Wyoming Uses AI To Replace Legacy Anti-Virus
Penaranda suggested that traditional anti-virus software was more reactive than proactive. Endpoint detection and response systems instead watch behavior on a machine and can stop malicious activity before it runs.
Wyoming also gains 24/7 response capability from the system, which matters because attacks do not follow government work hours, Penaranda said.
The platform can isolate a problem, notify the state security team and leave unaffected systems running.
That speed has practical value during incidents. Penaranda recalled one case that spread from a single machine to more than 300 within minutes. AI gave analysts a view across the affected environment quickly enough to understand the scope of the incident.
He described the technology as a “force multiplier” and a decision aid for analysts, rather than a replacement for them.
“Human powered, AI enhanced,” Penaranda said.
READ MORE: AI service hubs will redefine citizen transactions.
AI Helps Security Teams Sort More Data
Debbi Blyth, executive strategist for CrowdStrike and a former Colorado CISO, said state and local security teams face a volume problem that makes automation useful.
CrowdStrike uses AI agents to process telemetry and present threats with context for human responders, she said. In some cases, the tools can block malicious behavior without waiting for an analyst.
For public-sector security operations centers, Blyth said, that means more data can be processed while employees spend more time on work that requires human judgment.
She also recommended that agencies test new security products in their own environments before buying them. When she served as Colorado CISO, Blyth said, a proof of concept allowed her team to see how a product performed with the state’s applications, configurations and data.
That made the team more comfortable selecting and deploying the technology, she said.
LEARN MORE: Whole-of-state cybersecurity is a smarter way to scale.
AI Adds Speed to SIEM, SOAR and Identity Security
Adam Ford, Zscaler’s CTO for state and local government and education and a former Illinois CISO, said AI does not make existing security information and event management and security orchestration, automation and response investments obsolete.
SIEM systems still give agencies aggregated data for threat hunting and reviewing past activity, Ford said. AI can use that data to recognize patterns, speed decisions and automate actions such as isolating a device to limit lateral movement.
Ford also argued that agencies need security architectures built for faster attacks. He pointed to zero-trust network security as a way to make movement between systems harder and more visible. Agencies also need visibility into which AI tools and agents employees are using on their devices.
“We have to get faster,” Ford said.
Morgan Reed, distinguished strategic adviser and field chief technology officer for Okta, described a similar approach to identity security. AI can ingest risk signals from endpoint tools and firewalls, then trigger identity actions across products.
For example, a security signal could prompt Okta to end a user session or require stronger multifactor authentication. Automated workflows could freeze an identity, quarantine a device and create a ticket for the security team.
DIVE DEEPER: Continuous authentication supports zero trust.
Wyoming Looks for AI That Saves Staff Time and Money
Cost remains part of the calculation for state and local agencies.
Blyth said some agencies are using managed detection and response plus 24/7 threat hunting services instead of trying to staff every function themselves. She also pointed to platform consolidation as a way to remove overlapping legacy products.
Penaranda said Wyoming applies a similar test when positions open on the security team. Managers review the departing employee’s duties and ask which tasks can be reassigned, automated or made easier with existing tools.
The state applies the same thinking to its technology portfolio. If one product duplicates much of what another product already does, Wyoming looks for ways to consolidate.
“Why do we want to go buy five different flavors of the same thing if one can do basically most of it?” Penaranda said.
For Penaranda, using technology as a force multiplier also provides a way to justify how Wyoming spends its limited cybersecurity dollars.
“That’s of primary importance” for state government, he said.
