Under attack: State looks to harden cybersecurity as AI changes the game

Cyberattacks on government entities are increasing, the speed of attacks is accelerating and the impact could be far reaching thanks largely to artificial intelligence. 

February’s cyberattack on the University of Mississippi Medical Center demonstrated the damage that hackers can inflict. UMMC was without Wifi or phones and it’s regular computer system was down for more than a week. It canceled appointments and elective surgeries, and medical staff had to use paper charts to care for patients. 

On Tuesday, the Senate Cybersecurity Committee met with experts to learn about what the state should do to protect citizens and assets. 

READ MORE: UMMC revenue tumbled after February cyberattack

Lt. Gov. Delbert Hosemann created the committee in August to study the security of state and local government information systems and laws and penalties. The committee will develop recommendations for the Legislature’s 2027 session. 

Hosemann has said the state is “woefully inadequate” in cybersecurity.

In 2025, $77 billion in losses in the U.S. from cyber crimes were reported to the FBI. Hosemann said that due to underreporting, the actual cost could be in the hundreds of billions.

Speakers at the hearing on Tuesday emphasized the need for a collaborative, coordinated and centralized system for combatting cyber threats in state and local governments. 

According to Bobby Freeman, the director of the Cybersecurity Unit within the Department of Public Safety’s Office of Homeland Security, said that many cyberattacks are coming from outside of the U.S., requiring state agencies and local governments to work with federal agencies. 

To prepare for potential attacks, various agencies and local governments in Mississippi need to have a plan to work together. This could include common definitions, clear governance and crisis communications plans. 

“Coordination is key to all of this,” said Kevin Chin, a cybersecurity expert with Microsoft. 

Currently, cybersecurity and enforcement are dispersed. At the state level the Mississippi Department of Information Technology Services, the Cybersecurity Unit and the attorney general’s office are each responsible for different aspects of cybersecurity from providing services to state agencies to prosecuting crimes, and some departments have their own policies. Local governments are usually responsible for their own security resulting in a patchwork system that can make coordination and communication difficult. 

Doug Robinson, executive director of the National Association of State Chief Information Officers, told the committee he has seen a “march toward more consolidated and centralized models” across states.

Multiple speakers said that having a single centralized state cybersecurity resource would make collaboration and communication easier. A single system would also provide opportunities to eliminate duplicated work, share knowledge and save money. But speakers had different ideas about who the central agency or person should be.

A single system could also help the state respond quickly to cyberattacks. 

Cyberattacks are moving faster than ever thanks to AI and a rapid response is key to minimizing damage. Jon Tidwell, a government strategic services leader with Google, said that AI is making cyberattacks increasingly sophisticated and hackers are able to precisely time attacks to target a system. 

Some experts said that to be successful, the state needs more timely visibility into attacks on local governments. One proposal is to pass a law requiring local governments to report when they have data breaches within 24 hours. State agencies are already required to report incidents to state Information Technology Services

“You can’t protect what you don’t know about,” said Mark Butscher, a security specialist with Google. 

Cybersecurity tools and professionals are not cheap. Additionally, state and local governments are competing for these highly specialized personnel with private industry and the federal government, which often pay more. Suggestions included working with community colleges and universities to develop a pipeline and funding cybersecurity as a recurring expense in the state budget.

“Cybersecurity is no longer a back-office expense, it is a foundational requirement for public service continuity,” said Tidwell. 

The committee said it would first focus on policies around state agencies. This could include consolidation, increasing visibility of attacks and making sure state agencies are following policies. However, disparate and numerous city and county governments present a hard challenge. 

Legislators are also interested in how to enforce cybersecurity laws and punish crimes, although some speakers urged the committee to focus less on criminal laws and more on the organization and coordination of various groups.

Sen. Tyler McCaughn, a Republican from Newton and one of the committee’s chairmen, said he had more questions, including procurement, reporting and enforcement.

“I’m going to give you a heads up. We’re not done,” McCaughn said, “We’re not done with this year. We’re not done with these hearings. Because I feel really confident that an enforcement piece will be our next discussion.”