Mississippi’s Senate Select Committee on Cybersecurity examined how to protect AI tools, improve cyber incident reporting and coordinate defenses across state and local government during an October 13 hearing in Room 216 at the State Capitol.
State officials and representatives of federal government, technology companies and a national association of state technology leaders discussed gaps in staffing, funding and response authority. AI was part of the discussion both as a tool for attackers and as a technology that agencies need to secure before using it in their own operations.
This account draws on the Mississippi Legislature’s public recording of the hearing. Lieutenant Governor Delbert Hosemann established the committee in August to study government information systems and cybercrime enforcement. Co-chaired by Senators Bart Williams and Tyler McCaughn, it is developing recommendations for the 2027 Legislative Session.
Protecting AI tools and the information they can access
During afternoon questions, the committee asked how agencies could keep AI tools from taking actions beyond their instructions and how those tools could be protected from attack while assisting with cyber incident response.
Microsoft representative Kevin Chin emphasized identifying who created an AI agent, understanding what it can access and retiring agents that are no longer needed. John Tidwell, representing Google through its Mandiant cybersecurity business, emphasized data classification, approved tools and governance before deployment.
In his morning presentation, Tidwell also discussed deepfakes used in social engineering and the need for response exercises that account for those threats. He described potential uses of AI in security work, including helping analysts examine logs, while emphasizing data ownership and governance.
Doug Robinson, executive director of the National Association of State Chief Information Officers (NASCIO), presented findings from the 2026 NASCIO-Deloitte Cybersecurity Study. He discussed AI-enabled threats alongside possible defensive uses such as analyzing security information and identifying anomalies. The study also examines funding pressures, workforce shortages and support for local governments.
Faster reporting and clearer responsibility
Bobby Freeman, director of the Mississippi Cyber Unit within the Mississippi Office of Homeland Security, described how delays in reporting an attack can complicate containment and the preservation of evidence.
He recommended requiring state, local and K-12 entities to report significant cyber incidents to the Cyber Unit within 48 hours, and said he would include critical infrastructure in that requirement. He also recommended defining the unit’s authority to coordinate large cyber emergencies involving multiple jurisdictions and increasing support for cybersecurity and digital forensics personnel and equipment.
Those were witness recommendations for lawmakers to consider. The hearing did not establish a new 48-hour reporting rule.
Mississippi already has legislation creating a State Security Operations Center within the Department of Information Technology Services (ITS). State Chief Information Officer and ITS Executive Director Craig Orgeron discussed planning for that center and the challenges of coordinating agencies whose technology budgets and personnel are distributed across government.
Orgeron urged consideration of efficiencies in existing technology spending as a way to reinvest in cybersecurity. Senators questioned how to ensure agencies follow security requirements and whether stronger coordination should come through an existing agency, a separate organization or a combination of shared services and agency responsibilities.
Support for smaller governments
Greg Mallette, Mississippi’s cybersecurity state coordinator with the federal Cybersecurity and Infrastructure Security Agency (CISA), outlined basic protections: multifactor authentication, backups protected from alteration and isolated from production systems, remediation of known vulnerabilities and incident response plans with responsibilities established before an attack.
He discussed voluntary shared services and purchasing arrangements that could help smaller governments obtain security capabilities they may struggle to maintain independently. Microsoft and Google representatives also discussed shared security operations and opportunities to connect higher education with cybersecurity workforce development.
Freeman warned about the sustainability of local cybersecurity support as existing federal grant funding runs out, particularly in communities with limited staff and resources.
MAIN resources for residents and organizations
The hearing took place during Cybersecurity Awareness Month. For residents and organizations seeking practical guidance on AI-related risks, the Mississippi Artificial Intelligence Network (MAIN) provides an AI Cyber Safety guide covering suspicious requests, information protection, connected tools and steps to take if something goes wrong.
MAIN’s Cybersecurity AI Playbook provides more detailed guidance for organizations reviewing AI systems and security workflows. It covers data classification, permissions, analyst review, testing and preparation for AI-related incidents, several of the issues raised during the hearing.