NLC Partners with CyberAlliance on AI for Local Gov Cyber
NLC Offers AI-Powered Cyber Platform to Local Governments
Related Entities
Organizations
Products & Tech
Other
Full Report
Executive Summary
The National League of Cities (NLC), a prominent advocacy organization for U.S. municipalities, has announced a partnership with cybersecurity firm CyberAlliance. This collaboration, revealed on August 24, 2026, will provide local governments with access to an Artificial Intelligence-powered cybersecurity platform named Sally AI. The platform is designed to deliver automated risk assessments, cyber benchmarking, and strategic guidance to help resource-strapped cities and towns improve their cyber resilience. The move comes as local governments grapple with a 42% increase in cyber incidents and the recent loss of critical federal funding.
Program Details
The NLC's initiative aims to fill a critical gap for its members. The partnership with CyberAlliance will offer:
- Sally AI Platform: An AI-driven tool that provides cybersecurity risk assessments tailored to municipal environments.
- Resilience Guidance: Actionable strategies and recommendations to improve a city's security posture.
- Cyber Benchmarking: Services that allow a municipality to compare its cybersecurity maturity against its peers.
- Workshops: Educational sessions to help local government staff understand and implement best practices.
Context and Motivation
This program is a direct response to two converging trends:
- Rising Attacks: Local governments have become a prime target for threat actors, particularly ransomware gangs, who see them as having critical services but weak defenses. A 42% increase in incidents was noted in 2025.
- Reduced Federal Support: The Trump administration cut federal funding for the Multi-State Information Sharing and Analysis Center (MS-ISAC), a resource that had been a cornerstone of cybersecurity support for state and local governments since 2003. This left many smaller municipalities without access to affordable threat intelligence and incident response support.
In June, a coalition of local government organizations highlighted this funding crisis by urging Congress to allocate $300 million for the State and Local Cybersecurity Grant Program for fiscal year 2027.
Impact Assessment
The NLC's program could provide a vital lifeline for many U.S. towns and cities. By leveraging AI, the Sally AI platform aims to provide scalable and affordable expertise that many local governments cannot afford to hire in-house. A successful rollout could lead to:
- Improved baseline security across numerous municipalities.
- A better understanding of systemic risks facing the public sector.
- A reduction in successful cyberattacks against local government services (e.g., schools, utilities, emergency services).
However, the effectiveness of the program will depend on the platform's quality, the level of adoption by NLC members, and the ability of under-staffed IT departments to act on the recommendations provided.
Guidance for Local Governments
Municipal leaders interested in this program should engage with the NLC to understand the specifics of the offering. Key questions to ask include:
- What is the cost structure for accessing Sally AI and the associated services?
- What data is required for the AI risk assessment, and how is that data protected?
- Do the recommendations align with established frameworks like the NIST Cybersecurity Framework?
- What level of technical expertise is required to implement the platform's suggestions?
Timeline of Events
Timeline of Events
The National League of Cities announces its partnership with CyberAlliance.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.