Governments Urged to Plan for Breaches That Defenses Cannot Stop

 | 

That is the central recommendation of a commentary published by Route Fifty, which argues that artificial intelligence is accelerating cyberattacks faster than agencies can address vulnerabilities. Prevention remains essential, but governments also need an “assume breach” mindset that treats limiting an attacker’s reach as a core responsibility.

Gary Barlet, public sector chief technology officer at cybersecurity company Illumio, writes that agencies should assess their ability to preserve operations after an intrusion. The stakes extend beyond stolen information. Compromised government systems can interrupt services that residents rely on for safety and daily necessities.

“If an attacker gets in, how far can they go,” Barlet asks, “and how quickly can we contain them?”

AI makes that assessment more urgent by helping attackers find and exploit weaknesses on compressed timelines. Barlet argues that opportunities to fixing vulnerabilities before exploitation are shrinking, leaving agencies exposed even when they maintain conventional defenses.

Patching software, managing identities, protecting endpoints and training employees remain necessary. But those measures cannot guarantee that every intrusion will be prevented, particularly when attackers exploit a weakness before a fix becomes available.

For state and local agencies, the challenge is compounded by legacy systems that combine older infrastructure, cloud services, operational technology and systems maintained by contractors. Limited staffing and budgets can make those connections harder to understand and protect, the analysis notes.

The consequences become apparent when an attacker moves from an initial foothold into systems supporting essential operations. Barlet points to recent attacks against U.S. water utilities in which intruders accessed internet-facing industrial control systems. Some operators lost full monitoring or control capabilities and resorted to manual operations.

Such incidents demonstrate why a breach must be treated as a potential service-continuity emergency. A compromised system should not become a route into public safety infrastructure, financial applications or equipment controlling physical operations.

Barlet recommends that agencies begin by identifying their most important services and mapping the technology supporting them. Officials need to understand connections among systems, including remote access and access granted to outside vendors.

Priorities will vary. A water utility, benefits agency and emergency communications center face different operational risks. Each nevertheless needs to establish which assets require protection, which other systems can reach them and how quickly compromised components can be isolated.

Segmentation and separation are critical to a containment plan, Barlet writes. By restricting communication among systems, applications and computing workloads, agencies can limit an intruder’s ability to move across their environment. Containment also creates time for security teams to investigate, respond and recover.

That capability should be tested alongside incident detection, communications and restoration procedures. The objective is to isolate affected systems while preserving services that remain secure. Shutting down an entire network may restrict an attacker, but it can also impose substantial costs on residents.

The analysis also calls for new metrics for measuring cybersecurity performance. Counts of patched vulnerabilities and resolved alerts describe security activity, but reveal little about whether essential services could survive an intrusion.

Officials should also measure which functions remain available, how quickly critical operations recover and whether disruption spreads beyond the initial compromise. Those outcomes make continuity of government services a practical test of cybersecurity readiness.

For agency leaders, the recommendation is to incorporate containment into planning, architecture and exercises before an incident occurs. Assuming a breach means designing operations around the possibility that preventive controls will fail, then demonstrating that a single compromised system cannot disable the services a community needs.