State and local cybersecurity faces rising risk with fewer resources

At a glance

What this is: This whitepaper argues that municipalities are under increasing cyber pressure because limited staffing and budgets are colliding with aging infrastructure and sensitive public data.

Why it matters: It matters because IAM, security awareness, and governance teams in public sector environments often have to reduce exposure without relying on major tool expansion or headcount growth.

Context

State and local cybersecurity is a governance problem before it is a tooling problem. When budgets shrink, staffing stays thin, and legacy systems remain in service, the control environment weakens even if risk exposure keeps rising. That combination matters especially where public-sector systems hold citizen records, operational data, and critical-service dependencies.

The article frames the issue through resource constraint and attacker attention, not through a single technical weakness. For IAM and security leaders, the intersection is practical: identity controls, awareness programmes, and access discipline often become the compensating controls when agencies cannot modernise everything at once.

Key questions

Q: How should state and local governments prioritize cybersecurity when budgets, staff, and legacy systems are all constrained?

A: They should start by treating cybersecurity as an operational dependency, not a discretionary IT expense. The highest-value steps are patching known vulnerabilities, formalising shared responsibility across departments, improving identity security, and building a tested recovery plan. A platform approach can reduce tool sprawl, simplify administration, and free small teams to focus on risk reduction instead of fragmented maintenance.

Q: Why do aging systems make ransomware and data theft more likely in public sector environments?

A: Aging systems extend the life of weak authentication, poor visibility, and unpatched exposure paths. That gives attackers more ways to enter, more places to move, and more time to exploit gaps before small teams can detect or contain them.

Q: What do security teams get wrong about awareness training in government?

A: They treat it as a standalone compliance activity instead of a control that supports detection and decision-making. Training works best when it reinforces real behaviours such as reporting phishing, verifying unusual requests, and protecting credentials. It should complement technical controls, not replace them.

Q: Should organisations prioritise human risk management or infrastructure modernisation first?

A: If resources are constrained, organisations should first secure the paths that attackers are most likely to exploit immediately, especially access governance and user behaviour controls. Modernisation still matters, but it takes longer to deliver risk reduction than tightening current identity and recovery controls.

Technical breakdown

Why underfunded public-sector environments become easier targets

Municipal and local government environments often accumulate risk through slow replacement cycles, fragmented oversight, and mixed legacy-modern estates. Aging infrastructure tends to carry weaker visibility, inconsistent patching, and stale access pathways, while limited staff reduces the organisation’s ability to monitor and remediate. Attackers do not need a novel technique when routine control gaps already exist. The operational issue is that every delayed upgrade, unreviewed account, and unmaintained server expands the attack surface faster than small teams can reduce it.

Practical implication: prioritise the control gaps that expand exposure fastest, especially stale access, legacy systems, and weak monitoring coverage.

How ransomware pressure changes security priorities

Ransomware thrives in environments where defenders cannot consistently detect, contain, and recover. In public-sector settings, the problem is not only the malware itself but the operational asymmetry between attackers and understaffed teams. Limited resources force trade-offs, so recovery planning, identity discipline, and user behaviour controls become disproportionately important. If an organisation cannot guarantee perfect prevention, it has to limit blast radius and shorten the time between compromise and containment.

Practical implication: assume some attacks will get through and invest in containment, recovery readiness, and access reduction rather than prevention alone.

Why human risk management matters when technical budgets are tight

Human risk management is a way to reduce exposure without depending entirely on large-scale infrastructure change. It focuses on the behaviours, privileges, and decisions that shape whether phishing, credential misuse, or careless access handling turns into an incident. In resource-constrained public-sector environments, that can be a realistic compensating control because awareness, simulation, and policy reinforcement scale more cheaply than broad platform replacement. The important point is that HRM should support governance, not substitute for basic access control.

Practical implication: use HRM to reduce risky user actions, but pair it with stronger access governance so human behaviour is not the only line of defence.

Threat narrative

Attacker objective: The attacker’s objective is usually to disrupt operations, pressure the organisation into recovery costs, or access sensitive citizen and government data for secondary use.

1. Entry commonly begins with opportunistic phishing, credential abuse, or exploitation of exposed legacy services in under-resourced environments.
2. Escalation follows when weak access discipline or stale privileges let attackers move from a single account into broader administrative or data-bearing systems.
3. Impact comes from ransomware, data theft, or service disruption that public agencies may struggle to contain quickly because of limited staffing and older infrastructure.

Breaches seen in the wild

• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Public-sector cyber risk is now a control-discipline problem, not just a funding problem. The article correctly frames understaffing, aging infrastructure, and sensitive data as a combined exposure pattern. The sector does not fail because it lacks awareness of threats alone, but because resource constraints slow the renewal of the controls that keep exposure bounded. For practitioners, that means the governance question is which controls can still be made reliable when replacement budgets are thin.

Human risk management becomes a compensating control only when access governance remains intact. Security awareness can reduce the probability of successful phishing or careless behaviour, but it cannot replace account lifecycle discipline, least privilege, or review of privileged access. In identity terms, the article points to a familiar public-sector weakness: human behaviour is easier to train than complex estates are to secure. The practical conclusion is that HRM must sit alongside IAM, not in place of it.

Legacy infrastructure creates a persistence layer for attacker opportunity. Older systems and slow upgrade cycles preserve weak points long enough for commodity attackers to exploit them repeatedly. That creates a governance debt that accumulates across endpoints, servers, and identity paths, especially where public data is spread across multiple local systems. The field should treat ageing infrastructure as an operational risk multiplier, not a background IT inconvenience.

Control compression: this article describes the point where agencies must do more with fewer controls, so governance becomes a matter of narrowing scope rather than expanding stack complexity. That is especially relevant to identity programmes, where access reductions and targeted awareness can still be enforced even when major modernisation is delayed. The practitioner conclusion is to concentrate scarce effort on the controls most likely to reduce blast radius.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: Public Sector Identity Security Guide

What this signals

Public-sector security programmes are increasingly shaped by constraint, which means the control strategy must be selective rather than expansive. The agencies most at risk are often the ones that cannot replace infrastructure quickly, so they need to harden identity paths, reduce standing access, and make recovery realistic with small teams. That is a governance choice, not just a budget outcome.

Control compression is the right way to think about this risk pattern. When staffing, infrastructure, and time are all limited, the controls that matter most are the ones that narrow attack paths and preserve service continuity. Agencies that keep trying to solve the problem with more tooling alone will usually move slower than the threat.

A practical signal of maturity is whether an organisation can shorten exposure without waiting for a full platform refresh. That means privileged access discipline, targeted HRM, and tested recovery processes should be treated as core public-sector resilience controls.

For practitioners

• Prioritise access reviews for high-risk accounts Focus reviews on administrative, remote access, and shared accounts that can turn a phishing event into broad compromise. Remove inactive accounts, tighten role scope, and verify that privileged access still matches current job functions.
• Use HRM to target likely failure points Run awareness and simulation programmes against the behaviours most likely to affect public-sector environments, especially phishing, credential reuse, and unsafe handling of sensitive data.
• Constrain legacy-system exposure paths Segment ageing systems, reduce direct internet exposure, and remove unnecessary access routes into servers that still hold citizen or operational data.
• Build recovery around limited staff capacity Test restoration, escalation, and communication steps with the assumption that the first responders will be a small team under pressure, not a fully staffed SOC.

Key takeaways

• State and local governments face a compound cyber risk where shrinking budgets, legacy systems, and sensitive data exposure reinforce one another.
• Ransomware and related attacks are harder to absorb when small teams must defend large, ageing environments with limited recovery capacity.
• The most realistic risk reduction comes from narrowing access, focusing awareness on high-probability failures, and making recovery workable for understaffed agencies.

Key terms

• Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
• Privileged Access: Privileged access is any elevated entitlement that can change systems, data, or security settings. When privilege is excessive or poorly scoped, a single compromised identity can create outsized blast radius across environments.
• Legacy Infrastructure: Legacy infrastructure is an existing environment built before current automation standards were in place. It may include manually configured resources, inconsistent naming, and limited code coverage. In practice, it creates migration and governance challenges because teams must import, validate, and standardise assets without disrupting live services.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course if your programme needs stronger control over access, privilege, and identity lifecycle decisions.