Government
,
Industry Specific
Tightening Budgets and AI-Enabled Attacks Stretch State Cyber Defenses
State CISOs across the United States are feeling the strain as artificial intelligence, dwindling resources and expanding attack surfaces converge in an increasingly challenging threat environment, and many security fear they’re not prepared.
See Also: New Trend in Federal Cybersecurity: Streamlining Efficiency with a Holistic IT Approach eBook
Only 22% of CISOs were extremely or very confident that their state data is protected from cyberthreats. That’s a significant drop since 2022, when 48% were confident, according to the 2026 NASCIO-Deloitte Cybersecurity study.
The CISOs were even more pessimistic about local government and public higher education cybersecurity, with 63% saying they’re “not very confident” those organizations can protect public data – nearly double the 35% low confidence figure four years ago.
“There’s been substantive change in the last couple of years,” said Michael Wyatt, cyber principal, Deloitte, and a co-author of the study. “If you take AI-accelerated attacks, more sophisticated and higher-volume threats, add in third-party vendor risk and then layer in budget challenges – it all adds up. There’s good reason for that drop.”
Mirroring the private sector, states see the potential of AI is increase emerging threats and bolster their cyber defenses. All but one state are using or planning to use generative AI for cyber defense, but only 2% of state CISOs are “very confident” they can protect against AI-enabled attacks, down from 10% in 2024. And 47% are “not very confident” or “not confident at all” in defending against AI-enabled attacks, up from 41% in 2024.
“GenAI is accelerating both the sophistication and volume of cyberthreats, enabling adversaries to craft highly targeted phishing, automate exploitation and rapidly detect and exploit known vulnerabilities,” one state CISO told NASCIO. “At the same time, it offers state IT security teams powerful capabilities for real-time threat analysis, automation of routine tasks and faster incident response – provided it’s implemented with strong governance and risk controls.”
States making the most progress are embedding AI into security operations centers for triage, alert summarization and SIEM/SOAR enrichment, and pairing those deployments with a governance-first philosophy, Wyatt said. “If the adversaries have these tools, the defenders need tools as well.” So far, 23 states report using GenAI in security operations.
The report also highlights the risk posed by third-party vendors that turn on AI features inside existing software without notifying customers. “There needs to be clarity from the vendor community on exactly what AI capabilities are being enabled, and what sort of security and risk reviews have been done on that capability before it just gets turned on,” Wyatt said. “There also needs to be the ability for states to opt out.”
Third-party breaches are a top concern for 78% of states. Legacy infrastructure remains a major barrier, cited by 65% of CISOs and tied with the rising sophistication of threats.
In this changing landscape, the successful CISO still operates by a standard playbook, Wyatt said. They inventory legacy systems, rank by exposure and business criticality, triage the highest-risk systems, and resist lift-and-shift cloud migrations that “may be just moving the vulnerabilities from here to there rather than actually improving the risk posture.”
Budget challenges, meanwhile, are felt across the country. Only 22% of states say their budget is increasing by 6% or more this year, down from 40% in 2024. And 16% of CISOs say their budgets have been slashed. Two years ago, that number was zero.
There are multiple reasons for this funding dry spell. Pandemic-era federal relief has dried up and the Multi-State Information Sharing and Analysis Center (MS-ISAC) has shifted to paid membership, a move which has roughly halved state participation, Wyatt said.
In addition, the fate of the State and Local Cybersecurity Grant Program is in the hands of Congress, where its future remains unclear. That funding, while helpful, is “inadequate,” according to 40% of CISOs. Another 37% said increasing the amount of funding available through the program would be beneficial.
That funding pressure explains why “metrics to measure and report effectiveness” is the top cybersecurity initiative in 2026 for 49% of CISOs, up from 15% in 2022. They need to make the case to skeptical legislatures who often don’t understand the technologies at play. “More than once, I’ve heard CISOs ask the question, or get the question from the legislature: “Aren’t we done with this yet?” Wyatt said.
The states getting funding, he said, build a multi-year road map tied to budget, report against it annually, and frame outcomes in terms of mission continuity and dollar-loss avoidance rather than incidents blocked.
The evolving threat landscape and risk posed by unprotected networks is helping push states toward a whole-of-state cybersecurity model, extending services to counties, municipalities, K-12 districts and critical infrastructure operators.
Wyatt said Texas had created a whole-of-state approach others examine. “Texas Cyber Command doesn’t rely on any federal dollars. It’s all general appropriations at the state level,” he said. “Other states are certainly looking to and thinking about, okay, how are we going to meet the moment from a cyber investment perspective?”
The CISO role is also undergoing a transformation, and they’re becoming a strategic leadership partner. Every state CISO now offers strategy, governance and risk management services to state agencies, up from 81% in 2022. The share of CISOs overseeing emerging-technology adoption has nearly doubled since 2022, from 38% to 69%, and 76% are responsible for protecting against AI threats, while 67% own oversight of responsible AI use by public employees.
“The elevation of the CISO role is fantastic. They’re really becoming enterprise risk and governance leaders,” Wyatt said, adding that more state CISOs now come from CIO, CTO or other business backgrounds rather than purely technical ones. “The profile seems to be migrating to an expectation of business acumen, regulatory fluency, cross-functional understanding,” he said. “Then technical depth can be provided by other team members.”