Over the past several weeks, I have written about two developments that most cybersecurity commentary treats as separate stories. The first was the escalation between the United States, Israel, and Iran, following the documented pattern of state-sponsored actors pivoting to civilian infrastructure during kinetic conflict. The second was the White House National Cyber Strategy, which formally named state, local, tribal, and territorial organizations as critical nodes in the national cyber defense posture, and then declined to close the readiness gap those organizations have carried for years. Both pointed in the same direction: the threat is active, the federal acknowledgment is not an operational solution, and the organizations left holding that responsibility are the least equipped to carry it.
What neither post named directly is who absorbs the cost when those organizations fail. The named target in a breach is the institution, but the people who pay are the residents, patients, and families who depend on it: populations navigating public benefits systems, accessing care through community health clinics, relying on housing assistance that runs through a city or county network. For them there is no backup system. When the institution goes offline, the service is simply gone.
Thirty years at the intersection of technology and civic infrastructure has shown me this asymmetry in practice. A ransomware attack on a regional hospital does not just compromise data; it delays care, forces ambulance diversions, and erodes the institutional trust that takes decades to build. A network failure at a nonprofit serving vulnerable populations can suspend operations entirely, eliminating services that have no substitute. What a well-resourced enterprise recovers from in hours can take a civic institution weeks, and the people waiting on the other side of that window are already operating without reserve.
The current environment makes this more urgent. When nation-state actors and their proxies target civilian infrastructure, the selection logic is deliberate: disrupting local government, healthcare, and social services produces visible, cascading damage without requiring military precision. The goal is not destruction — it is to make the state appear unable to protect its own people. The organizations closest to daily civic life, and least equipped to defend themselves, are the preferred attack surface precisely because the damage is immediate and the recovery is slow.
There is a version of civic leadership that expands transit, funds affordable housing, and drives workforce development. There is another version that secures the hospitals, government agencies, and social service organizations those communities depend on. For most of my career those felt like different conversations happening in different rooms, and thus recognizing that they are not changes how the work feels and what it demands.
The populations are the same. The stakes are the same. And the through-line, that the people with the least margin are always the last to be protected, becomes impossible to unsee once you see it. Cybersecurity has always been a social policy question. It has just never been welcomed into that conversation. That is the work now. Not the technology. But the people on the other side of it.