OPINION
A government agency I work with lost nearly a million dollars and never heard an alarm. No ransom note, no locked-up servers. Attackers slipped into a handful of staff email accounts, watched how the agency moved money for a couple of months, and then quietly rerouted a wire meant for an affordable-housing project. Nobody caught it until the money was already gone.
This wasn't a federal department or a Fortune 500 company. It was a local housing authority, the kind of place that helps families make rent. And here's the part I keep coming back to: The breach isn't how the story ends. It's what finally pushed the agency to stand up a real security program, and today it is one of the better-defended shops I work with. That turnaround is the whole point. The gap is real, but it closes faster than most people expect once someone decides to close it.
I've worked across 82 engagements in 46 states now, and I've watched that same turnaround happen too many times to call it luck. Local governments hold the same data the federal government does (i.e., Social Security numbers, medical records, criminal-justice files, payroll), usually with a fraction of the people to protect it. More than 80% of state and local organizations run security with fewer than five dedicated staff. Agencies like that aren't careless; they're outnumbered. Resourcing problems, though, can be designed around, and here's what I've actually seen work.
Start With Basic Questions
Start with the exposure, not the tool. Every engagement I take begins with the boring questions: What are you running, what data are you sitting on, where are you actually exposed, before anyone brings up a product. A county with one administrator covering 14 departments does not need the same plan as a school district, and the hour spent seeing that difference is what decides whether any of it is still running a year later.