Topic starter
02/08/2026 12:08 pm
TL;DR: Rising cyber pressure is colliding with shrinking budgets, legacy systems, and sensitive citizen data, Knowbe4’s whitepaper reports. Small public-sector teams have less room to absorb ransomware or data theft, so recovery and access controls have to do more work with less capacity.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper State and Local Cybersecurity: Facing New Burdens Amid Rising Threats”.
Key questions
Q: Why do aging systems make ransomware and data theft more likely in public sector environments?
A: Aging systems extend the life of weak authentication, poor visibility, and unpatched exposure paths.
Q: What do security teams get wrong about awareness training in government?
A: They treat it as a standalone compliance activity instead of a control that supports detection and decision-making.
A: They should start by treating cybersecurity as an operational dependency, not a discretionary IT expense.
Practitioner guidance
- Prioritise access reviews for high-risk accounts Focus reviews on administrative, remote access, and shared accounts that can turn a phishing event into broad compromise.
- Use HRM to target likely failure points Run awareness and simulation programmes against the behaviours most likely to affect public-sector environments, especially phishing, credential reuse, and unsafe handling of sensitive data.
- Constrain legacy-system exposure paths Segment ageing systems, reduce direct internet exposure, and remove unnecessary access routes into servers that still hold citizen or operational data.
Bottom line: State and local governments face a compound cyber risk where shrinking budgets, legacy systems, and sensitive data exposure reinforce one another.
Glossary terms: Human Risk Management, Privileged Access, Legacy Infrastructure, Standing Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:12 pm
Public-sector cyber risk is now a control-discipline problem, not just a funding problem. The article correctly frames understaffing, aging infrastructure, and sensitive data as a combined exposure pattern. The sector does not fail because it lacks awareness of threats alone, but because resource constraints slow the renewal of the controls that keep exposure bounded. For practitioners, that means the governance question is which controls can still be made reliable when replacement budgets are thin.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations prioritise human risk management or infrastructure modernisation first?
A: If resources are constrained, organisations should first secure the paths that attackers are most likely to exploit immediately, especially access governance and user behaviour controls. Modernisation still matters, but it takes longer to deliver risk reduction than tightening current identity and recovery controls.
👉 Read our full editorial: State and local cybersecurity faces rising risk with fewer resources