U.S. Public Sector Races to Fend Off New Security Threats

Public agencies in the U.S. are in a cybersecurity arms race to defend systems and data from increasingly sophisticated attacks, according to a new research report published today by Information Services Group (ISG) (Nasdaq: III), a leading global technology research and advisory firm.

The 2024 ISG Provider Lens Cybersecurity — Solutions and Services report for the U.S. Public Sector finds that many state, local and educational (SLED) organizations are highly vulnerable to evolving cybercrime techniques and can become vectors for attacks on larger agencies. SLED enterprises vary widely in terms of risk, staff training and preparedness despite significant government spending on cybersecurity, including a $400 million federal grant program for state and local agencies.

“Agencies need to make significant investments just to stay current on cybersecurity,” said Nathan Frey, partner and lead, ISG Public Sector, for the U.S. “As threats grow, they are constantly challenged to provide an adequate defense while constrained by budget and hiring limitations.”

The sector is expected to invest more in training over the next few years, because all public employees who work with data or technology need to be aware of cybersecurity and governance requirements, the report says. As agencies adopt new technologies, they will also need tools to prevent these from being exploited. Demand for third-party cybersecurity services is expected to grow significantly.

In the coming years, SLED organizations are likely to adopt Generative AI (GenAI) platforms to help them optimize service delivery to constituents and derive new insights from data, ISG says. The risks that come with GenAI are not yet fully known, so agencies will need to choose platforms carefully and update their defenses to make sure the technology delivers a net benefit.

Some public agencies taking a holistic approach to security are investing in extended detection and response (XDR) and security service edge (SSE), ISG says. By correlating data from multiple security layers and enforcing common security policies across all endpoints and applications, these tools can help organizations rein in the complexity of multiple cybersecurity systems.

Like commercial enterprises, U.S. public-sector agencies want simpler and more flexible cyber defenses, the report says. Many are adopting a zero-trust approach to lock down access to critical infrastructure, sometimes due to regulatory mandates. The sector is also growing more interested in AI tools that automate responses to security incidents, reducing human effort and the need for training.