California has taken a bold step toward advancing its cybersecurity measures by integrating artificial intelligence (AI) into the defense systems protecting essential services such as power, water, and transportation networks. This initiative, touted as groundbreaking by state officials, aims to establish the nation’s first comprehensive “AI Cyber Defense Program.”

On August 10, 2026, Governor Gavin Newsom publicly directed state agencies to implement this program under the auspices of the California Cybersecurity Integration Center (Cal-CSIC). This directive included mandates that local governments and critical infrastructure operators also adopt AI-enhanced defensive measures. Furthermore, to foster accountability and vigilance, the initiative decrees that every state agency appoint an AI cybersecurity officer.

Ann Cleaveland, who leads the UC Berkeley Center for Long-Term Cybersecurity, emphasized the urgent need for states to arm their defenders with AI technologies. With attackers increasingly leveraging advanced AI tools, it is essential that defenders are not left at a competitive disadvantage. “You can’t put defenders at a disadvantage by withholding AI tools that are available to attackers,” Cleaveland stated. She underscored that states require such instruments to keep pace with the speed at which AI can identify vulnerabilities within systems.

One of the pressing issues states face is the growing financial burden of cybersecurity measures, especially in light of diminishing federal support. Federal funding for initiatives like the Multi-State Information Sharing and Analysis Center, which had provided vital monitoring and threat intelligence services to state and local governments at no cost, ceased in late 2025. This absence has pushed many jurisdictions to seek paid alternatives, further straining budgets already stretched thin. Adding to the complexity, the State and Local Cybersecurity Grant Program, having been initially funded by $1 billion under the Bipartisan Infrastructure Law, is nearing the end of its current phase. While the House has moved to extend its authorization, the Senate’s actions have yet to reflect the same urgency.

“It’s a lot to ask of states to fill these gaps,” Cleaveland remarked, pointing out the overwhelming challenge of securing funding to mitigate emerging cyber threats. She reiterated the necessity for federal support to be reinstated and expanded, arguing, “States are where the action is happening now.”

The urgency of this situation is underscored by a recent cyberattack, believed to be linked to Iranian operatives, that targeted over 30 municipal water systems across Minnesota—a situation that has now been reported in at least a dozen states. Authorities including the FBI, Environmental Protection Agency, and the Cybersecurity and Infrastructure Security Agency (CISA) have issued warnings about incidents where attackers are exploiting internet-exposed industrial controllers at water and wastewater utilities.

Cal-CSIC, which will play a pivotal role in the new program, serves as the state’s threat intelligence and incident coordination hub. It operates under the California Governor’s Office of Emergency Services. Caroline Thomas Jacobs, Director of Cal OES and the state’s Homeland Security Advisor, stressed that cyberattacks pose a significant threat, potentially incapacitating critical services such as water supplies, power distribution, transportation networks, and emergency communications. She indicated that the new program would enable partners to identify threats more swiftly and effectively.

The state intends to utilize AI for a variety of purposes, including vulnerability detection, strengthening network defenses, and enhancing incident response capabilities. However, specific details regarding the models or vendors to be engaged in the program have yet to be released.

Governor Newsom’s previous executive orders regarding AI, both in 2023 and 2026, have established a foundational framework for the integration of AI within government operations. Additionally, Senate Bill 53, enacted in 2025, mandates that leading AI developers disclose safety frameworks and report critical safety incidents to state authorities. This legislative movement illustrates California’s commitment to not only adopting advanced technologies but ensuring they are implemented safely and effectively to fortify the state’s critical infrastructure.