Vermont’s former technology chief says towns can’t fight cyber threats alone. The state offers free help, but the current grant round ends Nov. 30.

by Compass Vermont

Vermont’s cities and towns can’t defend themselves against cyberattacks on their own, according to the state’s former top technology official.

“They’re not in the position to independently handle the risks and the magnitude of cybersecurity exposure at their capacity,” Denise Reilly-Hughes told Compass Vermont. She spoke in an interview on her last day as secretary of the Agency of Digital Services and state chief information officer. She left Oct. 16 for the private sector. Compass’s first story from that interview covered how state government uses artificial intelligence. This one covers what she said about the towns.

Towns still carry some responsibility for their own protection, she said. But they should be able to work with the state to protect themselves.

Why It Matters to You

Your town office holds your property records, your tax bills and your contact information. It sends you email and posts notices you’re expected to trust.

If criminals break into those systems, they can lock up the records or steal them. If they can imitate the town’s email, they can send residents bills or messages that look official.

The Free First Step

The simplest protection Reilly-Hughes pointed to is moving a town’s website and email to a .gov address.

Anyone can buy a .com, .org or .net address. Only verified U.S. government organizations can get a .gov address. The federal program that issues them checks that the requester is a real government, and it charges nothing.

“Just getting their domain registered as a .gov give[s] them layers of protection,” Reilly-Hughes said. The change carries over to a town’s email as well as its website, she said.

Registering the address is free. Moving the town’s website and email to it is a separate job. The new address doesn’t replace other cybersecurity protections.

She didn’t know how many towns have made the switch. Compass checked the federal government’s public registry of .gov addresses. As of this week, 78 Vermont cities and towns had registered one. That’s fewer than a third of Vermont’s 247 cities and organized towns.

Only four of Vermont’s 10 cities are on the list: Burlington, South Burlington, Winooski and Essex Junction. Montpelier, the state capital, is not. Neither are Rutland, Barre, Newport, St. Albans City or Vergennes, or the towns of Bennington and St. Johnsbury.

What the State Is Offering

The state runs a federally funded program, the State and Local Cybersecurity Grant Program, to help towns clean up what Reilly-Hughes called “legacy risk.” That means weak spots left over from the technology towns already have, including older computer systems.

Every town that signs up starts with an assessment by a state team, which then recommends a project. The first projects on offer are:

• Security training for town employees, not just IT staff
• Multi-factor authentication, a second check beyond a password, such as a code sent to your phone
• Help moving a town’s website and email to a .gov address

As of the Oct. 16 interview, the state had completed assessments for 25 towns, about one in 10, Reilly-Hughes said. Two state employees are doing the work. She said about 60 towns are on track to get help.

“The fact that we have sixty on track is really good progress,” she said.

That help has a deadline. Under the state’s published rules for the projects it is offering now, all grant-funded work must be finished by Nov. 30, 2026. Towns are taken first come, first served for the multi-factor authentication and .gov projects for as long as the money lasts. Once the work is done, towns cover some ongoing costs themselves, such as staff time to keep the new systems running.

The federal grant also requires Vermont to put up its own matching money in later years. She said the state has been “really conservative” about how much it asks for each year.

The second offering is a membership in the Multi-State Information Sharing and Analysis Center, known as MS-ISAC. It’s a national center that warns governments about active threats and helps them respond to attacks. It also offers a service that blocks town computers from reaching known malicious websites.

MS-ISAC used to be fully funded by the Department of Homeland Security, Reilly-Hughes said. Federal funding ran out in 2025, and the center moved to paid memberships.

Vermont was one of the first states to buy a statewide membership that covers its towns, Reilly-Hughes said. The state announced the coverage in April. The membership is currently free to municipalities, schools, public water and wastewater utilities, and other public organizations.

“If you are a municipality and you’re not on there, folks may want to get registered quick,” she said.

When the Legislature created the state’s Cybersecurity Advisory Council through Act 71 of 2023, municipalities and school districts were among its main targets, Reilly-Hughes said.

“Cybersecurity is a team sport and nobody goes it alone,” she said.

AI Makes Attacks Faster

Reilly-Hughes said cyberattacks now often go hand in hand with artificial intelligence, because criminals use it too.

“They use technology like AI because they can do bad things faster,” she said. “And municipalities are absolutely a target for that.”

Insurance is not a substitute for protection, she said.

“Cyber insurance alone will not protect our municipalities from attacks,” Reilly-Hughes said.

Her Advice to a Select Board

Compass asked what she would tell the select board of a town of about 5,000 people that wanted to know what to do about AI and cybersecurity right now.

“I would tell them don’t ignore it,” she said. “It is happening, whether you’re looking or not, and you need to protect yourself.”

Her other advice was to ask the state for help and join the network of towns already working with it.

“There’s always going to be at least one person in the town who wants to be involved,” she said.

What You Can Check

Compass gives you the information so you can decide for yourself whether to ask your town about it.

Has your town registered a .gov address?

• Your town’s website address won’t always tell you. Some towns have registered a .gov address but haven’t moved their website or email to it yet.
• To check, look for your town in the federal .gov registry.
• If your town isn’t listed, you can raise it with your town clerk, town manager or select board.

For town officials: getting a .gov address

• Registration is free. Start at get.gov.
• A senior town official has to approve the request.
• Moving your website and email to the new address is separate work. The state’s assessment program, below, can help with it.

For town officials: free MS-ISAC membership

• Start with the state’s instructions at ready.vermont.gov/cybersecurity. The page explains what to do whether or not you’re already a member.
• Questions go to the Agency of Digital Services at VermontCIO@vermont.gov.

For town officials: a free state cybersecurity assessment

• Ask for one through the state’s contact form.
• All grant-funded work on the projects now offered must be finished by Nov. 30, 2026, and projects are first come, first served while money lasts. The state’s FAQ has the details.