State officials tell committee AI, ransomware and supply‑chain attacks are increasing threats to critical infrastructure

Ralph Johnson, the state's chief information security officer, and Tristan Allen of the Washington Emergency Management Division briefed the committee on the evolving cyber threat landscape and statewide defenses.

Johnson described a layered defensive model that combines agency security teams with centralized services and threat monitoring, stating that current threats include ransomware, supply‑chain compromises and nation‑state activity. "AI enables attackers to automate reconnaissance, generate malware, craft highly convincing phishing campaigns, and execute attacks with precision and speed," Johnson said, noting that 0‑day exploits and automated campaigns have raised urgency for real‑time monitoring.

Allen described the state and local cybersecurity grant program and said Washington has received about 43% of grants in that federal program, funding hundreds of projects since FY22. He and Johnson emphasized gaps: federal intelligence products arrive in finished form but the state lacks shared, real‑time visibility into participating local and private networks to operationalize intelligence immediately.

Committee members asked whether failures in past incidents stemmed from weak rules or compliance failures. Johnson said protections are in place but defensive layers can be bypassed or fail; he cited interconnected systems and cascading effects in recent incidents. He and Allen said the state is planning a volunteer cyber incident response team under the state's emergency worker program and recommended exploring a centrally hosted endpoint security and threat intelligence platform to improve visibility and coordinated response.

No legislative action was taken in the briefing; members asked for follow‑up briefings and data on grants, compelled reporting options and the proposed operational model.