U.S. state governments are taking on a larger role in cybersecurity to help protect local communities and essential services. Many states are building state-led cyber defense programs, including cybersecurity clinics, regional security operations centers (RSOCs), and state cyber corps programs to reduce costs, strengthen the local workforce, and improve cyber resilience.

Cyber defense programs in the U.S. as of April 2026 (Source: UC Berkley, CLTC)

Some states are expanding shared services, centralized procurement, cyber risk pools, and threat intelligence-sharing networks to help public service organizations access cybersecurity support and strengthen statewide defenses.

“Cyber defense programs are a smart investment for states because they can save taxpayer dollars, develop the local workforce, and strengthen community cyber defense. Such programs can be a cost-efficient way to help defend ‘target-rich, resource-poor’ organizations that provide essential services to U.S. communities but lack the resources to protect themselves from cyberattacks by criminals and nation-states,” Grace Menna, Senior Fellow, Public Interest Cybersecurity, at UC Berkeley’s CLTC, said.

The guide presents a roadmap for states to strengthen cybersecurity through shared intelligence, tools, training, and procurement processes. It covers cybersecurity clinics, where college and university students gain hands-on experience by providing free cybersecurity support to community organizations.

The roadmap includes RSOCs, which use teams of cybersecurity professionals and students to detect and respond to security incidents within a region, and state cyber corps programs, where volunteer cybersecurity professionals provide preventive and incident response services under state government oversight.

Cyber defense programs show return on investment

The guidebook says the impact of individual cyber defense programs increases when they operate as part of a broader ecosystem that connects multiple initiatives and resources. It links these programs to cost savings, workforce development, and stronger community protection.

These programs can reduce the cost of cyber incidents, lower the burden on taxpayers, and help states avoid losses tied to ransomware and other attacks. Strong cybersecurity programs can also support a state’s financial position by helping preserve or improve bond ratings.

The programs also help build cybersecurity skills by training students and professionals while expanding protection for organizations such as schools, hospitals, utilities, local governments, and nonprofits.

State cyber corps programs can generate between $1.4 million and $7.5 million in gross economic value annually while helping community organizations strengthen their defenses. RSOCs are estimated to generate between $1.1 million and $2.6 million annually, while cybersecurity clinics generate between $12,000 and $150,000 per year.

What makes cyber defense programs work

Successful cyber defense programs rely on stable funding, support from state leadership, and cooperation between government agencies, universities, nonprofits, and private organizations. Programs connected to broader state cybersecurity efforts and information-sharing networks can improve coordination and extend support to local communities.

Funding limitations, staffing shortages, administrative complexity, and maintaining long-term participation remain some of the main challenges for these programs. The guidebook describes efforts in Texas, Wisconsin, and New Jersey, where states are building larger cyber ecosystems that connect multiple programs, share resources and threat intelligence, and support community cyber defense efforts.