NASCIO-Deloitte survey exposes US state cyber-budget pressure

US state cybersecurity chiefs reported sharply lower confidence in public-sector defences in the 2026 NASCIO-Deloitte survey, while some faced budget cuts. For businesses supplying government or depending on public services, the concern is interconnected exposure: a weakness outside a state agency can still disrupt the systems it relies on. The findings measure officials’ confidence and priorities, however, not a documented increase in successful attacks.

What happened

The biennial study covered chief information security officers from all 50 US states and two territories. According to Deloitte US’s account of the 2026 findings, 26% were extremely or very confident that their state’s information assets were protected against cyber threats, compared with 48% in 2022—a fall of 22 percentage points.

Doubts were more pronounced beyond state agencies. The proportion describing themselves as not very confident in local government and public higher education’s ability to secure public data rose from 35% in 2022 to 63% in 2026. That is an assessment by state security chiefs, not a separate survey of municipal or university security teams. It nevertheless identifies where those overseeing state security see growing exposure.

Financial pressure also became more visible. Sixteen per cent of CISOs reported budget cuts in 2026, against none in 2024. Deloitte’s release does not give the size of those reductions or the cash value of security budgets. The finding establishes that cuts had emerged among respondents; it does not establish how much defensive capacity was lost.

The survey also recorded a change in management priorities. Implementing measures of cybersecurity effectiveness was the leading initiative for 2026, selected by 49% of respondents, up from 25% in 2024 and 15% in 2022. More chiefs wanted evidence that spending was working. That is not the same as saying they already had it.

The background

States share systems and data with counties, cities and public colleges and universities. Deloitte argues that vulnerabilities can therefore spread consequences across institutional boundaries, exposing personal information, interrupting essential services and increasing incident-response costs. A state’s own security arrangements cannot be judged entirely separately from those of the organisations connected to it.

For suppliers, this makes the distinction between securing a product and securing a service important. A contractor may control its own software while remaining dependent on public systems for data or service delivery. The survey does not measure private suppliers’ security or identify breaches caused by them. Its relevance to third parties lies in the dependencies it describes, rather than in a quantified finding about vendor failure.

Roughly one-fifth of CISOs said their states were moving towards a coordinated, state-wide cybersecurity approach. As Deloitte describes it, this extends support beyond state agencies through shared capabilities and collaboration. The economic argument is straightforward: separate public bodies need not each assemble every defensive capability themselves. The release does not provide cost savings or comparative results demonstrating that this model performs better.

Staffing is an important limit to the published evidence. Deloitte’s release gives no headcount, vacancy or recruitment figures. It cannot support a claim that state security teams became smaller or that shortages caused confidence to fall. Shared services and automation may stretch available capacity, but their effect on staffing is not quantified here.

The UK connection requires similar care. These are US state findings, not evidence about British councils or a statement of UK legal duties. British firms serving US public bodies may have direct commercial exposure; others face a comparable question about dependencies, rather than an identical measured risk. Our coverage of the UK cyber bill’s unresolved AI safeguards addresses the separate domestic policy debate.

What people are saying

Mike Wyatt, Deloitte’s cyber-risk leader covering state, local and higher education, favoured extending protection through shared services. He described states considering security operations centres and regional support so that counties, cities and schools could draw on broader defensive capabilities. His position treats coordination as a way to contain weaknesses before they become wider incidents—not merely as an administrative tidying-up exercise.

Meredith Ward, NASCIO’s deputy executive director, welcomed CISOs’ involvement in generative-AI decisions. She argued that early participation in strategy, security policies and reviews of proposed uses could help governments adopt the technology without setting safeguards aside. This is an institutional argument for involving security leaders at the outset; the survey does not test whether that involvement accelerated deployment or reduced incidents.

The participation figures are substantial. Ninety-four per cent of state CISOs said they were involved in developing generative-AI security policies, and 84% in generative-AI strategy. Those measures establish involvement, not the quality of the policies, their enforcement or their coverage of every agency. Presence at the meeting is useful; it is not an audit result.

Deloitte also describes AI as making attacks cheaper to generate and automate. CISOs pointed to deepfakes, agents that search for vulnerabilities and adapt, and AI-driven ransomware-as-a-service operations. These are reported concerns, not attack-frequency statistics. The distinction matters when interpreting research such as Anthropic’s IoT worm tests: demonstrated capabilities and measured prevalence answer different business questions.

On defence, CISOs described using AI to triage alerts and summarise events, while exploring report creation, threat identification and training. Deloitte says several states were already using generative AI in security information and event management, and in security orchestration, automation and response. It supplies neither a state-by-state deployment count nor measured productivity gains. Adoption is documented more clearly than effectiveness.

What happens next

The clearest forward-looking signal in the 2026 findings is the demand for effectiveness measures. Deloitte identifies incident-response time and phishing click rates as examples of operational indicators that can help explain the value of cyber spending. These measure specific activities or behaviours; neither alone demonstrates that an organisation’s information assets are secure.

For suppliers seeking public-sector business, that priority points towards a more demanding commercial conversation: what changed after a security service was installed? A claim about detection capability is different from evidence of faster response in the buyer’s environment. The same distinction underlies the evidence gap facing buyers of AI benchmarks. The survey does not announce new procurement conditions, but it shows why evidence of results could carry more weight.

Budget cuts and interest in shared capabilities create a further tension. Pooling services may help participating bodies obtain support they could not readily provide alone, yet it also makes coordination and allocation of responsibility consequential. The release does not establish whether states adopting that approach secured additional funding, changed contracts or achieved better outcomes.

The retrospective record therefore stops at reported 2026 priorities, confidence and adoption. It contains no subsequent results showing that AI tools, shared services or new metrics reversed the decline in confidence. The next meaningful comparison would distinguish plans from implementation, and implementation from measured defensive gains.