Government Cybersecurity Statistics

The services sector experienced 45 disclosed attacks (15%) and government experienced 30 disclosed attacks (10%) in Q2 2026.

58% of federal IT and cybersecurity decision makers report their agencies have deployed or are piloting AI agents

28% of federal IT and cybersecurity decision makers express high confidence in their ability to deploy AI agents securely

In H1 2026, one government entity confirmed it paid a ransom while 16 government entities said they did not pay.

The median ransom demand in H1 2026 was $100,000, which is one-fifth of the H2 2025 median of $500,000.

The United States accounted for 31% of government ransomware attacks in H1 2026, with 58 of the 187 attacks, representing a 23% decline from 75 attacks in H2 2025.

72% of local and state government organizations paid the ransom, the highest payment rate among sectors.

Vulnerabilities account for 56.4% of critical exposures in Government.

43% of Public Sector organizations experience access revocation failures.

20% of Public Sector credential revocations are performed manually, which is more than double the manual revocation rate in the IT/Technology sector.

Energy, oil/gas, and utilities reported an 80% breach rate and federal/central government report a 78% breach rate, the highest across industries surveyed.

Government entities experienced 32 publicly disclosed ransomware attacks (12%) and the technology sector experienced 28 attacks (11%) in Q1 2026.

63% of CISOs describe themselves as not very confident in the ability of local government and public higher education to secure public data, up from 35% in 2022.

Roughly one-fifth of CISOs indicate their states are moving toward a "whole-of-state" approach to cybersecurity.

49% of state CISOs name implementing effectiveness metrics as a top cybersecurity initiative, up from 25% in 2024 and 15% in 2022.

36% of financial services organisations and 36% of IT & technology organisations report modernising most or all core systems, compared with 12% of public sector organisations and 19% of industrial organisations

Government services have 40% consumer trust

Government’s share of total attacks increased from 5% to 12% year-over-year, with an average attack size of 5.5 Gbps.

Between January 1 and December 31, 2025, government organizations worldwide faced the highest number of threat campaigns, with 274 attacks targeting various federal, state, and municipal bodies.

The government sector ranked as the second most targeted industry in February, with organizations experiencing 2,714 weekly attacks on average, reflecting a 2% year‑over‑year increase.

Government services are the primary target in 38.8% of all claimed hactivism attacks.

The most impacted industries by initial access brokers in LATAM in 2025 were national government, agriculture and food and beverage production and education.

1.6% of public sector agencies report broad AI deployment across departments.

57% of public sector agencies are actively exploring and learning about AI.

78% of security leaders in government, defense, and critical services cite outdated infrastructure as a primary source of cyber vulnerability.

53% of government IT security leaders rely on manual data transfer processes.

45% of security leaders in government, defense, and critical services cite managing identity and authentication across multiple domains as the biggest challenge to securing access to mission data.

16% of public sector agencies are piloting small AI projects.

In Q3 2025, commerce received 88% of crawler traffic, while the Public Sector received 96%, and Education had the highest fetcher volume at 77%

69% of cyber incidents in 2024 targeted central governments in the EU.