Sacramento, California – California’s next major cyber threat may not arrive as a clumsy email filled with spelling errors. It could look polished, sound convincing and move at machine speed.
That shift is driving the state’s new cybersecurity strategy, Cal-Secure 2.0, an updated roadmap designed to protect government systems as artificial intelligence gives attackers more powerful tools.
Governor Gavin Newsom announced the plan as the next phase of California’s statewide cybersecurity effort, launched in 2021. The new version is intended to help agencies secure the digital systems behind everyday public services, including healthcare, benefits, transportation and public safety.
“Californians expect their government to protect not only their personal information, but also the essential services they rely on every day,” Newsom said. “As cyber threats evolve, California is evolving with them.”
State officials said cyberattacks are becoming more frequent and sophisticated. Criminals can use AI to produce believable scams, identify weaknesses faster and target government agencies or critical infrastructure with greater precision.
Cal-Secure 2.0 is organized around three priorities. The first is workforce development, with an emphasis on recruiting, training and retaining cybersecurity professionals across state government. The second is stronger coordination, allowing agencies to share information, learn from attacks and respond faster. The third is technology modernization, including investments in improved security tools and preparation for emerging technologies such as AI.
“Cyber threats don’t stand still, and neither can we,” said Chris Given, California’s chief information officer and director of the California Department of Technology. He said the strategy gives agencies practical guidance to adapt and better protect essential services.
Unlike the original plan, the updated strategy gives individual agencies more freedom to concentrate on the risks most relevant to their operations. At the same time, they will work within a common statewide framework aligned with national cybersecurity standards.
California State Information Security Officer Vitaliy Panych said the goal is to help every state entity identify its largest vulnerabilities, strengthen defenses and respond quickly when problems arise.
The cyber plan also fits into California’s broader push on privacy and emerging technology. The state has approved measures requiring browsers to offer a single opt-out from third-party data sales, making account cancellation clearer for social media users and expanding transparency requirements for data brokers.
California has also developed the Delete Request and Opt-out Platform, known as DROP, which is intended to make it easier for residents to stop data brokers from selling their information. Executive orders issued in 2023 and 2026 have addressed responsible AI adoption and government procurement.
With Cal-Secure 2.0, the state is preparing for a threat environment in which attacks may change faster than traditional defenses. The strategy’s test will be whether California’s agencies can modernize at the same pace.