Key Takeaways
- The National League of Cities (NLC) is partnering with CyberAlliance to offer municipalities cybersecurity risk assessments, workshops, benchmarking, and access to the AI‑driven Sally AI platform.
- This initiative responds to a 42 % rise in cyber incidents targeting local governments in 2025 and growing concerns among state CIOs about their ability to safeguard critical data.
- The program fills a gap left after the Trump administration eliminated federal funding for the Multi‑State Information Sharing and Analysis Center (MS‑ISAC), a resource municipalities had relied on since 2003.
- High‑profile attacks this summer disrupted services in Minnesota, California, and Washington, D.C., underscoring the urgency of bolstered defenses.
- Experts link the surge in threats to attackers’ increasing use of artificial intelligence and advocate for local governments to adopt AI‑based defenses as well.
- A coalition of local government groups has urged Congress to allocate $300 million for the State and Local Cybersecurity Grant Program in FY 2027, stressing that sustained federal investment is essential for baseline cybersecurity capabilities nationwide.
Overview of the NLC‑CyberAlliance Partnership
The National League of Cities has entered into a strategic collaboration with CyberAlliance, a U.S.–based cybersecurity firm that specializes in serving public‑sector clients. Through this partnership, municipalities will gain access to a suite of services designed to evaluate and strengthen their cyber posture. Core offerings include comprehensive risk‑assessment workshops, cyber‑benchmarking exercises that allow cities to compare their defenses against peers, and direct use of CyberAlliance’s proprietary AI‑powered intelligence platform, Sally AI. By bundling these resources, the NLC aims to provide a pragmatic, scalable pathway for local governments that may lack the expertise or budget to develop sophisticated cybersecurity programs on their own.
Motivation Behind the Initiative
Local government leaders have long described the Multi‑State Information Sharing and Analysis Center (MS‑ISAC) as a critical component of their cybersecurity infrastructure. Established in 2003, MS‑ISAC offered threat intelligence sharing, incident response coordination, and best‑practice guidance at no cost to participating jurisdictions. When the Trump administration withdrew federal funding for MS‑ISAC last year, many cities reported feeling exposed, prompting the NLC to seek alternative mechanisms to fill the void. The partnership with CyberAlliance is positioned as a direct response to that funding loss, aiming to restore a baseline level of situational awareness and defensive capability for municipalities nationwide.
Escalating Threat Landscape in 2025
Cybersecurity incidents targeting municipalities surged by an estimated 42 % in 2025, according to data cited by state chief information officers (CIOs). This sharp increase has eroded confidence among state IT leaders, who report growing doubts about their ability to protect essential public‑sector data—such as voter records, emergency services information, and financial systems—against increasingly sophisticated adversaries. The rise in attacks is not merely quantitative; the nature of threats has evolved, with adversaries employing more advanced tactics, techniques, and procedures (TTPs) that often bypass traditional signature‑based defenses.
High‑Profile Incidents Highlighting Vulnerabilities
The summer of 2025 witnessed several headline‑grabbing cyberattacks that crippled municipal operations across the United States. In Minnesota, a ransomware outbreak forced the shutdown of city hall services and disrupted public‑transport scheduling systems. California experienced a distributed denial‑of‑service (DDoS) attack that overwhelmed the online portals used for utility bill payments and permit applications, leading to widespread citizen frustration. Washington, D.C., faced a sophisticated intrusion that compromised internal communications networks, temporarily hindering coordination between emergency response agencies. These incidents collectively illustrate how a single breach can cascade into broad disruptions affecting public safety, civic trust, and municipal finances.
The Role of Artificial Intelligence in Both Attack and Defense
Analysts attribute much of the recent uptick in successful attacks to threat actors’ growing use of artificial intelligence. AI enables adversaries to automate reconnaissance, craft highly convincing phishing lures at scale, and rapidly adapt malware to evade detection. Conversely, the same technology offers defensive opportunities: AI‑driven platforms can analyze vast streams of network telemetry in real time, identify anomalous behavior indicative of compromise, and recommend or even execute mitigative actions faster than human analysts alone. CyberAlliance’s Sally AI exemplifies this defensive application, using machine‑learning models trained on global threat data to prioritize alerts, predict likely attack vectors, and suggest tailored remediation steps for each participating municipality.
Workshops, Benchmarking, and Knowledge Sharing
Beyond the AI platform, the NLC‑CyberAlliance program includes a series of interactive workshops aimed at building internal capacity. These sessions cover fundamentals such as patch management, multi‑factor authentication, incident‑response planning, and employee awareness training. Complementing the workshops, cyber‑benchmarking exercises allow cities to measure their security maturity against standardized frameworks (e.g., NIST CSF or CIS Controls) and peer groups, highlighting gaps that require investment or policy adjustment. By fostering a community of practice, the initiative encourages municipalities to share lessons learned, thereby amplifying the impact of individual investments.
Addressing the Funding Gap Left by MS‑ISAC’s Defunding
The elimination of federal support for MS‑ISAC created a noticeable void in the cybersecurity ecosystem for local governments. While some states have attempted to replicate MS‑ISAC functions through state‑level information sharing centers, the scale and breadth of the former national hub remain unmatched. The NLC‑CyberAlliance effort seeks to mitigate this gap by delivering a federally‑agnostic, yet nationally coordinated, set of tools and services. Importantly, the program is designed to be accessible regardless of a jurisdiction’s size or existing IT budget, with tiered service levels that can scale from small towns to large metropolitan areas.
Advocacy for Sustained Federal Investment
Recognizing that private‑sector partnerships alone cannot fully substitute for long‑term public funding, a coalition of local government organizations has turned to Congress for assistance. In June, the coalition sent a letter urging lawmakers to allocate $300 million for the State and Local Cybersecurity Grant Program in fiscal year 2027. The letter emphasized that persistent threats from nation‑state actors, ransomware syndicates, and other cybercriminals necessitate sustained federal investment to ensure every community—regardless of geography or wealth—can attain baseline cybersecurity capabilities. The appeal underscores the view that cybersecurity is a public good requiring collective stewardship.
Conclusion: Building Resilient Municipalities
The NLC‑CyberAlliance partnership represents a proactive, multifaceted response to an escalating cyber threat environment facing America’s cities, towns, and villages. By combining risk assessments, educational workshops, benchmarking, and an AI‑powered intelligence platform, the initiative aims to elevate municipal defenses while fostering a culture of continuous improvement. Simultaneously, the effort highlights the ongoing need for reliable federal support to complement private‑sector solutions. As local governments navigate an era where cyber resilience is integral to everyday operations, programs like this will be pivotal in safeguarding the essential services that underpin daily life and public trust.