Preparing state CIOs for the future of cyber and AI defense

The White House’s Achieving Efficiency Through State and Local Preparedness executive order marks a major shift in responsibility by expanding states’ cybersecurity obligations. Building on this momentum, the newly released Artificial Intelligence Action Plan requires states to reevaluate their AI regulations if they want to remain eligible for federal funding. 

Together, these mandates create an opportunity for state governments to expand their impact and leadership. With the right guidance, enhanced authorities and financial support, states are well-positioned to succeed and deliver meaningful results.

States play a pivotal role in safeguarding the critical infrastructure that keeps our nation running — power grids, water systems, emergency services and more. As these systems become increasingly attractive targets for adversaries, state chief information officers, chief information security officers and governors are taking on greater responsibilities. 

To meet this challenge, they must act quickly and strategically, and leverage the knowledge they already have at their disposal. Early actions, including strengthening cyber defenses, prioritizing risk assessments, and coordinating with federal partners, lay the groundwork for long-term success, even as additional guidance, authorities and funding are secured.

Adversaries aren’t waiting for states to implement comprehensive cybersecurity and incident response plans. Gaps in protocols for threat detection, breach response, and cross-agency coordination leave critical infrastructure vulnerable. The question is no longer if a breach will occur, but when?

The true measure of resilience will be how quickly and effectively states respond: containing the attack, sustaining operations, and recovering quickly. To thrive in this new reality, state leaders must define their cybersecurity responsibilities, prioritize critical assets, adopt whole-of-state approaches, and establish necessary AI protections.

Defining Responsibilities and Protecting the Essentials

To effectively address these challenges, states must begin by drawing clear lines of responsibility. That means pressing the federal government for explicit guidance on roles, authorities, and available funding, while internally conducting gap analyses to determine where federal coverage is ending and where new state obligations begin. Once responsibilities are understood, leaders must immediately prioritize and develop a plan of action.

Most states have limited budgets and staff for cyber functions; not every system can be defended equally. Trying to spread resources too thin will only increase exposure. Instead, states should focus first on the most critical systems while adopting an “assume breach” mindset.

An “assume breach” mindset accepts that breaches are inevitable and shifts the focus from trying to prevent every breach to minimizing the impact through security measures, protocols, and tools designed as if an attacker is already inside the network. 

From there, states can begin identifying their pain points and mapping operations, including what systems would create the greatest disruption if taken offline, where current defenses are weakest, and what resources exist to close those gaps. Recent research found that when a ransomware attack hits, 47% of organizations paid the ransom, simply because they couldn’t afford downtime.

Adopting an “assume breach” mindset and building internal defenses doesn’t require an immediate, large-scale overhaul. The key is to look at responsibilities and determine which tasks can realistically be tackled first. Next, conduct a targeted review to identify vulnerabilities. Then, prioritize these vulnerabilities based on the most urgent needs and current capabilities. 

Other incremental steps include tightening controls around crown-jewel systems, building better detection for unusual activity, and practicing faster response protocols. Each step increases resilience. The goal isn’t perfection, but ensuring that when attacks happen, critical services remain operational, and citizens don’t feel the impact.

Breaking Down Silos to Build Whole-of-State Strength

Even the most well-funded states cannot meet these responsibilities in isolation. Simply pushing responsibilities down without coordination only multiplies the risks. That is why a whole-of-state approach is essential. 

Rather than leaving states and municipalities to operate independently, collaboration ensures comprehensive coverage. By sharing resources, standardizing services, and coordinating responses, local governments gain access to tools and expertise they could not otherwise afford. This collective effort strengthens trust and resilience across the state.

Cyber events rarely stop at state borders, and one state’s compromise can ripple across a region. A successful attack on Texas’s energy infrastructure, for example, could cascade far beyond its borders, impacting fuel and heating across neighboring states. Pooling resources, sharing intelligence, understanding priorities, and aligning strategies can turn limited budgets into a force multiplier.

The State and Local Cybersecurity Grant Program has also been instrumental in helping states build cybersecurity plans and deliver shared services. As the program's future remains uncertain, leaders cannot wait to act. They must have a plan in place that sustains these collaboration efforts.

Bring AI Into the Security Fold

The AI Action Plan also prioritizes AI security for state leaders. To remain eligible for funding, leaders must inventory where AI is already embedded across government services and establish safeguards for transparency, accountability, and security. AI systems should be treated no differently than other critical assets. They must be integrated into the broader cybersecurity posture and subject to the same risk assessments and protections.

This is not only about reducing risk but also about ensuring that states don’t lose out on crucial federal resources. Acting now on AI governance gives states a chance to get ahead of potential vulnerabilities rather than reacting after adversaries or compliance failures expose them.

Proactive Leadership is Needed

While states wait for additional support and guidance, they must act. By creating a plan and making smart, upfront decisions about cybersecurity and AI protections, states can avoid breaches that spiral into disasters, prevent costly operational downtime, and strengthen long-term resilience. 

Every dollar spent on proactive measures today translates into efficiency gains tomorrow, reduced recovery costs, and minimized disruption. Investing early isn’t just about security; it’s about ensuring government operations run smoothly and resources are used wisely.

Gary Barlet is the public sector chief technology officer at Illumio, where he works with government agencies, contractors and the broader ecosystem to incorporate zero trust segmentation, or microsegmentation, as a strategic enabler of zero trust architecture.