US government face surge in cyberattacks amid budget cuts

KnowBe4 has released new research outlining the cybersecurity challenges encountered by state, local, tribal, and territorial governments in the United States.

The research indicates that government organisations are increasingly targeted by cybercriminals, particularly through ransomware, and are facing significant resource constraints that hinder their ability to respond effectively to such attacks. The report found that over 80% of these organisations operate with fewer than five employees dedicated to cybersecurity.

Analysis of sector data highlights the increasing frequency of attacks. A 313% rise in security incidents was reported in the Multi-State Information Sharing and Analysis Center (MS-ISAC) 2022 survey. This surge in incidents has coincided with a reduction in federal funding, specifically a cut of USD $10 million to the Center for Internet Security (CIS), which supports vital information sharing networks for government agencies.

Financial costs associated with cyberattacks have also been significant. The report notes that the average ransom per attack reached USD $872,656 between 2018 and December 2024, while total costs resulting from these attacks exceeded USD $1.09 billion over the same period.

According to the report, a central challenge is a lack of funding. Of those surveyed, 70% of state, local, tribal, and territorial government organisations identified insufficient funding as their primary security concern.

Staffing levels remain low despite the increasing threat. More than 80% of the organisations surveyed reported having fewer than five cybersecurity employees on staff, underscoring the limitations they face in mounting adequate defences.

Respondents identified human error as the most common entry point for cyberattacks, often exploited through methods such as social engineering. The report estimates that human error is responsible for between 70% and 90% of successful cyber breaches in these government entities.

To mitigate these challenges, the report highlights the positive impact of security awareness training among employees. KnowBe4's 2025 Phishing by Industry Benchmarking Report found that such training reduced the rate of phishing susceptibility from approximately 33.1% to just 4.1% after one year of implementation. This suggests that simple, cost-effective training measures can deliver substantial benefits for resource-constrained organisations seeking to manage risk.

The research argues that building organisational resilience depends not only on technological tools but also on strengthening security culture through staff training and awareness. The findings suggest there are routes forward for under-resourced government entities to bolster their defences against cyberthreats.

"The data tells an alarming story about state and local government cybersecurity readiness. As these organisations grapple with constrained budgets and outdated infrastructure, they remain prime targets for cybercriminals. The surge in ransomware attacks underscores the need to build a more resilient security culture. It's crucial to prioritise human risk management, which has proven to be a powerful tool to counteract these rising challenges," Erich Kron, Security Awareness Advocate at KnowBe4, commented on the report.

The report concludes that state, local, tribal, and territorial government organisations can benefit from focused investment in security awareness training, especially given their limited personnel and budgets, as it represents a viable means of reducing vulnerability to cyberattacks.