The Funding Squeeze in Numbers
The 2026 NASCIO-Deloitte Cybersecurity Study documents a sharp deterioration across nearly every measure.
Budget growth has contracted significantly. Only 22% of state CISOs reported budget increases of six percent or more — down from 40% in 2024. At the same time, 16% reported actual budget reductions, compared to zero percent in 2024. The middle — flat or incremental growth — is squeezing the agencies that cannot make the business case for cybersecurity investment in terms legislators understand.
CISO confidence has fallen to its lowest level in the three editions of the study. Only 22% of respondents expressed confidence that the state's information assets are adequately protected — down from 48% in 2022. The study's authors attribute the deterioration partly to AI-enabled threat escalation, which is raising the technical floor for effective defense, combined with the persistent burden of legacy infrastructure on security architectures that were not designed for the current threat environment.
The confidence gap extends beyond the state's own perimeter. Only 26% of state CISOs are at least somewhat confident in the security posture of their local government and higher education partners — meaning 63% are not very or not at all confident. That matters because those partners handle sensitive state data: Medicaid eligibility records, state-administered unemployment insurance, court filings. A breach at the county level can be a breach of state data.
Why "Metrics to Measure and Report Effectiveness" Became the Most-Cited Initiative
The most striking finding in the 2026 study is structural rather than technical. When CISOs were asked to identify their top five cybersecurity initiatives, 49% named "metrics to measure and report effectiveness" — up from 25% in 2024 and 15% in 2022, making it the most-cited item in this year's survey. That trend reflects something important about how state cybersecurity leaders are reframing their work.
Measuring effectiveness in operational terms (mean time to detect, patch cadence, vulnerability age) has always been a sound technical practice. What's changed is the audience for that measurement. State CISOs are increasingly building metrics structures that speak to appropriators and cabinet secretaries — people whose decision calculus involves cost of inaction, service continuity risk, and exposure to federal compliance penalties, not attack surface reduction ratios.
The shift also reflects hard lessons from budget battles. Generic risk arguments — "our threat surface is growing" — tend not to survive a legislative session in which every agency is competing for flat or reduced general funds. Arguments framed in dollar-loss avoidance and mission continuity create the kind of consequence clarity that moves funding — but only when the figures can be traced to actual documented events, not modeling.
A secondary driver: federal funding requirements. The State and Local Cybersecurity Grant Program (SLCGP; 6 U.S.C. 665g, enacted as part of the Infrastructure Investment and Jobs Act in 2021) required grantee states to develop plans that describe progress metrics and submit annual progress reports. SLCGP authorization lapsed at the end of fiscal year 2026 — September 30, 2026 — and had not been reauthorized as of this writing. States that received SLCGP funding in prior cycles may retain reporting obligations tied to those grants; the documentation discipline the program required is a sound internal practice regardless of whether the program is reauthorized.
What Programs Getting Funded Are Doing Differently
The 2026 study's findings suggest three practices associated with programs that defend or grow their cybersecurity budgets.
Multi-year roadmaps tied to mission continuity milestones. Single-year budget requests are inherently fragile. A multi-year plan that maps security investment to specific operational risks makes the cost of *not* funding the second year visible in the context of what the first year achieved. As a hypothetical illustration of the structure: "in year one, we eliminate the unpatched legacy systems that sit upstream of benefits payment infrastructure; in year two, we implement privileged access management across all critical systems; in year three, we complete a whole-of-state detection and response baseline." The specifics must come from the state's actual environment, but the form — sequenced investment tied to named operational risks — is what distinguishes a defensible multi-year request from an annual ask.
Dollar-loss framing that references actual peer events. State legislators respond to concrete peer comparisons. Citing a specific ransomware event at a comparable state — documented recovery costs, days of service disruption, federal reporting obligations triggered, identity monitoring costs for affected residents — anchors the risk discussion in operational and financial reality rather than threat actor characterizations. As a hypothetical illustration of the argument structure: a state might contend that an event comparable to a documented peer-state incident would cost approximately $X in recovery, lost productivity, and notification — but that figure must come from a published incident report and must withstand scrutiny from legislative budget staff. An estimate that is challenged in testimony typically does more damage than no estimate at all.
Separating capital investment from operational baseline. One structural trap in state cybersecurity budgeting is the conflation of one-time capital requests (a zero trust architecture build-out, a SIEM platform replacement) with ongoing operational costs (staff, managed detection services, continuous monitoring). Budget committees that approved a capital investment two years ago sometimes treat it as having "solved" cybersecurity. CISOs who clearly separate "what we built" from "what it costs to operate and what comes next" sustain the narrative of ongoing investment necessity rather than allowing a one-time approval to function as a permanent closing argument.
Third-Party Risk and the Legacy Infrastructure Problem
The 2026 study identifies two barriers that compound the funding challenge: 78% of state CISOs rated breaches involving third parties as a threat for the coming year — the most-cited threat in the survey — and 65% cite legacy infrastructure as a significant barrier to improving their security posture, tied for the top barrier with the sophistication of the threat environment.
Both of these are budget arguments waiting to be made. Third-party risk, in particular, is a category where the state's exposure is often disproportionate to its direct control. When a benefits administration vendor, a court case management SaaS provider, or a transit agency data system is compromised, the state frequently bears the notification burden and may bear liability. Documenting the state's third-party dependency map and the exposure profile of each major vendor converts a vague concern into a defensible investment thesis for vendor risk management programs.
Legacy infrastructure creates a subtler budget problem. When CISOs argue for modernization, the response is often that modernization is an IT capital budget question, not a security question. The reframe that works is to establish the specific security controls that cannot be implemented on the legacy platform — and therefore to document the security debt accumulating for each year the platform remains unmodernized. That debt argument — not "we need a new system" but "every year we delay, we accumulate X in unmitigable risk exposure" — tends to land differently with appropriators.
GenAI: The Budget Wildcard
Ninety-four percent of state CISOs in the 2026 study report active involvement in GenAI security policy development. That figure is striking because it reflects a resource demand that did not exist two years ago and that most cybersecurity budgets did not plan for.
GenAI security policy work encompasses a wide range: establishing what employees can and cannot submit to public AI systems, assessing the security posture of AI tools being procured by state agencies, designing data governance rules for AI-generated content in official communications, and building a monitoring capability for AI-related incidents. None of this is optional in a governance environment where state agencies are actively adopting AI tools, often faster than any central security review can keep up with.
The budget implication is that CISOs need to find resources for GenAI security work either by reprioritizing existing capacity or by making the case for incremental funding. Given the budget environment, most will be doing the former — which means something else isn't getting done. Making that tradeoff explicit, rather than letting it remain invisible, is itself a form of business-case discipline.
Where This Approach Can Fall Short
The business-case framing has real limits, and understanding them is part of executing it effectively.
The measurement trap. Metrics that satisfy a legislative hearing are not necessarily the ones that improve security. A state that optimizes for reportable metrics — patch cadence, mean time to close — without connecting them to actual risk reduction can produce a program that looks funded and functional while leaving the most consequential exposures unaddressed. The discipline of linking metrics to mission continuity rather than technical hygiene alone partially addresses this, but requires the CISO to hold two frameworks simultaneously and resist collapsing them when time pressure mounts before a hearing.
Peer incident numbers must survive examination. Recovery cost estimates from published breach reports vary widely in methodology and completeness, and state budget staff are increasingly sophisticated about these distinctions. An estimate that cannot be traced to a specific published source will be challenged. Build the incident file from documented, sourced reports — not modeling, and not aggregated secondary estimates.
A credible alternative: documented risk acceptance. If the measurement baseline and multi-year roadmap approach is not achievable — perhaps because the CISO lacks the internal data infrastructure to support it, or because the administration prefers a consolidated IT budget — the alternative is formal documented risk acceptance. A risk acceptance signed by the agency director or CIO that describes the specific unmitigated risk and the decision not to fund it moves accountability from the CISO to the official who signed it. This is a legitimate and sometimes more effective path in states where the appropriations culture resists the security-as-investment framing, or where the CISO's credibility is not yet established with the budget committee.
Who owns each piece. The CISO owns measurement design and the narrative for appropriators. The CIO must vouch for the technical accuracy of infrastructure claims. The agency CFO validates financial framing and can testify to cost-of-inaction estimates. Legislative budget staff need to be cultivated before the hearing cycle, not encountered for the first time during testimony. Each of these is a dependency; a gap in any of them can undermine an otherwise well-constructed case.
A Practical Starting Point for State CISOs
If the budget argument needs to be rebuilt — or made for the first time in business terms — the following starting points follow from the 2026 study's findings.
- Establish and document a measurement baseline. (Owner: CISO + CIO) Forty-nine percent of CISOs naming metrics as a top-five initiative represents a significant peer signal. What gets measured can be reported; what can be reported can be defended. The metrics that matter most in the appropriations context are those tied to service continuity and financial exposure, not those tied to technical security hygiene alone.
- Conduct a third-party exposure inventory. (Owner: CISO + agency counsel) Identify the five to ten vendors whose compromise would most directly disrupt state services or expose the most sensitive resident data. For each, document the contractual security requirements currently in place, the last independent review, and the notification obligations the state would bear in the event of a vendor breach. That inventory is the foundation of a third-party risk budget argument.
- Build the peer incident file. (Owner: CISO + budget staff) Compile documented ransomware and significant breach incidents from comparable states over the past two to three years, including published recovery cost estimates, service disruption duration, and federal reporting outcomes. Use only published, sourced figures. Used appropriately in budget testimony, this anchors the cost of inaction to observable reality rather than modeled projections.
- Document obligations under prior federal grants. (Owner: CISO + grants management) States that received SLCGP funding in prior cycles may retain reporting obligations tied to those grants. The metric and progress-documentation disciplines that the SLCGP statute requires (6 U.S.C. 665g) are sound internal practices regardless of whether the program is reauthorized — a state that cannot demonstrate measurable improvement against a documented baseline is in a weaker position for any future federal co-investment, whatever form it takes.
Sources and further reading
- 2026 NASCIO-Deloitte Cybersecurity Study (PDF) — primary source for all statistics cited
- NASCIO 2026 State CIO Top Ten Policy and Technology Priorities — AI ranked first for the first time; cybersecurity second
- SLCGP historical program information — FEMA — program authorization, prior-cycle requirements, and grantee reporting obligations
—-
Spartan X conducts cybersecurity risk assessments, security architecture design, and compliance roadmaps for state agencies — the foundational documentation that makes budget arguments defensible across multiple fiscal years. Building that baseline before the appropriations cycle starts is what gives a program's investment case staying power through the years when incidents don't occur.
