Rethinking how state and local cyber teams are built and supported

Across every level of government, teams are battling a surge of cyberattacks, including ransomware, data breaches and operational disruptions, all of which are detrimental to public agencies and missions. 

Data on last year from Unit 42 revealed an astonishing 86% of such incidents involve operational disruption, ranging from lengthy service outages to lasting reputational damage. In other words, these incidents have real-world consequences; when a school, hospital, or local government office is disrupted, citizens feel the effects.

But many state and local governments are fighting these battles with one hand tied behind their backs. Budgets are tight, legacy technology is prominent, and competition for cyber talent is fierce. 

To stay ahead, the conversation must move beyond identifying the “cyber talent gap” and instead focus on addressing how we build, support and empower teams and leverage technology to defend critical public infrastructure.

Breaking the Mold: Expanding the Cyber Talent Pipeline

Traditional employment criteria like four-year degrees and prior government experience are shrinking the talent pool at the exact moment we need to expand it. When so many agencies compete for the same small group of cyber professionals, costs rise, progress stalls and risks grow.

Forward-thinking organizations are broadening the funnel, recruiting veterans, mid-career professionals seeking a new purpose, community college graduates, and candidates with adjacent technical or analytical skills. Skills-based hiring is no longer just a buzzword, it’s a necessity.

Community colleges, technical schools and government agencies can help lead this shift. Delivering hands-on curriculum, inclusive lab access, and role-based certifications, programs equip students with practical skills for public sector careers. Digital learning and instructor-led training options are designed to meet learners where they are, whether they’re just starting out or upskilling mid-career.

This approach reflects a larger shift toward hiring for capability and potential, not just pedigree. As Office of Personnel Management Director Scott Kupor recently put it, “We have a real, acute shortage of people who have what I would call very cutting-edge, modern tech skills.” The numbers back him up, according to the Pew Research Center, fewer than 9% of the federal workforce is under 30, compared to nearly 23% of the overall U.S. workforce. Kupor and others are right to push for skills-based hiring. We should test candidates for what they can do, not just where they’ve been.

Best Practices for Building Robust Pipelines

Community colleges and technical schools have already emerged as vital partners in delivering targeted training directly to public sector placements. Additional public-private collaborations, including workforce-ready cybersecurity academies, are also providing students with the tools and hands-on experience needed to hit the ground running.

You don’t have to look far for examples. In the Washington, D.C. region, the Office of the Chief Technology Officer and the Office of the State Superintendent of Education recently brought more than 50 Advanced Technical Center students together to explore real-world opportunities in public service tech. Likewise, Virginia’s CyberSlam 2025 event convened nearly 500 high school students at George Mason University for hands-on activities and industry insights.

Alongside new recruitment, successful agencies are investing in their existing staff and encouraging cross-training, mentorship, and continual learning. By upskilling IT professionals to tackle cyber challenges, organizations both fill immediate gaps and boost retention by making employees feel valued.

But this only works if we foster a collaborative, mission-driven culture. Every agency leader has a role in making security a priority across departments. When mission, recognition, and resilience become part of an agency’s DNA, teams are ready to rise to the challenge together.

Empowering Small Teams with Smart Technology

Most agencies will never have the cyber headcount of a Fortune 500 company (they can’t hire enough talent either), but that doesn’t mean they can’t punch above their weight. Technology is the force multiplier. With investments in automation and AI, small teams can expedite routine monitoring and response times while freeing up talent to focus on the toughest problems.

Those platforms can help agencies automate threat detection and incident response, and in doing so, reduce the burden on limited staff, improving mean time to remediation and enabling teams to focus on what matters most. Agencies also receive unified visibility across endpoints, networks and clouds, helping close the gaps that attackers often exploit.

The 2024 ISC2 Cybersecurity Workforce Study found 67% of organizations reported a staffing shortage, and 90% said their teams face notable skills gaps, with over half noting these shortages pose a significant risk. AI expertise is among the most pressing gaps. Despite these challenges, however, most professionals believe AI and automation will greatly strengthen their organizations’ security posture. It’s not about technology replacing people; it’s about helping them do more with less.

Strengthening Partnerships for the Long Haul

Finally, we need to think beyond our agency walls. Public-private partnerships are essential for sharing threat intelligence, best practices and resources.

The future of state and local cybersecurity isn’t just about budgets or the latest tech. It’s about people — how we find them, how we train them, how we leverage them, and how we empower them to protect our communities. 

Agencies willing to think differently about talent, invest in smarter tools, and lead with purpose will be best positioned to defend the public in the digital age. The stakes couldn’t be higher, and the opportunity couldn’t be greater. Now is the time to act.

Eric Trexler is senior vice president for public sector at Palo Alto Networks.