Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era
Source Tenable Research
Description
This analysis discusses how AI is expanding the attack surface of critical infrastructure managed by state, local, and education (SLED) agencies. Cyber attackers often target under-resourced SLED organizations operating critical infrastructure such as water systems, hospitals, and emergency services. AI adoption by these agencies and adversaries' use of AI automation complicate security efforts. A whole-of-state cybersecurity approach, treating all local entities as a unified defensive perimeter, is recommended to mitigate risks. The report highlights concerns about aging operational technology, limited cyber staff in small communities, and unclear governance responsibilities. Attacks on smaller entities can have cascading effects on larger systems and public safety. Insider threats and excessive access privileges further increase risk. Nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern.