By summer 2019, Atlanta was still absorbing a SamSam ransomware attack that cost more than seventeen million dollars to recover from. Baltimore had refused a ransom at a recovery cost of over $18 million. Riviera Beach and Lake City had each paid six-figure ransoms in weeks. More than fifty U.S. local governments had been hit the preceding year. WaterISAC had issued updated cybersecurity fundamentals for water utilities. Illinois had added cybersecurity to its state Compliance Examination program under Public Act 100-914.

The City of Aurora, Il was watching. Illinois's second-largest city operates a water treatment plant, a municipal traffic management network, CJIS-obligated police systems, and administrative IT serving nearly two hundred thousand residents. The question was not whether to stand up full security operations. It was how to do it on the staff and budget of a city, against a threat already stopping municipal services for weeks.
This session walks the audience through what was built in response.

In August 2019, the city engaged a full-spectrum managed security operation covering not only enterprise IT but operational technology, including the water treatment plant and the traffic management network. Dual IT and OT scope inside a single managed engagement was uncommon for municipal deployments of that period, and it is the feature that distinguishes this case. The operation delivered continuous detection and response, vulnerability management, penetration testing, a SIEM platform, threat intelligence, incident response, and a governance-risk-compliance policy layer. A CISO consultant embedded alongside the city's Director of Cyber and Technology Risk, giving the engagement its governance structure in practice.

Across the engagement's six-year arc, August 2019 through December 2025, the operation captured and reported mitigating 35,331 threats across IT and OT, eliminating 351 high-severity threats before they produced incidents, zero major security incidents declared, and annualized cost 77% below an equivalent in-house SOC.

The session examines the three decisions that shaped the engagement.
First, the governance split between city authority and partner operational execution, instantiated by the embedded CISO consultant.
Second, treating water treatment and traffic management as first-class defensive domains rather than extensions of municipal IT.
Third, the cost and staffing structure that delivered dual-scope coverage on a municipal budget envelope.

The session closes on what the model became. The architecture that defended a single city can operate as a shared cybersecurity utility across jurisdictions, governed under intergovernmental agreement and funded through pooled contribution. Small water systems, regional transit authorities, rural electric cooperatives, and tier-2 manufacturers face the same resource architecture Aurora faced in 2019. The pattern translates with the same three decisions.