Public Exposure: State and Local Government Is the Only Sector Where Attacks Are Getting Worse

While every other sector got a break from attackers in 2026, state and local government saw a 242% increase. Here's why.

There’s a running joke in cybersecurity that government IT is where technology goes to retire. Ancient portals held together with custom middleware and institutional memory. Patch cycles measured in fiscal years, not weeks. Systems that predate the smartphones of the people using them. 

It’s funny until you look at the numbers.

In the first half of 2026, state and local government recorded a 242% year-over-year (YOY) increase in IPS attack volume. Every other sector SonicWall tracks (manufacturing, healthcare, financial services, education, retail, professional services) saw attacks decline, some by more than half. SLED went the other way. And it’s not something to ignore.

The Wrong Side of Every Trend

The 242% increase didn’t happen because attackers suddenly discovered government networks. It happened because while every other sector was tightening its posture and making attacks incrementally harder, government’s structural vulnerabilities stayed in place. Budget-constrained IT teams, a patchwork of legacy public-facing systems, and inconsistent patch cycles across departments made the public sector a growing target precisely when it was becoming a shrinking one everywhere else.

The per-device numbers reinforce this. State and local government logged 162,062 IPS hits per firewall in the first half of 2026, higher than any enterprise vertical in this cycle. These aren’t large, well-resourced organizations with dedicated security operations centers absorbing that volume. These are county offices, municipal agencies and state departments, many of them running the same web portals they launched fifteen years ago.

12.8 Million Hits on 18 Devices

The most alarming specific finding in the brief isn’t the headline number. It’s a single signature, Web Application Directory Traversal 31, that generated 12.8 million hits concentrated on just 18 firewalls globally, 12 of them in North America. That’s an extreme concentration with no equivalent anywhere else in this dataset.

The GoodTech Telnet anomaly in financial services generated similar patterns earlier in the year. In both cases, a small number of specific devices are generating detection volumes comparable to entire industry fleets. In government’s case, those devices are almost certainly aging portal, permitting, or records infrastructure that predates modern hardening practices.

The brief doesn’t mince words on this one: it warrants direct investigation now, not the next audit cycle.

The Quiet Part

Here’s the piece of the SLED threat picture that should keep government IT leaders up at night more than any ransomware headline: ransomware volume is actually down 74% year over year. That’s not good news.

Nearly 90% of malware detected on government networks in H1 2026 was Trojan-class: credential-stealing, persistence-establishing software designed not to destroy anything, but to stay hidden and wait. The playbook isn’t encrypt and demand payment. It’s get in, stay quiet, and either sell the access or use it later. Municipal and county governments hold citizen data, financial records, law enforcement systems, and permitting databases. That’s not a ransomware target. That’s an intelligence and identity theft target.

Log4Shell is still generating 19.5 million hits across 585 government firewalls more than four years after disclosure. The infrastructure carrying those unpatched Java instances isn’t going to patch itself.

The Architecture Is the Problem

State and local agencies frequently share network infrastructure across departments (finance, permitting, public safety, parks), often behind a single VPN concentrator that grants broad access the moment credentials are validated. A stolen login for one department’s application doesn’t stay contained. It unlocks the network behind it.

That’s the structural reality the 242% number is exploiting. The data doesn’t describe bad luck. It describes a predictable outcome from an architecture that was never designed for the threat environment it’s now operating in.

The full picture is in SonicWall’s 2026 State and Local Government Protect Brief, including the complete attack breakdown, the Directory Traversal anomaly analysis, and a five-point action plan built specifically for public sector IT teams.