As AI accelerates cyberattacks, governments need to rethink resilience

The window between vulnerability discovery and exploitation has practically been reduced to zero. Artificial intelligence is accelerating how quickly attackers can identify and act on weaknesses, shrinking timelines from months to hours. 

The recent Hugging Face incident is just one example of how quickly capabilities are advancing. As attacks accelerate, governments need to rethink what cyber resilience looks like.

Since attackers move faster than agencies can remediate vulnerabilities, resilience must depend on what happens after an attacker gets in. The ability to contain an intrusion before it spreads to critical systems and disrupts public services is critical.

That is particularly important for state and local cyber teams defending complex environments that span legacy infrastructure, cloud services, operational technology and systems operated by outside vendors, often with limited staff and budgets.

Patching, identity controls, endpoint security and employee training still matter. But when an attacker acts before a fix is available, prevention cannot be the only line of defense.

Government leaders need to ask: If an attacker gets in, how far can they go — and how quickly can we contain them?

Cyberattacks Can Quickly Become Service Disruptions

Government technology supports emergency communications, public safety, courts, benefits, transportation, elections, water systems and other services residents depend on every day. When an attacker moves into more critical parts of the environment, the impact quickly extends beyond IT.

Recent attacks against U.S. water utilities show what that looks like. When cyber actors gained remote access to internet-facing industrial control systems at facilities across several states, in some cases, operators lost the ability to fully monitor or control equipment and had to rely on manual operations. Incidents like this show why containment matters.

Critical infrastructure is an attractive target because disruption has major public impacts. During periods of heightened cyber activity or geopolitical tension, state and local operators can expect more scanning, probing and attempted intrusions against the systems communities rely on.

Build Resilience Around Essential Services

For state and local governments, resilience must start with the most critical services.

Agencies need visibility into which systems support critical operations, how they are connected and where third-party or remote access could create risk so they can focus protections where they matter most.

A municipal water utility will have different priorities than a state benefits agency or county emergency communications center. But each should understand which systems are critical, what can connect to them and how quickly they can be isolated.

Along with detecting an attack, communicating during an incident and restoring systems, agencies should test how to isolate a compromised system without taking unaffected services offline.

That is especially important in government. Shutting down an entire environment may contain an attack, but it creates another set of problems for residents who depend on those services.

Assume Breach and Contain the Attack

To prepare for the increased volume and speed of attacks, organizations should adopt an “assume breach” mindset. An assume breach mindset recognizes that no security control will stop every attack. Rather than relying solely on prevention, it focuses on limiting how far attackers can move once inside the environment. By containing lateral movement, organizations can reduce risk and prevent incidents from becoming cyber disasters.

In a highly connected government environment, a small incident quickly becomes a larger one. Agencies need the ability to isolate a compromised system while keeping unaffected systems running. Controls such as segmentation put the assume breach principle into practice by containing threats, limiting lateral movement and reducing operational impact.

Segmentation limits which systems, applications and workloads communicate with one another. If one system is compromised, it should not provide an open path to public safety systems, financial applications, operational technology, or other critical assets. This type of containment also gives cyber teams something increasingly valuable: time to investigate, respond and recover before an intrusion spreads.

Measure What Remains Operational

Government leaders also need clearer ways to measure resilience. Traditional cybersecurity metrics can track vulnerabilities patched or alerts resolved, but they do not show whether essential services can continue during an intrusion. Readiness should also reflect operational impact: what remains available, how quickly critical functions recover and whether disruption stays contained.

State and local governments cannot control every threat, but they can measure resilience through the outcomes they influence during an incident.

As attacks move faster, the ability to limit disruption and keep public services running will be one of the clearest measures of government cyber resilience.

Gary Barlet is Public Sector CTO at Illumio.