Whole-of-State Defense: How SLED Agencies Can Protect Critical Infrastructure from AI-Driven Threats

Tenable's latest commentary, published as the closing post of its Cybersecurity Awareness Month series, puts a sharp point on something those of us who have responded to incidents in the public sector already know from hard experience: attackers deliberately hunt under-resourced targets, and state, local, and education (SLED) organizations — particularly those operating water systems, hospitals, mass transit, emergency services, and schools — sit squarely in that crosshairs. The data backs it up. In the most recent National Association of State Chief Information Officers (NASCIO) research, nearly 90% of state CIOs rated cyberattacks on critical systems as a high concern.

What has changed in 2025–2026 is the force multiplier. Artificial intelligence is expanding the SLED attack surface in two fundamental ways: adversaries are using AI to scale and accelerate their attacks against these organizations, and SLED agencies themselves are deploying AI-enabled systems that introduce new, poorly understood exposure. For defenders, this is not a theoretical policy debate — it is an operational problem that demands a structural answer. That answer, as Tenable and an increasing number of state CISOs argue, is a whole-of-state security model.

This post breaks down the threat dynamics, explains why the traditional agency-by-agency defense model is failing SLED organizations, and delivers concrete guidance for state CIOs, CISOs, and the security engineers and SOC analysts who will actually implement the whole-of-state approach.

The Threat Picture: Why Attackers Prey on SLED

After fifteen years of IR work across public and private sectors, the pattern in SLED incidents is consistent and predictable:

Resource asymmetry is the exploit. A municipal water authority or a rural school district cannot staff a 24/7 SOC, retain DFIR talent, or maintain continuous exposure management. Adversaries know this. Ransomware operators and their initial access brokers explicitly profile victims by ability to pay and weakness of defense — and small public entities score high on both.
Critical services create maximum extortion leverage. When the victim operates emergency dispatch, a hospital, or a transit system, downtime is measured in public safety impact, not just dollars. That pressure directly drives ransom payment decisions, which in turn funds and encourages the next wave of attacks.
Fragmented accountability creates blind spots. In the typical state, dozens or hundreds of independent local agencies each defend themselves with wildly varying maturity. An attacker who cannot breach the state network simply pivots to the county, the school district, or the utility — and the state often has no visibility into any of it.
Legacy operational technology (OT). Water, transit, and utility environments run decades-old control systems that were never designed to be networked, let alone defended against modern intrusion techniques. Patching cycles are measured in years, and many systems cannot be patched at all without replacing the physical infrastructure.

How AI Widens the SLED Attack Surface

The news item identifies two fundamental vectors, and both deserve defender attention:

1. AI as an adversary capability. Attackers are using generative and automation tooling to industrialize reconnaissance, craft highly credible spear-phishing in flawless English (a serious problem for public employees who are frequent phishing targets), rapidly mutate malware to evade signature-based controls, and accelerate vulnerability discovery against the sprawling, inconsistently patched public-facing infrastructure typical of local government. The practical effect: the time between a weakness appearing in a SLED environment and an attacker finding it has compressed dramatically. Defensive cycles measured in weeks are now measured against adversary cycles measured in hours.

2. AI as new attack surface. SLED agencies are simultaneously deploying AI-powered services — chatbots for citizen services, AI-assisted document processing, smart traffic and utility management, and AI tooling embedded in third-party SaaS platforms. Each deployment introduces new risks: exposed AI APIs and inference endpoints, prompt injection against citizen-facing assistants, sensitive data flowing into models without governance, and shadow AI usage by staff with no security review. Most local agencies have no AI asset inventory, no AI acceptable-use policy, and no monitoring for AI-specific abuse.

The convergence of these two vectors is why NASCIO's CIOs are alarmed — and why incremental, per-agency improvements will not close the gap.

Why the Traditional Model Fails — and What Whole-of-State Changes

The legacy approach — every agency, municipality, and district defending itself in isolation — fails for structural reasons, not lack of effort. Security talent is scarce and expensive; no small town can compete with the private sector for a seasoned SOC analyst. Security tooling is priced for enterprises, not school districts. Threat intelligence, even when freely available, requires staff to operationalize it.

A whole-of-state security model treats the state's entire public-sector ecosystem — state agencies, counties, cities, school districts, utilities, and critical service providers — as a single defensive enterprise. In practice, mature whole-of-state programs share these components:

Centralized or federated SOC services. The state (or a contracted MSSP operating on the state's behalf) provides 24/7 monitoring, detection engineering, and incident response for participating local entities that could never build these capabilities independently. Endpoint detection and response (EDR) telemetry from across the state feeds shared detection content, so an attack observed at one school district generates detections that protect every other participant within hours.
Statewide exposure and attack surface management. Continuous discovery and assessment of internet-facing assets across all participating entities — critical when a forgotten water district SCADA interface or an unpatched VPN concentrator at a small hospital can become tomorrow's headline. This is precisely where exposure management platforms and continuous monitoring (rather than annual assessments) pay off.
Shared threat intelligence and ISAC participation. Operationalizing feeds from CISA, the Multi-State Information Sharing and Analysis Center (MS-ISAC), and sector-specific ISACs (WaterISAC, E-ISAC) into actual detections and blocks — not just inbox items.
Standardized security baselines and grant-funded uplift. Using frameworks like the NIST Cybersecurity Framework and CIS Controls to set minimum baselines, backed by funding vehicles such as the federal State and Local Cybersecurity Grant Program (SLCGP), so that participation raises the floor for the weakest entities rather than just measuring their failure.
Coordinated incident response and exercises. Pre-negotiated mutual aid, retainer-based DFIR capacity available to all participants, and regular tabletop and functional exercises involving water, health, emergency management, and education — because ransomware does not respect jurisdictional boundaries, and neither should response.
AI governance at scale. Statewide policies for AI procurement, acceptable use, data classification for model inputs, and security review requirements — so a school district deploying an AI chatbot inherits guardrails instead of inventing them alone.

Exploitation and Threat Landscape Context

This news item does not describe a specific CVE or a single exploit; it describes a systemic condition. The operational reality for defenders is that SLED intrusions in the current environment follow well-worn paths: phishing and stolen credentials against staff, exploitation of unpatched internet-facing appliances and remote access services, abuse of unmanaged remote access tools, and ransomware deployment with pre-encryption data theft for double extortion. AI accelerates the front of that chain — reconnaissance, social engineering, and vulnerability discovery — while the back of the chain (lateral movement, encryption, exfiltration) remains detectable with disciplined telemetry and well-tuned behavioral detections.

That distinction matters: the whole-of-state model's value is not exotic tooling — it is ensuring that every participating entity has baseline telemetry, 24/7 eyes-on-glass, and current threat-informed detections, capabilities that reliably catch commodity intrusions but are completely absent in the majority of small public entities today.

Executive Takeaways

Because this story is a strategic model rather than a discrete vulnerability, the value for practitioners is in the decisions it should drive. These are the actions we recommend to state CIOs, CISOs, and SLED security leaders:

Stand up or join a statewide SOC capability now. If your state operates a shared security operations service, mandate or strongly incentivize EDR/MDR onboarding for every local entity running critical services — water, health, 911/PSAP, transit, K-12. If your state does not yet offer this, push for it in the next budget cycle and, in the interim, contract shared MDR capacity through cooperative purchasing vehicles. Coverage of the weakest entities is the entire point.
Build a continuous statewide attack surface inventory. You cannot protect what you cannot see. Deploy continuous external discovery and exposure management across all participating entities, with special attention to internet-facing OT/ICS-adjacent systems, remote access gateways, and unmanaged cloud services. Feed findings into a prioritized remediation pipeline with SLCGP or state grant funding attached — findings without funding become reports nobody reads.
Establish statewide AI governance before the next procurement cycle. Publish a model AI acceptable-use policy, an AI procurement security checklist (data handling, model provider vetting, API security, incident notification obligations), and a shadow-AI discovery effort using CASB/SaaS telemetry. Require security review for any citizen-facing AI deployment. The agencies deploying AI today with no guardrails are generating tomorrow's breach notifications.
Adopt CIS Controls as the common statewide baseline, and measure against it. The CIS Controls, with Implementation Group 1 as the floor for small entities, give heterogeneous participants a shared language and an achievable maturity path. Tie grant funding to demonstrated progress against IG1 (asset inventory, secure configuration, account management, logging, malware defenses, backup/recovery) rather than tool purchases.
Pre-negotiate incident response capacity and exercise it statewide. Retain DFIR support that any participating entity can invoke without procurement delays — hours matter in ransomware. Run at least one annual statewide exercise that includes water, public health, emergency management, and education, simulating a multi-entity ransomware event with AI-enhanced social engineering as the entry vector. Measure time-to-detect, time-to-notify, and time-to-contain across the federation.
Segment IT from OT and enforce it as a funding condition. For utilities and transit authorities in particular, require documented network segmentation between business networks and control systems, disabled or brokered remote access into OT zones, and out-of-band backup for critical configurations. A statewide program that funds detection but ignores flat OT networks is buying alerts about disasters it cannot prevent.

Remediation and Implementation Roadmap

Whole-of-state is a program, not a patch — but it can be sequenced pragmatically:

First 90 days: Inventory participating entities and their critical services; identify which operate water, health, emergency, or education systems with no current monitoring; onboard those entities to shared EDR/MDR first (risk-prioritized, not alphabetical). Stand up the external attack surface discovery capability and run the first statewide exposure snapshot.
Months 3–6: Publish the shared baseline (CIS IG1), the AI governance policy, and the IR mutual-aid framework. Execute SLCGP or state grant allocations tied to baseline adoption. Begin weekly statewide threat briefings operationalized from CISA and MS-ISAC reporting.
Months 6–12: Expand detection engineering as a shared function — one detection written from an incident at a county hospital protects every participant. Conduct the first statewide exercise. Establish metrics: mean time to detect across the federation, percentage of critical-service entities with 24/7 monitoring, percentage with tested backups, percentage compliant with IG1.
Ongoing: Treat the weakest participating entities as the true measure of the program. Attackers will always route around the state capital's hardened network and hit the unmonitored water district — the whole-of-state model only works if it closes that gap.

For practitioners evaluating tooling for this mission, prioritize platforms that can operate across multi-tenant, heterogeneous environments: unified exposure management across IT, cloud, and OT; MDR/SOC services that ingest telemetry from hundreds of small entities without requiring local staff; and reporting that translates technical posture into the language of state legislatures and grant auditors.

Final Assessment

The NASCIO finding that nearly 90% of state CIOs view attacks on critical systems as a high concern is not anxiety — it is an accurate read of the threat. AI has compressed attacker timelines and expanded the SLED attack surface on both sides of the equation, while the resource asymmetry between attackers and small public entities continues to widen. No school district or rural water authority will hire its way out of this problem.

Whole-of-state security is the only model that changes the math: shared telemetry, shared detection engineering, shared response capacity, and shared governance, funded and mandated at the state level. The states that operationalize this in 2026 will absorb the next ransomware wave as a manageable incident. The states that do not will read about their water systems and hospitals in the headlines.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub