Nineteen Thousand Local Governments Lost Their Threat Intelligence Last Year. The Barrier to Selling Them Yours Is About $2,200, Not a SOC 2 Audit — Here Is the Actual List.
- Patrick Duggan
- 1 hour ago
- 7 min read
On September 30, 2025, CISA ended its cooperative agreement with the Center for Internet Security. That single administrative decision removed $27 million in annual federal funding from the Multi-State Information Sharing and Analysis Center, which had been providing free cybersecurity services to roughly nineteen thousand state, local, tribal and territorial members.
MS-ISAC moved to a paid membership model. Eleven states bought statewide memberships.
There are fifty states.
Everyone else — counties, cities, towns, school districts, water authorities, transit agencies — went from free threat intelligence to a line item they have to justify to a board. Many of them have no security staff at all. Some have no IT staff at all. CISA has since lost roughly a third of its workforce, and the FY2027 budget proposal cuts a further $495 million, eliminating election security, chemical security, and cyber education outright.
That is the largest single addressable gap in American cybersecurity right now, and it was created on purpose by a funding decision, not by an adversary.
We are a two-person company in Minnesota. We have been figuring out what it actually takes to sell into that gap, and the answer turned out to be so much smaller than we expected that we think it is worth publishing the whole list.
The number is about $2,200
Not a typo, and not a stunt. Here is the real gate list for selling a threat intelligence product to a local government in the United States.
SAM.gov registration — $0. This is the federal System for Award Management. Registration is free, has always been free, and anyone charging you for it is running a scam that the government itself warns about. You get a Unique Entity ID. It takes a few weeks of paperwork patience, not money.
D-U-N-S number — $0. Free from Dun and Bradstreet. Also frequently upsold by people who should not be.
Cyber liability and errors-and-omissions insurance — roughly $1,200 a year for a small technology company at typical starting limits. This is the one that actually stops people, because almost every government contract requires a certificate of insurance before you can sign anything, and almost no early-stage founder has one. It is not optional and it is not expensive. It is just a thing nobody tells you.
State vendor registration — $0 to about $500 per state. Every state runs its own procurement portal. Most are free. A few charge a nominal fee. This is filling in forms, one state at a time.
A CAGE code — $0, issued as part of SAM registration.
Insurance plus registrations in a handful of states lands you at roughly two thousand two hundred dollars. That is the barrier to entry for selling cybersecurity to American local government.
What you do not need, and why everyone thinks you do
Here is where most small companies talk themselves out of a market they could already serve.
You probably do not need SOC 2. SOC 2 Type 2 is the near-universal entry ticket for commercial enterprise procurement — the Fortune 1000 vendor questionnaire asks for it before it asks anything else. It costs somewhere between thirty and ninety thousand dollars all-in once you count the audit, the compliance tooling, a penetration test, and the engineering time to remediate what the audit finds. It also requires an observation window of three to twelve months, so you cannot buy it in a hurry.
It is worth every dollar when a named enterprise deal is waiting on it. It is close to worthless as a speculative purchase, and it is not what state and local government asks for.
You almost certainly do not need FedRAMP. FedRAMP authorization runs from five hundred thousand dollars into the millions. It governs cloud services that store or process federal data. If your product is a feed the customer pulls — a blocklist their firewall fetches, a STIX bundle their SIEM ingests — you are not hosting their data, and the regime that exists to protect hosted government data does not attach the way people assume.
You may not need StateRAMP either. Same logic, state level. Pursue it when a state names it in writing in a solicitation. Never speculatively.
CMMC is for defense contractors handling controlled unclassified information. If you are not touching CUI, it is not your problem.
The single most useful question a small company can ask is: does my product hold the customer's data, or does the customer pull from mine? If it is the second, most of the expensive compliance world was built for somebody else's architecture, and you have been pricing a problem you do not have.
The part where we tell on ourselves
We would not publish this if we had not just run it against ourselves and found things we did not like.
We keep an automated compliance harness. It exists because a hand-maintained checklist in this repository once listed forty-four items as complete when the live API said the underlying protection was not enabled at all. Nobody lied. A checkbox simply cannot track live configuration. So now every control carries the command that proves it, and the harness reports what that command actually returned.
We ran it this week. Three controls failed. Our static analysis was configured to report findings rather than block a merge — a gate that cannot fail is not a gate — and it had quietly sailed past its own documented expiry date. Our dependency hygiene was worse than we believed. And a compliance document written last October still described us as "compliant" with a framework that, by definition, requires an outside auditor we have not yet hired.
Then we found the worst one. The harness itself was under-reporting. One check ran a single page of API results and reported the count as though it were the total, so a number that was exactly equal to the page size got recorded as a measurement. The tool built specifically to stop compliance claims from drifting into fiction had drifted into fiction. Its documented proof command and the command it actually executed were not the same command.
We fixed it, and then we wrote a guard so that any count landing precisely on a common page boundary gets flagged as suspicious rather than believed.
The lesson generalizes, and it is the real one in this post. A number that equals a limit is not a measurement. A control that has never failed has never been tested. A green dashboard is a claim, not evidence. If you are a small company hoping to sell security to anyone, the discipline of checking your own instruments is worth more than any certificate you can buy, because the certificate is a snapshot and the discipline is what keeps you honest between snapshots.
How a very small company actually competes here
Four things, in order of how much they matter.
Marginal cost is the whole strategy. A town of four thousand people cannot pay enterprise prices and never will. If serving your ten-thousandth customer costs you almost nothing, you can price where an organization with staffed support cannot follow. That is not a discount, it is a different cost structure, and it is the only durable advantage a small company has against an incumbent.
Ship the formats they already consume. Nobody in a county IT office wants a dashboard login. They want something their existing firewall, SIEM or MISP instance can pull on a schedule and forget about. STIX 2.1 and TAXII, MISP feeds, plain CSV blocklists, OPNsense-compatible lists. If they have to change their workflow to use you, you have lost.
Be honest about what you are not. MS-ISAC gave its members far more than data — round-the-clock analyst support, incident response, election infrastructure services, a member community. A small vendor providing an intelligence feed is not a replacement for a federally funded institution, and anyone claiming otherwise should be shown the door. Sell the layer you can actually deliver, name the layers you cannot, and let the buyer decide. That posture wins more deals than it loses.
Publish your method, including the parts that went wrong. We publish our misses. This week our own ledger said we had receipts on three of eleven newly-exploited vulnerabilities and nothing on the other eight, and we wrote that up under our own name. Public sector buyers are not stupid; they have been sold to by people with perfect slide decks for their entire careers. A vendor who shows the failures is a vendor whose successes mean something.
What we would tell someone starting Monday
Get the insurance quote first, because it is the gate that silently blocks everything else and it takes a couple of weeks to bind. Register on SAM.gov while you wait, and do not pay anybody to do it for you. Pick three states where the statewide membership was not purchased and register as a vendor there, because those are the orphaned buyers. Build the boring formats. Price for a town, not for a bank.
Then go read your own dashboards with the assumption that at least one of them is lying to you, because in our experience roughly one of them always is.
Nineteen thousand public entities lost their threat intelligence. Most of them still do not have it back. The barrier to helping is about two thousand two hundred dollars and the willingness to do procurement paperwork, and that is a much smaller number than the industry has any interest in telling you.
Was this useful? Rate this post — the widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=nineteen-thousand-local-governments-lost-their-threat-intelligence-last-year-the-barrier-to-selling
Comments