An alarming 21 percent of government organizations only discovered ransomware once encryption had already begun, highlighting that ransomware is becoming harder to detect and easier to deploy under the radar at scale. Over the past two years we have seen local, state, and federal government and municipal organizations fall victim to devastating ransomware attacks – from Nevada, to St. Paul, to Foster City – and increasingly being left at a disadvantage when it comes to detection.
Just recently water systems in Minnesota were also targeted in cyberattacks, allegedly attributed to Iran, showing that it isn’t just ransomware being used to target government-operated infrastructure. This signals how government organizations are entering a new phase of cyber risk where AI-powered applications, increasingly complex environments, and sophisticated attackers have dramatically shortened the time between compromise and impact. The greatest challenge is no longer simply preventing ransomware and cyber attacks, it’s detecting malicious activity before the attack is fully executed.
Government’s Cybersecurity Challenge Has Fundamentally Changed
Today’s attacks often move too quickly for traditional security models that rely on perimeter defenses or known indicators of compromise. Globally, the problem is even more pronounced: 49 percent of organizations didn’t detect ransomware until data exfiltration had already begun or later, and roughly 15% didn’t realize they had been compromised until they received a ransom demand.
Unfortunately, AI only is accelerating this challenge on both sides of the equation. As government agencies rapidly adopt GenAI applications, AI agents, and agentic infrastructure to improve operations, each new AI-powered tool introduces additional identities, and thus, more risk.
At the same time, attackers are using AI to automate reconnaissance, identify vulnerabilities faster, and shorten the time between initial access and ransomware deployment. In fact, a majority of global respondents identified AI agents, agentic infrastructure, and GenAI applications as their single biggest cybersecurity risk, ranking above public cloud environments and third-party integrations. Meanwhile, 85 percent of organizations reported experiencing a security incident, data exposure, or near miss tied to AI systems, demonstrating that AI risk is no longer theoretical.
Public Sector Complexity Makes Early Detection Harder
Public sector organizations face unique obstacles that make early detection especially difficult. They are often plagued with hybrid and multi-cloud environments, a mix of IT and OT infrastructure, and sprawling third-party ecosystems. They also often lack the proper resources needed to monitor and defend against the blind spots that attackers are more easily learning how to exploit.
Given that these agencies are responsible for delivering essential public services, even brief disruptions can have consequences that extend far beyond financial loss, affecting public safety, citizen trust, and government operations.
This added layer of stress and immense operational pressure forces government leaders into difficult recovery decisions when a breach is discovered only after encryption has begun. Even though the average ransom payment fell to $2.8 million, the percentage of organizations paying ransoms jumped from 70 percent to 83 percent last year. As more organizations detect cyber incidents in the final stage of the process, they are left with no choice but to make a payment. The increase in payment frequency reflects not simply more aggressive attackers, but the growing cost of detecting threats too late.
Building Resilience Means Prioritizing Visibility and Early Detection
Government cybersecurity strategies must evolve beyond the assumption that every attack can be prevented. Instead, agencies should prioritize continuous visibility across networks, cloud environments, and east-west traffic so they can identify suspicious behavior before attackers achieve their objectives.
These security teams should focus on reducing attacker dwell time by strengthening their ability to detect lateral movement, abnormal communications between systems, and other behavioral indicators that signal an active compromise. Faster detection will provide more opportunities to isolate affected systems, protect critical services, and avoid ransomware encryption altogether. Look at the SolarWinds incident, for example, in which the attackers were able to remain undetected while they traveled through the network in silence, going unnoticed until it was too late.
Attackers commonly evade detection by using encrypted communication channels, mimicking legitimate user workflows, and leveraging valid privileged accounts, techniques that traditional perimeter-based tools often struggle to identify. Ultimately, resilience in the AI era will be measured less by whether agencies experience cyberattacks, which are increasingly inevitable, and more by how quickly they can detect, contain, and recover from them. Organizations that invest in visibility and rapid response will be better positioned to protect themselves.
The Bottom Line
These ransomware findings are a warning about more than one attack technique; it signals that government cybersecurity must adapt to a faster, AI-driven threat landscape. As AI expands both the attack surface and attackers’ capabilities, agencies can no longer measure success solely by blocking threats at the perimeter. Closing the visibility gap, reducing attacker dwell time, and detecting threats before encryption begins will be essential to protecting critical services, maintaining operational continuity, and preserving public trust.
The author, Sarah Cleveland, is Senior Director of Federal Strategy at ExtraHop.