Overcoming the Execution Gap
Several states have successfully closed the gap. They provide a useful blueprint for other localities that might be struggling to implement whole-of-state cybersecurity:
- Minnesota has a unified framework where counties, local cities and port authorities plug directly into the state’s centralized Security Operations Center capabilities and threat analysis.
- Arizona’s Cyber Command Center acts as a shared resource for state agencies, local municipalities and local universities.
- North Dakota’s Joint Security Operations Center covers all of the state’s K–12 districts, county governments and local municipalities.
These states show that closing the execution gap does not require forcing every agency to replace its technology stack. Rather, closing the gap entails using shared services to strengthen the systems agencies already rely on.
READ MORE: A new approach to risk and vulnerability management.
Addressing the Vulnerability Gap
Fortifying older systems has never been more important, especially as AI becomes increasingly weaponized. The NASCIO-Deloitte Cybersecurity Study warns that cybercriminals are targeting an ever-widening range of local entities and using AI-enabled tools to probe for weaknesses.
This AI-driven threat environment — often referred to as a “Mythos moment” — is especially dangerous for agencies that rely on legacy technology. Many public sector agencies are pinned to older versions of software and libraries because upgrading a critical application could break essential services. This creates a vulnerability gap that lies at the heart of the broader execution gap.
To minimize both gaps, states can extend centralized vulnerability management services to local agencies and partners. Instead of having individual agencies scan for hard-to-find vulnerabilities on their own, state-led organizations can identify legacy software or libraries affected by known vulnerabilities and alert partners to the threat. Local agencies and organizations can then immediately prioritize those vulnerabilities before hackers have a chance to exploit them.
EXPLORE: Should you upgrade legacy devices?
Sharing Responsibility for Defense
Bolstering security around legacy technologies also addresses political, legal and resource concerns. When an agency discovers a compromise but cannot offer a remedy, disclosure can become politically difficult, and liability concerns can loom large. And when every agency must find, analyze and fix vulnerabilities on its own, scarce cyber staff are stretched even further.
When sharing their vulnerability management services statewide, state agencies provide other entities with the support needed to address these hurdles. The state identifies affected software, validates the risk and remediates it without requiring every local partner to fund a separate capability or undertake a disruptive modernization project. That support can make information sharing and coordinated incident response more feasible while preserving local control.
By fully committing to a whole-of-state approach, state agencies treat defense as a shared public utility they help manage rather than dictate. No silos, no audits, no edicts from on high; just a sound collective framework built on support and trust.
