IC Workforce & Organization — 2026-05-30

SANS Survey Finds Only One-Third of Government Cybersecurity Programs Fully Funded as Workforce Gaps Persist

BLUFGovernment cyber programs have cleared the governance bar but stall at operational execution, leaving threat detection and incident response, the functions where intrusions succeed or fail, chronically under-resourced.

The SANS Institute's 2026 Cybersecurity Readiness in Government Survey, drawing on responses from 417 federal, state, and local practitioners, found only one in three government cybersecurity programs is fully funded 12. Sixty-three percent of respondents cited budget limitations as their primary obstacle, and more than half reported difficulty recruiting and retaining qualified personnel 123. Staff training and awareness and threat detection and response ranked as the most resource-constrained functions 13. Fifty-five percent of surveyed agencies report a fully implemented strategy, but only 22% rate themselves capable of executing it at scale, a gap survey author Ryan Nicholson attributed directly to funding shortfalls and workforce constraints 12.

Analysis
Execution capacity, not governance, is the binding constraint on government cyber defense. Threat detection and incident response, the functions on which intrusion success or failure turns, rank as the most resource-constrained areas, meaning agencies face greatest exposure precisely where intrusions are caught or missed. The 33-point gap between agencies claiming a fully implemented strategy and those rating themselves capable of executing it at scale reflects a sector-wide plateau: basic governance is in place, operational integration is not. Budget trajectories under current discretionary constraints offer no structural relief absent deliberate appropriations action. Coverage traces entirely to a SANS press release. Agencies may also frame readiness pessimistically when answering a vendor questionnaire, putting the real shortfall below reported levels.

5 sources