America turns 250 this year, and CISA has tied this year's Cybersecurity Awareness Month to the milestone with its national theme, "Securing the Next 250." The framing hits differently in state and local government than anywhere else. Agencies are being asked to protect the next two and a half centuries of public services, while many still depend on systems installed two or three decades ago.
When Oklahoma's governor proclaimed the month, the state's CIO described the anniversary as a chance to think about the digital foundation being built for the future. For most cities, counties, and school districts, that foundation already exists. The harder question is whether it can hold.
Old systems aren't automatically dangerous. A well-maintained, well-understood platform can run safely for years. The risk comes from what tends to build up around legacy technology in the public sector:
IT leaders know this. In a MeriTalk study of state and local government IT decision-makers, 93% said they were concerned about the state of their legacy applications and systems, and 96% believed critical infrastructure is at risk because of them. Yet more than one in three (36%) said their leadership still operates with an "if it isn't broke, don't fix it" approach.
Springbrook Software's 2026 survey of nearly 350 local government professionals found that awareness of ransomware attacks fell from 86% to 70% in a single year. The attacks didn't slow down. They became background noise. Routine cybersecurity training slipped from 99% to 72% over the same period, and 54% of local governments still run multiple, fragmented systems that widen the attack surface and make patching harder to keep up with.
The cost of that drift is measurable. The Information Technology and Innovation Foundation counted 525 ransomware attacks on federal, state, and local government entities between 2018 and 2024, with an estimated $1.09 billion in downtime. In government, downtime isn't an abstraction. It's delayed permits, closed offices, and residents who can't pay a bill or reach a service they depend on.
Rip-and-replace modernization is expensive, slow, and often impossible to fund in a single budget year. Resilience doesn't require it. Agencies that hold up well against modern attacks tend to practice four disciplines consistently.
1. Know what you're running. You can't protect, patch, or retire what you can't see. A current inventory of systems, owners, and vendor support status is the foundation for every other decision.
2. Contain what you can't replace yet. When a legacy system has to stay, network segmentation keeps it from becoming an open door. Isolating end-of-life platforms and operational technology from general user networks limits how far an attacker can move if one system is compromised.
3. Operate continuously, not occasionally. Patching, monitoring, and configuration management have to happen every week, not when someone finds spare time. This is the area where lean public sector IT teams fall behind first.
4. Plan for recovery before you need it. Tested, isolated backups and a documented disaster recovery plan turn a ransomware incident from a weeks-long outage into a recoverable event.
None of these are one-time projects. They're operating disciplines, and that's exactly where most agencies struggle.
A mid-sized county might have a small IT team responsible for everything from help desk tickets to firewall rules to the network supporting emergency dispatch. Asking that same team to run continuous patching, monitor segmented legacy environments, and maintain tested recovery plans isn't realistic. Something gives, and it's usually the maintenance work nobody sees until something breaks.
Managed infrastructure services change that equation. Instead of competing for scarce security talent or waiting for the next budget cycle, agencies can extend their team with engineers who manage network architecture, segmentation, patching, monitoring, and backup and recovery as an ongoing service, with predictable costs that fit public sector budgeting.
That's the model Tec-Refresh uses with state and local agencies. Our infrastructure team works alongside in-house IT staff to keep legacy systems contained and maintained, so the people who know the community's needs best can spend their time on the services residents rely on. For agencies that aren't sure where their biggest gaps are, a Cyber Asset Risk Assessment is a practical first step toward a complete inventory.
CISA's theme looks centuries ahead, but the decisions that matter most get made in the next 12 months: which systems get segmented, who's watching the network at 2 a.m., and whether anyone has tested the backups lately.
Agencies that treat Cybersecurity Awareness Month as the start of a year-round operating plan, rather than a month of posters and reminders, will be in a far stronger position when the next incident lands. Building to last doesn't take a 250-year plan. It takes a reliable one.