Dataminr 2026 U.S. Midterm Election Security Checklist

Why the 2026 U.S. Midterms Demand a Fresh Look at Security

While turnout for midterm elections typically runs lower than in presidential years, the threat environment has evolved significantly since 2024. The most acute risks are no longer centered on direct attacks on voting infrastructure. Instead, sophisticated actors are targeting the information ecosystem around elections — spreading mis- and disinformation, registering thousands of election-themed domains to power phishing and impersonation campaigns, and harvesting credentials from political fundraising platforms at scale

At the same time, reduced federal support for election security means that both public agencies and private organizations must take more ownership of their own preparedness. Organizations with assets near polling locations, voter data in their custody, or critical infrastructure that could be disrupted during the election window face real exposure and need to be ready before November.

This checklist provides a practical framework for security leaders at public and private organizations to assess and strengthen their election security posture across both physical and cyber domains.

Best Practices for the 2026 Election Cycle

The following best practices come from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Dataminr. 

Build Connections—and Reinforce Them

To increase vigilance and accelerate response time, establish relationships with both public and private organizations including businesses surrounding election facilities (polling places, election offices and warehouses) and local authorities, first responders and emergency management teams. It’s also important to connect with community leaders and organizations.

Pro tip: If you need support, contact your local CISA Protective Security Advisor (PSA)—a security subject matter expert that can assist in securing critical infrastructure operations.

Plan for Physical Security Incidents

As with any large-scale event, ensure you have a well-established plan that outlines how you will respond to physical security incidents. This calls for maintaining situational awareness, applying any lessons learned from past events, and taking into account key factors such as traffic flows and evacuation routes.

Note that stadiums, convention centers and other large-scale sites do not have the same protections as government sites. Security teams can leverage CISA resources for recommendations on how to secure such facilities. For organizations with facilities near polling locations or election offices:

• Establish a well-defined response plan for physical security incidents, including traffic flows and evacuation routes.
• Apply lessons from past large-scale events to your election-period planning. Refer to CISA resources for securing public gatherings.
• Ensure security staff understand the heightened sensitivity of the period after Election Day, when official results are still being tabulated.

Conduct Rigorous Credential Management

Ensure your credentials are updated and you have implemented multi-factor authentication (MFA) to protect voter data and prevent unauthorized access. Don’t forget to check that passwords used for systems handling election information are strong and unique.

Monitor criminal markets and breach repositories for organizational credentials that may surface as election season approaches. Audit third-party vendor access to election-adjacent systems, as concentration risk in the vendor ecosystem can create cascading exposure.

Implement Network Segmentation

Don’t overlook this critical cyber defense strategy. By dividing a network into distinct sections, organizations create virtual barriers against potential threats. Use this approach to ensure that if one segment of the network is compromised, other critical systems are not affected—and limit lateral movement within the network.

Ensure that systems handling voter data, donor records, or election operations are isolated from general enterprise networks. Apply zero-trust principles: enforce the rule that users access only the systems they explicitly need, only when they need them.

Fortify Against Phishing and Domain Spoofing

Check Point’s 2026 U.S. Midterm Election Threat Outlook finds that the highest-probability threats this cycle are focused on phishing, brand impersonation, credential theft, and domain abuse.  New registered domains are used for phishing pages impersonating voter information portals, fraudulent donation collection, candidate impersonation, and deceptive content designed to look like official election communications.

Steps to take:

• Implement rigorous email security
• Monitor for look-alike domains impersonating your organization, election authorities, or trusted news outlets
• Brief employees on the elevated phishing risk during election season
• Apply the same scrutiny to text and social media-based lures, not just email

Guard Against AI-Enabled Influence Operations

A new and material risk for the 2026 cycle is the use of AI to create large-scale content designed to erode trust in institutions and election outcomes. The goal is to make fabricated political content appear to come from a trusted source, then distribute it at speed before verification can catch up.

Steps to take:

• Establish a process for quickly identifying and reporting impersonation of your organization’s brand or domain
• Ensure your communications team and security team are coordinated on how to respond if your brand is spoofed in an election-related false narrative
• Train employees to verify the authenticity of any media content referencing your organization before sharing or acting on it

Establish AI-Augmented Baseline Monitoring

The scale of election-period threat activity demands monitoring capabilities that go beyond manual review. Establish a baseline of normal network activity so that you can identify anomalies that might indicate a cybersecurity threat. This proactive approach allows for early detection of potential issues, enabling a swift response to mitigate risks and helping to protect election systems from unauthorized access and potential compromises.

Maintain coverage in the days after Election Day—the period before official results are certified is historically when disruption attempts peak. Ensure your cyber and physical security teams share a common operating picture throughout the election window.

Critical Election Security Questions to Assess Your Readiness

Use the following questions to evaluate your organization’s preparedness for the 2026 U.S. midterm elections:

Physical and Situational Awareness

1. Do we have assets at or near polling stations? If so, are we able to surface and act on physical security events as they emerge and unfold in real time?

2. Do we have real-time visibility into physical security events occurring at or near election locations across the country at both the national and local level?

3. Do we know the proximity of our facilities to locations that have historically experienced election-related incidents?

4. Do we have a communication plan to keep employees informed about potential security risks during the election period and in the days that follow before official results are certified?

Cyber

5. Are we able to detect voter data breaches or unauthorized access to election-sensitive systems in real time?

6. Have we assessed our exposure to credential theft from election-season phishing campaigns — including any organizational accounts linked to political donation or campaign-adjacent platforms?

7. Are we monitoring for newly registered domains that impersonate our brand, our partners, or the election infrastructure our operations depend on?

8. In the event that threat actors launch infrastructure-disrupting cyber attacks, do we have a response plan for outages and disruptions?

Cross-Functional Readiness

9. Are our cyber and physical security teams working in lockstep to identify potential cyber-physical risk?

10. Have we identified critical suppliers, third-party providers, and potential concentration risks that could affect operations if a disruption occurs?

11. Have we considered establishing a cross-functional group of leaders to scenario-plan for election risks specific to our sector and geography?

12. Do we have the coverage needed to maintain situational awareness in the days after Election Day, across both physical and digital domains, before official results have been finalized?