Cybersecurity Awareness Is Not Cybersecurity Readiness

By: Craig Dotson

Cybersecurity training belongs in every public safety organization. Verizon’s 2025 Data Breach Investigations Report found that about 60% of breaches involved a human element. Helping employees recognize suspicious messages, protect credentials, and report concerns remains essential. Yet training alone cannot tell an agency whether its dispatch network has an overlooked vulnerability or whether its recovery procedures will keep critical communications available during an incident.

Zetron’s 2025 cybersecurity survey offers a useful starting point. Drawing on 146 respondents, primarily from U.S. public sector organizations, the Cybersecurity Readiness Benchmark examines gaps that organizations may overlook when they feel confidence in their defenses. Among the findings, more than 30% reported an assessment gap, meaning they had not received a cybersecurity assessment in more than a year or had never had one.

For leaders responsible for mission critical operations, that gap raises a practical question: How can you prioritize cybersecurity investments without a current understanding of your risk?

Awareness needs a current risk baseline
Awareness helps people recognize threats and make safer decisions. Readiness requires an organization to understand its systems, evaluate its protections, and prepare to respond when those protections are tested. Both are necessary. They also answer different questions.
A training record shows that employees received instruction. A current risk assessment should help establish which assets support essential services, where vulnerabilities exist, and which improvements deserve attention first. That baseline gives leaders a foundation for decisions about staffing, technology and funding.

Training should continue alongside assessment, remediation and response exercises to help employees continually recognize threats. Each piece offers important contribution to cybersecurity readiness. For example, phishing training may help employees spot suspicious emails. But if the agency has added a new remote support connection since its last assessment, it also needs to review who can use that connection, what they can access and how their activity is monitored.

What the 30+% assessment gap means for prioritization
The 2025 Cybersecurity Survey overview describes nearly one-third of surveyed agencies as having gone more than a year without a cybersecurity assessment or never having one at all. Without a current baseline, agencies may struggle to distinguish an urgent exposure from an improvement that can wait until a later budget cycle. They may also rely on assumptions about protections implemented before a network change, system upgrade, or new vendor relationship.

For agencies managing limited resources, an assessment should produce a usable plan. Findings need to connect technical risk to operational consequences, identify responsible owners, and establish priorities. Leaders should be able to explain why an investment matters, what risk it addresses, and how progress will be verified.

The survey does not establish that every organization in this group is insecure. It points to a potential gap between what leaders believe is protected and what they have recently evaluated. An assessment is a starting point. Its value depends on the action that follows and on keeping the baseline current as systems and operations change.

Include the systems that keep operations moving
Public safety cybersecurity assessments and planning should account for call taking, dispatch, computer aided dispatch (CAD) radio communications and the network services that connect them. Operational technology also deserves explicit attention wherever connected systems monitor or control physical processes.

NIST’s Guide to Operational Technology Security, published in 2023, emphasizes operational technology’s distinctive performance, reliability and safety requirements. Those requirements matter when planning security changes in environments that must remain available 24/7/365.

For technology decision makers, this means bringing IT, communications personnel, operational leaders and service providers into the same planning process. Together, they should examine connections between systems, remote access arrangements, maintenance responsibilities, and recovery dependencies.

The discussion should include what happens during a disruption. Which functions must be restored first? Can staff use alternate workflows? Have backup communications and restoration procedures been exercised under realistic conditions?

These questions connect cybersecurity to the work agencies perform every day: receiving calls, coordinating responders and maintaining services their communities depend on.

Resolve uncertainty around data, insurance and ownership
Organizational blind spots often begin with unanswered questions. The survey summary highlights a significant finding: respondents are uncertain about whether their agency handled information subject to protective requirements. Understanding what data and information your organization handles and stores is a necessary step toward protecting it appropriately.

Leaders should establish what sensitive information their systems store or transmit, where it resides, and who can access it. That understanding should inform access controls, retention practices and conversations about applicable requirements.

Cyber insurance deserves a similarly specific review. Agencies should confirm their coverage, exclusions, notification procedures and requirements with the people responsible for the policy. Insurance planning should sit alongside prevention and recovery planning, with clear expectations about whom to contact during an incident.

Ownership also needs to be explicit. In an environment supported by agency personnel, shared government IT, and multiple vendors, responsibility can become fragmented. Assign owners to review alerts, address assessment findings, approve access and coordinate incident response. Document handoffs so an urgent decision doesn’t depend on finding the right person after a disruption begins.

Build a cybersecurity risk baseline with MAX One Cyber
Understanding where your agency stands starts with an assessment tailored to its operations. Zetron’s MAX One Cyber provides customized, in-depth cybersecurity risk assessments for public safety, local government and other critical operations. Based on FCC, APCO, DHS, NIST, and NENA best practices, these assessments deliver a prioritized roadmap of actionable recommendations to address vulnerabilities and strengthen network security.

Max One Cyber supports this work through customized risk assessments and actionable recommendations, along with continuous monitoring and threat detection services. MAX One Cyber also offers continuous monitoring and threat detection, helping identify risks that other security layers may miss.

Turn awareness into an actionable readiness plan
October is Cybersecurity Awareness Month. Use this time to do a cybersecurity check-up of your organization. Confirm when your last cybersecurity assessment occurred, what it covered, and which findings remain unresolved. Include critical communications, operations, IT, and even service providers when needed in that review. Then connect the results to a prioritized plan with clear accountability.

Establishing a baseline in your cybersecurity assessment is critical, as is maintaining a list of items to address, along with a timeline and assigned owner. Awareness gives employees the knowledge to act. Readiness with a current baseline, clear responsibilities and tested procedures gives your organization a much stronger foundation for maintaining essential services.