SonicWall has released its 2026 State and Local Government (SLED) Protect Brief, a vertical-specific companion to the SonicWall 2026 Cyber Protect Report. The report found that state and local government attack volume rose 242% year-over-year, with over 300 million High/Medium priority intrusion prevention (IPS) in the first half of 2026, revealing extreme volume pivot absorbing intrusion attempts across aging public portals and unpatched legacy systems.
Across most industries, attackers have grown more selective, trading volume for precision. State and local government broke that pattern entirely. Budget-constrained IT teams, a wide mix of legacy public-facing systems, and inconsistent patch cycles across departments are making the sector a growing target.
"State and local government is the one place where the data does not show attackers backing off," said Michael Crean, SonicWall SVP of Managed Services. "State and local government networks are taking the brunt of attacker focus. State and local IT teams are being asked to defend expanding digital footprints with limited resources, relying on aging public-facing systems and inconsistent departmental patch cycles. Attackers recognize these structural friction points, and they are actively exploiting them."
Recorded 162,062 IPS hits per firewall, higher than any enterprise vertical in this cycle. Outside North America, threat profile shifts: in EMEA, SIPVicious VoIP fraud signatures account for roughly 20% of IPS volume, six times North American share, while in UK four of top 15 signatures are cross-site scripting variants.
Apache Log4j2 (Log4Shell) generated 19.5 million hits across 585 government firewalls, more than four years after vulnerability was disclosed and emergency-patched industry-wide. Java-based case management, permitting and records systems common in state and local government continue to run unpatched instances at scale, a sign of patch cycles that lag disclosure timelines by years, not weeks.
Malware tells quieter story. Nearly 90% of 57.7 million malware detections were Trojan-class, software designed to maintain persistent access that pays off later through follow-on ransomware, data exfiltration or resale of stolen credentials. Ransomware made up only 7% of malware volume, and its fragmented landscape suggests opportunistic, automated targeting rather than one outbreak. Municipal and county governments remain attractive targets because service disruption creates outsized public pressure to pay.
Many state and local agencies share network infrastructure across finance, permitting, public safety, parks and recreation, often behind single VPN concentrator granting broad access once credentials validated. Zero Trust changes architecture, not just policy: access granted at application level tied to continuously verified identity and device posture.
"Government networks were built to share, and attackers are exploiting exactly that," said Crean. "Public-sector IT teams are being asked to do more with less while defending systems that were never designed for today's threat landscape. Zero Trust does not require agencies to replace everything at once. It requires that one compromised credential never again become a compromised department, or a compromised city."
SonicWall Cloud Secure Edge delivers that model, and brief outlines five actions agencies can take now, from replacing flat VPN access to maintaining offline, immutable backups with EDR rollback.
About SonicWall
SonicWall is a partner-first unified cybersecurity portfolio that helps SMBs, MSPs, and IT teams consolidate network, endpoint, cloud, and threat response across hybrid environments. For more than 30 years, SonicWall has championed partner-first model combining purpose-built technology, cloud-delivered security services and real-time threat intelligence.
