The COVID-19 pandemic highlighted to cities around the world the importance of smart city programs—the use of technology, data, and innovative solutions to address their social, environmental, and economic challenges. Indeed, 65% of city leaders surveyed in 2020 as part of ESI ThoughtLab’s Smart City Solutions for a Risker World reported that the top lessons learned from the pandemic was that smart city programs are crucial for their future.
However, innovation is a double-edged sword. As city leaders increase their investments in digital technologies, they also expose their cities to greater cybersecurity risks if they do not put appropriate safeguards in place up front.
The pandemic was a stress test for urban cybersecurity systems. Attacks on state and local governments went up dramatically as cybercriminals sought to take advantage of the crisis.
Many cities fell victim to ransomware and other attack vectors. For example, Knoxville, TN was hit in June of 2020 with an attack that crippled its IT systems. The disruption escalated when hackers began publishing data online in a move to extract a ransom payment. Hackers also took advantage of pandemic-related disarray by shamelessly targeting some hospitals.
The ESI ThoughtLab study shows that cities need to do more to keep their urban centers and citizens secure. Most cities, 60%, reported they are not well prepared for cyberattacks. Although small cities felt more confident about their cybersecurity systems than others, the smallest urban areas are in a more precarious situation, with only 29% believing they were well prepared. This is borne out by the incidence of attacks during the pandemic on smaller cities in the US, such as Florence, AL, and Pensacola, FL.
In fact, one sign of a smart city leader—one that is most advanced in using technology and innovative solutions—is its level of cybersecurity Ninety-five percent of cities classified as leaders in the study said they were well prepared for cyberattacks, against just 8% of beginner cities.
% of cities that are well/very well prepared for cyberattacks by size.

Cybersecurity best practices
There are best practices that cities can follow to shore up their defenses against attacks. City managers should take a sheet from the lesson book of smart city leaders.
There are five key cybersecurity steps that leaders take far more often than other cities to address their cybersecurity vulnerabilities:
- Prioritize assets and create access control policies. Protecting a city’s most valuable assets is a smart first step, as is making sure the city imposes tight controls on who can access its systems.
- Invest in disaster recovery, response, and event management technology. No matter how strong a city’s firewalls, it only takes one bad guy to get through. So smart city leaders invest more heavily in specialized recovery and response technology to act quickly to mitigate impacts.
- Provide cybersecurity training to staff. This is a critical step for cities since cybercriminals often capitalize on employees’ mistakes.
- Protect critical infrastructure. This includes security testing of electricity grids, traffic lights, hospitals, and other urban assets. Interconnecting city assets and domains through IoT and other technologies can expose cities to a catastrophic attack if they do not adequately safeguard their infrastructure.
- Develop a cyber incident response and recovery plan. Smart city leaders understand they not only need to be act quickly to stop an attack, but also have processes in place to limit the aftereffects, including those related to liability and financial and reputational impacts.
Cybersecurity areas where smart city leaders invest more
One small city that learned the value of such best practices was Torrance, CA. On March 1st, 2020 Torrance experienced a cyber incident that had an adverse impact on city operations. Just two weeks later, Torrance declared a local state of emergency due to the coronavirus pandemic.
Lessons from a cyberattack
Faced with two major crises, city leaders scrambled to set up a virtual emergency operations center (EOC) through Slack, a cloud-based messaging platform hosted by Amazon Web Services. The city used Google Drive for all its forms and documents instead of email, as it was both safer and more efficient.
Within a week, the city had transitioned from brick and mortar, paper and pencil, to virtual operations. It was then able to connect area hospitals, the local school district, the Red Cross, Salvation Army, and business groups to the EOC for real-time information sharing. And when Torrance and Southern California experienced civil unrest—yet another disruption—a few months later, Slack allowed the city to flatten the information curve and share data, internally and confidentially, for increased awareness about the events.
The city was able to funnel live pictures of events directly into Slack where everyone involved in the management of the response could see and better understand the situation. “There were no longer silos that could form because the departments were all dissolved,” said Jeffrey Snoddy, emergency services manager for the city.
The experience was an eye-opener, and the city has since developed a cybersecurity plan. Reminders are sent to staff regarding practices to shore up security, such as changing passwords regularly and connecting from home with city-issued devices only. The city also does routine self-risk assessments of its vulnerabilities.
“Resilience and agility are a must to survive and to thrive,” said Torrance’s city manager, Aram Chaparyan. “Governments move at a slower pace because we have fiduciary responsibility. We have oversight by our elected officials and the public. We don’t have the luxury of time. It’s not if, it’s when we’ll have another crisis, and it’s all about creating a state of readiness.”

Laura Garcell Nimylowycz is the Editorial Assistant at ESI Thoughtlab, where she supports the editorial team with project management, research, and editing. Ms. Garcell Nimylowycz attended Columbia University as a Kluge scholar and received her Bachelor of Arts in Political Science and History in 2019. While at Columbia College, she was a staff writer for the university newspaper the Columbia Daily Spectator, as well as an editor for the Columbia Journal of Politics and Society.

Alyssa Simpson Rochwerger, VP, AI and Data, Appen: One of the biggest challenges is articulating the business problem they want to solve. Often, companies start with the technology, saying “I want to use AI” and then look for the business problem. Even after defining the problem and how to solve it, they need to understand the data they have access to, as AI systems are only as good as the training data we put into them.
Kurt Muehmel, Chief Customer Officer, Dataiku: There are two components to addressing AI scalability. One is organizational; it’s critical to have the right setup that both standardizes processes and enables people across the business to leverage data for more and more diverse use cases. For a lot of companies, that means having a center of excellence combined with robust programs for training, gamification, or whatever it takes to ensure data initiatives don’t stay siloed in this central team. The other component is reusability. Common sense and economics tell us not to start from scratch every time, and that is exactly the principal behind reducing costs associated with data cleaning, preparation, operationalizing, model maintenance, and even hiring woes.
Dr. Bulent Kiziltan, Chief Data and Analytics Officer: Hire AI domain experts who have demonstrated impact in multiple domains. Do not limit your leadership search to senior experts who have decades of expertise in that specific domain. Disruption and transformation can happen with a fresh perspective.
David Donovan, Executive Vice President, Financial Services Lead, North America, Publicis Sapient: The answer to this question is really dependent on where firms are with their maturity and adoption of AI within their processes and their business strategy and transformation. We are seeing investments made on all of the above. Most investment by financial firms now is on NLP and RPA focused mainly on reducing operational cost, while there is some experimentation towards alpha generation as well, but not comparable to the focus towards the former. We are also seeing big investments in customer centricity and targeting when it comes to sales and marketing.
Peter V. Henstock, Machine Learning & AI Lead, Pfizer: The success of AI is governed by two factors: the amount of clean data readily available, and the maturity of the industry in its acceptance of data-driven analyses. Older companies can have a wealth of data but may also have a disadvantage in organizing that data compared with younger companies like Uber that have created their data platforms with analytics in mind. The healthcare field has stricter rules for leveraging data and making decisions from them.
Mihir Sharma, Head of AI & Cognitive Initiatives, Financial Services, North America, Publicis Sapient: In our opinion, the general public is extremely green field with very limited knowledge of AI, although they do consume AI on a daily basis over their phones, or through augmentation of AI within their day-to-day activities through AI-powered companies, appliances, etc.
Alyssa Simpson Rochwerger, VP, AI and Data, Appen: There has been a lot of conversation about jobs and how AI will impact them, as well as the “black box” decision making around deep learning technologies.
Mihir Sharma, Head of AI & Cognitive Initiatives, Financial Services, North America, Publicis Sapient: Absolutely crucial without an ounce of doubt. Our lives have already seen AI starting to play a huge role in our day to day, be it our phones in using speech to text, or using Alexa/Google Home and other AI-powered devices, to autonomous and driverless cars coming in near future, to AI-enabled home appliances, and the list can go on and on. Because of big tech like Apple, and Amazon, consumers’ demand bigger experience, and AI will help create more personalized, real-time experiences which can unlock unique information and lead to a great experience with consumers.
Bill Hobbib, Senior Vice President, Marketing, DataRobot: There are a tremendous number of AI use cases to try and combat the outbreak of COVID-19. In healthcare, life sciences, and public health, the categories and use cases include the following:
Ari Kaplan, Director, Industry Marketing, DataRobot: Across the board, companies need to rapidly find signals in the unprecedented noise of the changing world. Models used for predictions and other business decisions are based on data that is limited or no longer applicable. Businesses are looking to AI now to more rapidly gain insights based on the changing economy, shutdown of physical businesses, the move to online purchasing, and changing interactions with their clients and customers.
David Donovan, Executive Vice President, Financial Services Lead, North America, Publicis Sapient: AI will be instrumental in future prevention and combatting of natural disaster, pandemics, and global crises. There will be huge advancement and focus on medical research in order to prevent this kind of an occurrence in future, and AI is supposed at the core of that research.
During his more than 35 years of research, marketing and publishing work, 