Why Cyber Resilience Must Be A Local Priority

Forbes

23-07-2025

Dara Warn is the CEO of INE, a global leader in enterprise cybersecurity training and certifications.
The volume of cyberattacks on state and local governments is growing louder, and the stakes couldn't be higher for our communities. Consider the direct impact: In March, Union County, Pennsylvania, saw sensitive personal information of thousands of residents exposed by ransomware, and in February, a cyberattack in Mission, Texas, disrupted police operations.
Spring brought a surge of cyberattacks targeting local government agencies across the country, with new incidents reported from coast to coast. The growing frequency and geographic spread of these breaches underscore just how widespread and urgent the threat has become.
These aren't isolated incidents. They are unmistakable symptoms of a pervasive crisis that erodes public confidence and directly compromises the very essence of safety and security within our communities. The time for robust, collaborative cybersecurity measures is now.
My time in cybersecurity has revealed a troubling reality. We've seen massive investments in cyber defenses from corporations and federal entities. Yet, it's our state and local governments—the foundational pillars of our communities, touching everyone's lives—that have emerged as increasingly vulnerable points in our nation's digital fabric. This escalating risk isn't merely a technological hurdle—it's a profound challenge to the security and resilience of the places we call home.
The Perfect Storm Of Vulnerability
Local governments have a unique set of factors that make them irresistible to cybercriminals. They possess incredibly valuable data: Social Security numbers, financial records, health information and critical infrastructure access. Yet they often operate with constrained budgets, aging systems and limited cybersecurity expertise.
Malware attacks involving remote access trojans against state and local governments increased by 148%, while "ransomware incidents were 51% more prominent during the first eight months of 2023 than they were during the same period a year earlier," according to the Center for Internet Security.
What makes these emerging threats particularly severe is their direct assault on the critical infrastructure and services that underpin public safety. The potential consequences are immediate and far-reaching:
• A cyber compromise of emergency dispatch systems could directly result in delayed responses.
• Exploiting industrial Internet of Things (IoT) vulnerabilities in water treatment facilities would place public health systems in jeopardy.
• The disruption of essential government services would leave citizens without vital access.
These attacks represent more than financial loss—they directly threaten the basic services communities depend on for safety and well-being.
The Economic Reality
Adding to the escalating threat landscape, a recent shift in federal cybersecurity policy has placed the onus squarely on state and local governments. Proposed 2026 budget cuts eliminate hundreds of positions at the Cybersecurity and Infrastructure Security Agency and reduce funding for cyber defense and education training. This reduction in federal support, coupled with increasing regulatory requirements, has created a widening resource gap that many of our jurisdictions are already struggling to bridge.
Budget constraints compound this challenge. When economic uncertainties reduce revenues, cybersecurity training programs—the very investments most crucial at such times—are often the first to be cut. Yet, the financial impact of a successful cyberattack on a small municipality can be devastating.
While the average cost of ransomware recovery in 2024 stood at $2.73 million (even before factoring in ransom payments), a sum that might be manageable for a Fortune 500 company could force a small town into financial crisis.
Supporting Our Cybersecurity Professionals
The vital backbone of local government essential services rests on the shoulders of IT and information security professionals. They work to keep systems operational, networks secure and ensure regulatory compliance. They represent the primary defense against increasingly sophisticated cyber threats. Their critical work encompasses keeping systems operational, fortifying networks and upholding regulatory compliance. Against a backdrop of increasingly sophisticated cyber threats, they stand as our foremost line of defense.
There are encouraging signs that state and local government leaders are beginning to recognize the importance of a robust cybersecurity framework. According to a 2024 survey by the Public Technology Institute, 72% of local government IT officials claim their budgets are adequate to address current cybersecurity threats, up from 64% the previous year. Additionally, 67% of local governments reported having a dedicated cybersecurity leadership role in 2024, compared to just 52% in the previous year.
Still, significant challenges remain. Research shows that the top three barriers to effectively defending against cybercrime are the inability to pay competitive salaries to cybersecurity employees (58.6%), an insufficient number of cybersecurity staff (53.1%) and a lack of funds (52.8%). These are all budget-related constraints that many local governments continue to face.
A Path Forward: Strategic Investment In Training
Addressing the cyber challenge demands a strategic, proactive approach to cybersecurity readiness. For local governments, this means recognizing that cybersecurity training for your IT and technical staff is a critical investment in community infrastructure, just as essential as maintaining our roads, bridges or vital water systems.
Effective cybersecurity requires comprehensive, ongoing training that constantly evolves with the threat landscape. This urgency is underscored by Verizon's "2024 Data Breach Investigations Report", which reveals that the human element is the common root cause of 68% of data breaches. This training must be deeply technical, highly engaging and continually updated to ensure defense strategies adapt as rapidly as new cyber threats emerge. Your technical teams, who are the frontline guardians of your community's digital infrastructure, need constant access to up-to-date, practical, hands-on training that prepares them for real-world scenarios.
Taking Action
Proactive local government leadership takes a tactical stance on cybersecurity readiness. Local government and business leaders should consider conducting comprehensive cybersecurity assessments to understand their current readiness. These assessments should inform strategic planning and budget allocation for the coming fiscal year. For jurisdictions where cybersecurity training has not yet been a top priority, the escalating threat landscape against local governments makes this a critical investment to prioritize now.
Cybersecurity is fundamentally about service delivery and public trust. Those who invest in their cybersecurity capabilities demonstrate a commitment to protecting the communities they serve and maintaining the essential services citizens depend on every day.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?