New York CIO outlines $174 million cyber plan, AI policy and statewide customer-experience overhaul

New York State Chief Information Officer Drew Bridal told the Senate Internet and Technology Committee on Feb. 10 that the state is pursuing a multi-year effort to modernize agency systems, expand cybersecurity protections and roll out an artificial-intelligence policy and training for state employees.

Bridal said the executive budget proposal includes a $174,000,000 increase, “and most of the money is going into cyber remediation,” and that the Office of Information Technology Services (ITS) plans to add about 295 staff positions to carry out modernization and security work. He described a shift toward embedding small, dedicated IT teams inside client agencies to pair technical and programmatic expertise and speed incident resolution and project delivery.

The committee’s chair, Sen. Kristen Gonzalez, said the presentation was intended to bring members up to date on the office’s priorities. The CIO outlined four principal areas of work: modernization projects, expanded digital services, cybersecurity and artificial intelligence — with customer experience as an organizing principle across those efforts.

Bridal described the customer-experience initiative — referred to in his remarks as IES — as a program broken into multiple releases. He said the program will be delivered in “between 6 and 12 releases” and is expected to be completed by the end of 2028. The work, he said, includes redesigning online workflows so services are mobile-ready and focused on users’ end-to-end journeys.

On artificial intelligence, Bridal said the administration has adopted a statewide policy under Gov. Kathy Hochul and that ITS is cataloging agency capabilities, building training resources and preparing an internal sandbox where employees can test tools on secure data. “AI is not a tool. It's generally a capability,” he said, adding that separating sensitive from non-sensitive data for generative tools is “a complicated question.”

On cybersecurity, Bridal said ITS operates joint security operations with client agencies and extends protections beyond the state to more than 100 counties and cities. He said roughly 95,000 endpoint computers are covered by the state’s protections now, and that the proposed budget increase would primarily fund remediation work.

Committee members pressed for specifics about scope and costs. Sen. Hinchey asked about the overall price tag to upgrade the state’s aging systems, noting in her remarks that many agency systems are older and staff retirements have left gaps in institutional knowledge. Bridal said some legacy systems are decades old and described modernization as a mix of remediation and transformation rather than one-to-one replacements; he singled out a large benefits system as an example of a long-running, complex effort.

Sen. Conatus raised whether the state has considered using AI tools to analyze its body of laws and regulations, citing an Ohio effort that identified outdated or redundant statutes. Bridal said the approach is feasible because laws are public data, but that a controlled environment and evaluation of model outputs would be required.

Bridal also outlined ongoing cybersecurity work: roughly 50 programs and six work streams are listed in phase two of cybersecurity remediation, and ITS is rolling out endpoint protection and emergency detection tools for local governments that subscribe to state services.

Bridal closed by thanking the committee and offering to provide additional detail in follow-up sessions. The committee followed the presentation with a bill session that moved six technology-related measures out of committee by voice vote.

Ending: The presentation provided senators with an overview of ITS priorities before the committee’s budget hearings later in the week; Bridal and committee members said they would provide and request additional, more detailed inventories and cost estimates in follow-up sessions.