State and local government intrusion-prevention detections rose 242% in the first half of 2026 compared with the same period last year, according to SonicWall research that points to heavy targeting of public-facing websites and older government systems.
The cybersecurity company’s analysis covered 312.5 million high- and medium-priority intrusion-prevention hits across 1,929 active firewalls. SonicWall announced the findings on Oct. 20 in a press release.
Education followed a different trajectory. The brief lists education among six sectors where intrusion-prevention volume declined, with decreases across those sectors ranging from 17% to 56%.
The findings reflect observed security events from SonicWall’s global network of sensors identified with state and local government and education environments. The measurements count detections rather than confirmed breaches.
Budget-constrained IT teams, a wide mix of legacy public-facing systems, and inconsistent patch cycles across departments make state and local government a growing target, according to the brief.
“State and local IT teams are being asked to defend expanding digital footprints with limited resources, relying on aging public-facing systems and inconsistent departmental patch cycles,” said Michael Crean, SonicWall’s senior vice president of managed services. “Attackers recognize these structural friction points, and they are actively exploiting them.”
Web attacks accounted for 85.1% of state and local government intrusion-prevention volume, or 265.8 million hits. SonicWall described much of that activity as probing public-facing portals, permitting systems, and case and records management platforms.
Among those web attacks, one directory traversal detection signature generated 12.8 million hits across just 18 firewalls globally, including 12 in North America.
“A handful of government web-facing systems are generating detection volumes comparable to an entire fleet elsewhere, almost certainly aging portal, permitting or records infrastructure that predates modern hardening practices,” the brief notes.
“This is not a background signature to revisit at the next audit cycle. It warrants direct investigation now.”
Detections tied to Log4Shell, a vulnerability in Apache Log4j2 software, reached 19.5 million across 585 government firewalls. SonicWall cited the activity as evidence of continuing exposure in Java-based government systems more than four years after the vulnerability’s disclosure.
The company recommended that agencies inventory Java-based case management, permitting, and records systems and establish schedules to patch or isolate them. Where patching is not feasible, the brief recommends web application firewall rules and network isolation.
Malware detections reached 57.7 million across state and local governments in the first half of 2026, up 8.6% year over year. Ransomware detections declined 74% to about 4 million hits across 51 firewalls globally. Six ransomware families remained active, led by JScript, Gandcrab, and Ryuk.
