Know the Threat Before It Knocks
Most agencies can't hire a security expert. That doesn’t mean they can’t be prepared.
In August, malware forced a city of close to 30,000 people to shut down its entire computer network. 911 routing, police and fire dispatch, and records all went down. Dispatchers moved to the county’s dispatch center to keep answering calls, and the city declared a state of emergency. Officials don’t expect the network to be fully back and operating until after Halloween.
Attacks like this are no longer rare. Government ranked second of all industries for security incidents in Verizon’s 2026 Data Breach Investigations Report (DBIR), with 3,634 incidents and 2,410 confirmed breaches.
Most agencies learn about a threat the same way everyone else does: from the news. A headline breaks, the chief asks whether the department is affected, and there’s no good place to look. Nobody dropped the ball. Hiring a security expert takes a budget most agencies don’t have and a skill set that’s hard to find. At most of the agencies we work with, no one’s full-time job is security. It falls to the people who manage the agency’s IT infrastructure, where it competes with every other responsibility they carry.
When Police Systems Go Dark
Earlier this year, ransomware took down a sheriff’s office network and report system. Deputies had to use Word documents to complete their reports. The office couldn’t confirm whether some of its sex offender registry files would ever be recovered. The cost is climbing too. The average public sector breach now costs $3.5 million, up 22% in a year, according to IBM’s 2026 Cost of a Data Breach Report.
The way in is usually the network around dispatch. Network intrusions made up 49% of the state and local government cases in Palo Alto Networks’ Unit 42 2026 Incident Response Report, a higher share than any other industry. That network is one your IT staff manages every day.
Key takeaway: Your dispatch and records systems are only as safe as the network around them. Ask your IT team or provider for a current list of every system that connects to the internet.
Too Many Fixes, Not Enough Expertise
Software makers release updates, called patches, to close security holes. Unpatched holes now lead stolen passwords as the most common way attackers get in: 31% of breaches overall and 40% in public administration, according to the same Verizon report.
For agency IT staff already keeping everyday systems running, often without dedicated cybersecurity training, knowing what to fix first adds another demand. The federal cyber agency, CISA, tracks more than 1,700 security holes attackers are actively exploiting, including more than 350 tied to ransomware. CISA’s Cybersecurity Awareness Month theme, Securing the Next 250, offers three practical priorities for public safety agencies:
- Reduce exposure. Start with security holes attackers are already exploiting. Subscribe to CISA’s Known Exploited Vulnerabilities alerts and prioritize patches for affected internet-facing systems. Turn on multifactor authentication wherever possible, starting with remote access.
- Replace unsupported technology. Retire devices and software that no longer receive security updates.
- Recover from disruption. Keep one backup disconnected from your network, test restoring it, and write down who to call at 2 a.m. on a Saturday.
Key takeaway: Start where limited IT time can make the biggest difference: patch known threats, secure remote access, retire unsupported systems, and test your recovery plan. Sign up for CISA’s free email alerts for its Known Exploited Vulnerabilities list and patch anything on it that touches the internet before anything else.
The Analyst’s First Job, Done for You
If the holes are the unlocked windows in your building, the warning signs are the people trying to climb through them. Sorting the holes that matter to your agency from the ones that don’t is normally a security analyst’s job. Mark43’s Cyber Threat Detector puts that sorting directly in the platform your team already uses every day – no cybersecurity experience required.
The Cyber Threat Detector makes no changes to your network, so your team decides what gets blocked. The threat data comes only from public sources. Nothing from your dispatch events, reports, or records goes into it.
It flags known exploited holes from CISA’s list, each with recommended actions, a due date, and links to additional details. It also identifies warning signs of an attack, such as malicious websites, internet addresses, and file fingerprints, using an active threat feed. With one click, users can narrow the list to ransomware-linked items, high-priority items, or a specific vendor. That last one is critical, with 36% of government breaches involving a third party, such as a software vendor or service provider, according to Verizon’s report.
Proving what you did about a threat is the other half of the job. At many agencies, that proof lives in email threads and spreadsheets managed by one person. With the Cyber Threat Detector, agencies can maintain a centralized record that’s readily available when an auditor or insurer asks. One click marks an item as seen and adds it to a queue the whole department can view, so two people don’t chase the same issue. Every view and note is logged with a name and timestamp, and the record can’t be edited or deleted.
Key takeaway: Keep one shared record of every threat you looked at and what you did about it. Help your IT team focus on the threats that matter most. Learn more about the Cyber Threat Detector and book a demo to see how Mark43 delivers the most secure public safety platform.
