Here’s who is getting paid at DHS and who isn’t

Nearly 92% of DHS’s ~272,000 employees are working during the partial government shutdown that began Feb. 14, but many — including FEMA, civilian Coast Guard and CISA staff — remain unpaid. President Trump ordered back pay for TSA, and roughly 61,000 TSA employees began receiving missed wages; DHS is funding some paychecks using funds from the administration’s $165 billion domestic package (including $75B for ICE and $64B for CBP) and appears to be drawing on a ~$10B pot. The situation remains unresolved with no end in sight as lawmakers are in recess, creating continued uncertainty for affected federal workers and related operational readiness.

Analysis

The selective preservation of payrolls for politically prioritized missions creates a bifurcated DHS workforce: mission-critical law‑enforcement and border functions remain resourced while back-office, cyber, disaster-response and civilian teams face elevated churn and deferred projects. Expect attrition and contractor flight in unpaid units — a 5–10% hit to available specialized staff (cyber, legal, IT contractors) is plausible inside 30 days — which raises latent operational risk that is not priced into adjacent markets.

Operationally this increases near‑term tail risk for both cyber and physical continuity: reduced patching cadence and delayed vendor integrations raise the probability of a materially disruptive cyber incident, while understaffed civilian units (port liaisons, FEMA prepositioning, Coast Guard civilian planners) make logistics bottlenecks and event security failures likelier around high‑visibility deadlines. A single material incident would trigger emergency appropriations and reprogramming within days, producing an asymmetric snap re‑rating for homeland contractors.

From a budget/catalyst standpoint, the window for a political resolution is the dominant short‑term driver (days–weeks). If funding remains unresolved beyond 4–8 weeks, the more durable second‑order outcomes emerge: accelerated outsourcing to private integrators, permanent hiring freezes for civil roles, and multi‑year reallocation of discretionary DHS tech spend toward border/security programs. Conversely, a quick stopgap deal would compress upside for contractors and calm operational risk immediately.

Investment implication: favor government‑facing defense and security integrators with flexible delivery models that can capture emergency reprogramming dollars (6–12 month horizon), and overweight enterprise cybersecurity vendors that sell persistent SaaS/EDR footprints (3–9 months). Hedge with short exposure to economically sensitive, travel‑dependent names that reprice quickly on security disruptions; position sizing should assume a >10% probability of a material event within 3 months that would widen spreads quickly.

Key Decisions for Investors

• Long Leidos (LDOS) — 6–12 month horizon. Buy on <5% pullback from current levels; target +25–35% if Congress passes emergency appropriations or DHS reprioritizes contracts, stop -12%. Rationale: capture reprogramming dollars and short‑notice systems integration work.
• Long Booz Allen Hamilton (BAH) or ManTech (MANT) — 6–12 months. Use 9–12 month call spreads if you prefer defined risk. Expect outsized win rates on rapid task orders for cyber, border tech and emergency logistics; downside is muted if shutdown resolves quickly.
• Long enterprise cybersecurity (CrowdStrike CRWD or Palo Alto PANW) — 3–9 months. Buy shares or 9–12 month LEAP calls; target 20–40% upside if CISA/agency contract acceleration occurs post‑incident, stop -15%. Rationale: higher near‑term demand for managed detection and rapid incident response as understaffing raises vulnerability.
• Pair trade: Long LDOS + Short UAL (or LUV) — 3–6 months. Size net delta modestly (e.g., 1:0.5) to profit from a security‑related shock that rerates homeland contractors higher and travel stocks lower. Risk: quick political resolution removes catalyst; reward: asymmetric if a disruptive event forces emergency funding.