--- title: Whole-of-state security: Defending SLED critical... description: Nearly 90% of state CIOs rate cyber attacks on critical systems as a high concern, according to NASCIO-GDIT research. State, local, and education (SLED)... canonical: https://daily.dev/posts/whole-of-state-security-defending-sled-critical-infrastructure-w8wejxwa2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Whole-of-state security: Defending SLED critical infrastructure | daily.dev og:description: Nearly 90% of state CIOs rate cyber attacks on critical systems as a high concern, according to NASCIO-GDIT research. State, local, and education (SLED)... og:url: https://daily.dev/posts/whole-of-state-security-defending-sled-critical-infrastructure-w8wejxwa2 og:image: https://api.daily.dev/og/posts/W8WEjxWa2.png og:image:alt: Whole-of-state security: Defending SLED critical infrastructure og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Whole-of-state security: Defending SLED critical infrastructure **[Tenable Blog](https://daily.dev/sources/tenable-blog)** · 11 min read · 0 upvotes · 0 comments ## Summary Nearly 90% of state CIOs rate cyber attacks on critical systems as a high concern, according to NASCIO-GDIT research. State, local, and education (SLED) organizations running water systems, hospitals, and transit are prime targets because attackers use them as entry points to bigger networks. On July 30, the FBI and EPA warned that water utilities in at least seven states had reported cyber attacks, some leading to degraded water operations, while CISA reported a significant increase in attacks targeting programmable logic controllers. AI is widening the attack surface further, as employees build unsanctioned AI apps and attackers automate reconnaissance. A 'whole-of-state' approach, which 73% of responding states include in their plans, pools governance, visibility, and shared services, such as Utah's program covering roughly 80% of local government entities, to protect smaller, under-resourced agencies. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of state CIOs consider cyberattacks on critical infrastructure a high concern? Nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern, with the rest rating them as moderate. This comes from research combining the 2026 NASCIO State CIO Survey, the 2026 NASCIO-Deloitte Cybersecurity Study, and interviews with state CISOs, published in the 'The Expanding Cyber Perimeter' report by NASCIO and GDIT. _Security leaders tracking state and local cyber risk trends can follow coverage like this on daily.dev._ ### Why are attackers targeting water utilities and other SLED critical infrastructure instead of state agencies directly? Attackers often can't breach a hardened state agency directly, so they first compromise a weaker entry point like a small town's water utility, a rural school district, or a county dispatch center, then try to move laterally toward the larger target. On July 30, the FBI and EPA warned that water and wastewater utilities in at least seven states had reported cyber attacks causing degraded operations, and CISA noted a rise in attacks on exposed programmable logic controllers that caused boil water notices. _Engineers securing OT and water infrastructure can keep up with emerging threat patterns through daily.dev._ ### What is a whole-of-state cybersecurity approach? A whole-of-state cybersecurity approach treats state agencies, counties, cities, school districts, and utilities as one shared defensive perimeter rather than isolated organizations, pooling governance, visibility, and services so small entities aren't left to defend themselves alone. About 73% of states responding to the 2026 State CIO Survey include critical infrastructure protection in such plans, and Utah's shared services program covers roughly 80% of its local government entities with endpoint protection, patching, training, and incident response. _Teams weighing shared versus siloed security models for public sector infrastructure can research approaches like this on daily.dev._ ## Similar posts on daily.dev - [Whole-of-state cyber defense: How AI-driven security helps US states protect what matters most](https://daily.dev/posts/whole-of-state-cyber-defense-how-ai-driven-security-helps-us-states-protect-what-matters-most-cnn2a3iam) · elastic · 0 upvotes · 0 comments - [How nation-states use AI to target critical infrastructure](https://daily.dev/posts/how-nation-states-use-ai-to-target-critical-infrastructure-o0vgcyhfo) · Tenable Blog · 1 upvotes · 0 comments - [From Intelligence to Action: Operationalizing MS-ISAC Threat Data Across SLED Environments](https://daily.dev/posts/from-intelligence-to-action-operationalizing-ms-isac-threat-data-across-sled-environments-rfddedtk8) · Cisco · 0 upvotes · 0 comments - [Cloud CISO Perspectives: Tips on securing the water sector in the AI era](https://daily.dev/posts/cloud-ciso-perspectives-tips-on-securing-the-water-sector-in-the-ai-era-knlcc0zbg) · Google Cloud · 0 upvotes · 0 comments --- Tags: [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/whole-of-state-security-defending-sled-critical-infrastructure-w8wejxwa2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Whole-of-state security: Defending SLED critical infrastructure","url":"https://daily.dev/posts/whole-of-state-security-defending-sled-critical-infrastructure-w8wejxwa2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/whole-of-state-security-defending-sled-critical-infrastructure-w8wejxwa2"},"datePublished":"2026-10-27T13:04:48.873Z","dateModified":"2026-10-27T13:05:23.261Z","description":"Nearly 90% of state CIOs rate cyber attacks on critical systems as a high concern, according to NASCIO-GDIT research. State, local, and education (SLED)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cdaf47a64c631553d8b9309f028bfa93?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cdaf47a64c631553d8b9309f028bfa93?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Tenable Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Tenable Blog","logo":"https://media.daily.dev/image/upload/s--B6GAvw3H--/f_auto,q_auto/v1780213271/logos/tenable-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/tenable-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/whole-of-state-security-defending-sled-critical-infrastructure-w8wejxwa2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-security","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tenable Blog","item":"https://daily.dev/sources/tenable-blog"},{"@type":"ListItem","position":3,"name":"Whole-of-state security: Defending SLED critical infrastructure"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/whole-of-state-security-defending-sled-critical-infrastructure-w8wejxwa2#faq","mainEntity":[{"@type":"Question","name":"What percentage of state CIOs consider cyberattacks on critical infrastructure a high concern?","acceptedAnswer":{"@type":"Answer","text":"Nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern, with the rest rating them as moderate. This comes from research combining the 2026 NASCIO State CIO Survey, the 2026 NASCIO-Deloitte Cybersecurity Study, and interviews with state CISOs, published in the 'The Expanding Cyber Perimeter' report by NASCIO and GDIT. Security leaders tracking state and local cyber risk trends can follow coverage like this on daily.dev."}},{"@type":"Question","name":"Why are attackers targeting water utilities and other SLED critical infrastructure instead of state agencies directly?","acceptedAnswer":{"@type":"Answer","text":"Attackers often can't breach a hardened state agency directly, so they first compromise a weaker entry point like a small town's water utility, a rural school district, or a county dispatch center, then try to move laterally toward the larger target. On July 30, the FBI and EPA warned that water and wastewater utilities in at least seven states had reported cyber attacks causing degraded operations, and CISA noted a rise in attacks on exposed programmable logic controllers that caused boil water notices. Engineers securing OT and water infrastructure can keep up with emerging threat patterns through daily.dev."}},{"@type":"Question","name":"What is a whole-of-state cybersecurity approach?","acceptedAnswer":{"@type":"Answer","text":"A whole-of-state cybersecurity approach treats state agencies, counties, cities, school districts, and utilities as one shared defensive perimeter rather than isolated organizations, pooling governance, visibility, and services so small entities aren't left to defend themselves alone. About 73% of states responding to the 2026 State CIO Survey include critical infrastructure protection in such plans, and Utah's shared services program covers roughly 80% of its local government entities with endpoint protection, patching, training, and incident response. Teams weighing shared versus siloed security models for public sector infrastructure can research approaches like this on daily.dev."}}]} ```