's director can also compel an organization in writing to take urgent remedial action when a risk could enable a severe attack. Separately, Globes reported that the National Cyber Directorate had already ordered one vulnerable remote-work system decommissioned — yet 65% of government agencies kept using it for ten months before it was finally shut down in January 2025, exactly the kind of enforcement gap the bill is designed to close (Globes).
The case for mandatory rules — steelmanned
Critics of light-touch cybersecurity regimes have a genuinely strong argument here, and it is worth stating plainly: voluntary standards failed Israel for a decade. A comptroller's audit found ministries running exposed digital tools for months, a foreign ministry that hadn't updated its cybersecurity policy since 2018 despite a 500% spike in incidents during the Gaza conflict, and a national identity system connected to just 16% of mapped government services (Globes). Critical infrastructure — water, energy, hospitals — creates negative externalities when it is breached; a hospital's ransomware failure or a utility's outage doesn't stay contained to the negligent operator, it cascades to the public. In a market where 90.5% of surveyed economic bodies carry no cyber insurance, the private incentive to invest in defense is plainly too weak relative to the social cost of failure. A baseline floor, transparently set and centrally coordinated by one directorate rather than fragmented across ministries, is a defensible response to a genuine market failure — and Israel's wartime threat environment raises the stakes further.
Why proportionality still matters
That argument earns the bill its unanimous vote, but it doesn't excuse away the risks in execution. The bill leaves "essential organization" status to be defined by "the nature of the organization's activities, the scope of its operations, and the significance of the services it offers" rather than a fixed, published list — a flexibility that protects against under-inclusion but also invites scope creep as ministries expand coverage without new legislative scrutiny (Gornitzky GNY). Real-time reporting duties are sound policy, but paired with fines that double on repeat violations and personal criminal liability for officers, they risk pushing smaller essential-service providers — water utilities and regional hospitals rarely have general counsel on retainer — toward over-reporting or shadow compliance rather than genuine security investment. And a supervision model split across sectoral units in different ministries, "coordinated" by the INCD but not commanded by it, is the same fragmented structure the comptroller's audit just spent 100-plus pages criticizing; consolidating authority on paper without consolidating it in practice would just relocate the accountability gap rather than close it.
None of this argues against the bill — a mandatory floor beats a voluntary one that a State Comptroller has now twice documented as inadequate. But the second and third readings are where the Foreign Affairs and Defense Committee should narrow "essential organization" to something Knesset members actually vote on again if it expands, and where lawmakers should test whether INCD's "professional guidance" comes with the authority to override a ministry unit that's dragging its feet — the way one apparently did for ten months on a flagged remote-work vulnerability. A law this consequential, passed this unanimously, deserves scrutiny proportional to its power, not just its popularity.