Reactive vs. Proactive Security in 911
Public Safety Answering Points are facing an unprecedented surge in cyberattacks — ransomware incidents targeting local government have grown over 150% since 2019, and the average breach now costs $2.07M for public sector organizations. Yet most PSAPs still operate under a reactive security model: waiting for an incident, then scrambling to respond. This session examines why that approach is failing and what a proactive security posture actually looks like for 911 centers. Attendees will explore real-world case studies of PSAP and ECC breaches, review current threat trends specific to NG911 infrastructure, and learn a practical framework for shifting from detection-after-the-fact to continuous threat monitoring and prevention. Topics include mean-time-to-detect vs. mean-time-to-respond benchmarks across the industry, the expanding attack surface introduced by NG911 and ESInet migrations, compliance gaps in NIST and CISA frameworks as applied to public safety, and actionable steps centers of any size can take today to build a proactive security program — even with limited budgets and staff.
Objectives:
1. Identify the top cyber threats currently targeting PSAPs and ECCs and understand why 911 centers are disproportionately at risk
2. Compare reactive vs. proactive security models using real breach data, MTTD/MTTR metrics, and cost-of-breach analysis
3. Assess the new attack surface introduced by NG911, ESInet, and cloud-based CAD/RMS migrations
4. Leave with a practical, budget-conscious roadmap for implementing continuous monitoring, threat hunting, and proactive defenses at your center