Many state chief information security officers say the increase in sophistication of cybersecurity threats is outpacing the amount of resources states are allocating to address them, according to the 2024 edition of the Deloitte-NASCIO Cybersecurity Study.
Deloitte said Monday that it and the National Association of Chief Information Officers have been conducting the study every two years since 2010 with the aim of updating state leaders concerning the cybersecurity threat landscape. The 2024 study, which was completed this spring, covers input from the CISOs of all 50 states and the District of Columbia.
Of the CISOs surveyed, four said less than one percent of their state’s IT budget is allocated for cybersecurity while more than a third said they do not have a budget dedicated specifically for cybersecurity. In contrast, federal agencies allocate over 10 percent of their budgets for that purpose.
CISOs have nevertheless undertaken efforts to mitigate cyber risks, including by onboarding specialists who can focus on cybersecurity-related matters, according to NASCIO Deputy Executive Director Meredith Ward.
“In addition to growing their teams, our research found these leaders are determined to find creative solutions to protect their organizations and the public,” Ward, who co-authored the 2024 report, added.
The same report reveals that many state CISOs have turned to generative artificial intelligence to bolster security operations, even though the same technology is seen as a potential source of threats.
“The attack surface is expanding as state leaders’ reliance on information becomes increasingly central to the operation of government itself, and CISOs have an increasingly challenging mission to make the technology infrastructure resilient against ever-increasing cyber threats,” commented Srini Subramanian, the global government and public services consulting leader at Deloitte and co-author of the 2024 report.