This episode of the Tyler Tech Podcast features a conversation with Danielle DeMillo and Sonya Newell of Tyler Technologies on the evolving cybersecurity challenges facing public sector organizations. Recorded live at Tyler Connect 2026, the discussion explores how agencies can strengthen cybersecurity resilience amid growing threats, rapid technological change, and ongoing resource constraints. Danielle and Sonya share insights on prioritizing cyber risk, conducting effective assessments, building strong technology partnerships, and improving organizational preparedness. The conversation also highlights the critical role of leadership, employee training, and strategic planning, emphasizing that cybersecurity is not just a technology issue but a business and organizational responsibility.
In this episode of the Tyler Tech Podcast, recorded live at Tyler Connect 2026 in Las Vegas, Danielle DeMillo, senior manager of cybersecurity at Tyler Technologies, and Sonya Newell, manager of cybersecurity at Tyler Technologies, explore the evolving cybersecurity landscape facing public sector organizations. The conversation examines how emerging technologies, growing cyber threats, and persistent resource constraints are reshaping the way agencies approach security, risk management, and resilience.
The discussion explores some of the most common challenges organizations face when strengthening their cybersecurity posture, including aging technology, limited staffing, budget constraints, and the increasing sophistication of cyberattacks. Danielle and Sonya explain why effective cybersecurity begins with understanding organizational risk, prioritizing the most critical vulnerabilities, and taking a practical, strategic approach to improvement. They also discuss the value of cybersecurity assessments, vendor partnerships, employee training, and publicly available resources that can help organizations make meaningful progress.
The episode also highlights the critical role leadership plays in building a resilient cybersecurity culture. Danielle and Sonya emphasize that cybersecurity is not solely a technology issue but a business and leadership responsibility that requires executive engagement, informed decision-making, and long-term planning. Throughout the conversation, they share actionable insights for organizations at any stage of their cybersecurity journey, demonstrating how a combination of people, processes, technology, and leadership can help reduce risk, improve preparedness, and strengthen organizational resilience. As organizations recognize Cybersecurity Awareness Month, the discussion serves as a timely reminder that cybersecurity is everyone’s responsibility and that meaningful progress starts with understanding and managing risk.
This episode also highlights emerging strategies for building efficiency in the public sector, with insights into how agencies are using technology and process improvements to do more with existing resources.
And learn more about the topics discussed in this episode with these resources:
Listen to other episodes of the podcast.
Let us know what you think about the Tyler Tech Podcast in this survey!
Danielle DeMillo: Cybersecurity is a leadership problem. It’s very much a leadership concern, and they should be approaching it as a business issue and not just a technical issue.
Josh Henderson: From Tyler Technologies, this is the Tyler Tech Podcast. I’m your host, Josh Henderson. October is cybersecurity awareness month, making it the perfect time to step back and examine how organizations are preparing for an increasingly complex cyber landscape.
Recorded live at Tyler Connect 2026 in Las Vegas, my guests are Danielle DeMillo, senior manager of cybersecurity here at Tyler, and Sonya Newell, manager of cybersecurity at Tyler.
Together, they work closely with public sector organizations to help strengthen security programs, identify vulnerabilities, and build more resilient approaches to cyber risk management.
In this conversation, we discuss how the cybersecurity landscape is evolving, the challenges organizations face when improving their security posture, and why resilience requires more than just technology. We explore the role of leadership, training, risk assessments, vendor partnerships, and strategic planning, along with practical steps organizations can take to improve cybersecurity even when budgets and staffing resources are limited. Let’s get started.
Dani, Sonya, welcome to the Tyler Tech Podcast. Thank you so much for being here. It’s great to have you both.
Danielle DeMillo and Sonya Newell: Thank you for having us.
Josh Henderson: So, starting with the big picture, from both of your perspectives, how has the cybersecurity landscape evolved in recent years, especially for public sector organizations?
Sonya Newell: Well, you know, I think what’s really changing right now is the fact that you have a lot of targeting at systems which weren’t targeted before. They’re being targeted in a more automated fashion, and so the need for response is quicker. You need to be more on your toes. You need to have a pulse on what’s actually happening on your network at the current time.
There’s a lot of the same premises in place where, you know, you always need to address vulnerabilities. You always need to address any known issues, but the unknowns, I think, that the potential for zero days are a lot higher, and so the risk is going up.
Danielle DeMillo: I agree with your sentiment, Sonya. One thing I’ve certainly seen transpire over the last recent years is, of course, the evolution of AI makes things a lot faster and a lot easier for people to target places that otherwise, when they didn’t have the technical knowledge to before. And that is changing how the public sector needs to be able to respond to those.
And traditional controls do work, but staying on pace with the evolving technology from a defending side just as much as the attacking side is very important. And certainly, I think one of the knowns of the public sector is the resource constraints with the people. And I think I’ve recognized that a lot of the public has accepted that that is the norm and that’s not going to change. So how do we work with that?
And leveraging that technology to bolster their security posture and saying, okay, this is how it is. How can we make the best use of those resources?
Josh Henderson: I think that’s a great place to start, and I want to kind of dive into that a little bit deeper. So, with the evolution that you all are speaking to, what are the most common challenges you’re seeing or obstacles that organizations are having to face when trying to strengthen their cybersecurity posture?
Sonya Newell: I think a lot of organizations just don’t know where to start. I think, you know, there’s a lot of technology debt. A lot of organizations have systems which they know are outdated, but either don’t have the funds to fix or there just really isn’t a good replacement for it. So, what do you do? So, it’s a lot of investment time, a lot of anal analyzing time, but the reality is organizations don’t have that much time to put into it too. So, it’s how do you how do you pick your battles?
Danielle DeMillo: I agree with what you’re saying there, Sonya. And a lot of the approach has shifted and is focusing on where’s the biggest risk and what do we need to focus on with that and limiting and almost limiting what we’re looking at with that in mind. So, assessing things, what is the biggest risk to our organization, whether it be a financial loss or reputational hit, loss of constituent data, and what are the top five things we can do to drastically knock down that risk. And focusing on that, there’ll always be a lot of things that need to be addressed. And focusing on those top few that are manageable, that you already have the resources for, you can justify, is really your best bet in keeping those bigger items at bay and focusing on it that way instead of trying to wrangle the whole thing.
Josh Henderson: And it seems to me that organizations are maybe reacting to threats as opposed to being ready for threats. So how do you function in terms of, like, reaching out to organizations, talking to organizations, and preparing them to be more proactive rather than just reactive with cyber-attacks?
Sonya Newell: You know, one of the things that that my team does when we work with organizations is we usually ask them, you know, what keeps you up at night and how?
And because I think when it comes down to it, the staff at the organization know what they need to fix. If they’re aware of the technologies they have, they know what they have problems with, and it’s really just a matter of level setting the organization, making sure leadership is informed, and that they actually understand what that true risk is.
It’s not always an easy thing because, you know, we’re almost living in a world, I think, of two different technology eras where we’ve got AI, which is so evolving, and it’s and it’s so new, and it’s changing. Every day you look, there’s new capabilities. But then you have the platform of technologies that organizations have built their legacy on, a lot of the, you know, operational technologies, things which are using decades old technology that still need to be supported, so your staff need to know such a breadth of technology skills. It’s difficult to fill with a small staff.
Danielle DeMillo: Certainly, you think about how do we outreach and work with our clients or work with the public on that, it really starts at the top. So, bringing in, like, you know, Sonia was iterating, starting with the executives, the decision makers, the owners of the accountability is critical. And having a conversation to let them know, this is the benefit you’ll get from doing this, the return on that investment.
This is the potential or risk of impact to you and likelihood of something negative happening, and you just need to make a decision, and it’s all a monetary value. So, starting at that above the IT staff, above the any security staff an organization has, starts with them and the conversation starts with them and laying out the facts to them saying, it’s okay if you choose not to do, to choose a security monitoring service to monitor your network. But just understand that you could get hit and it might not be caught and you have a lawsuit for millions of dollars. If you’re willing to accept that risk, great. If not, these services are “insurance” to reduce that risk in many different layers.
Josh Henderson: I think we’re kind of, like, speaking to this idea of cyber resilience as a whole. So, when we talk about cyber resilience, how should leaders be thinking about building a strategy that goes beyond prevention and also focuses on that response and recovery element as well?
Sonya Newell: I mean, I think the key is to build good technology partners. I think that’s you need to know that the solutions you’re using, and you need to know who to reach out to, let them know what your needs are, and help them guide you because no one has all of the information. And there may be capabilities that your solutions you already have that you’re not aware of. It’s the resilience piece is key because operations, you know, for so many sectors is twenty four seven. And having a team that you can rely on, whether they support you directly, whether they support you through, you know, contracts, having that additional, you know, third leg to lean on is invaluable at times.
Danielle DeMillo: When you think about resiliency, there are so many different angles. There is a technical angle and resilience in your software and hardware and your infrastructure, and there is business operational resilience. And there are things that can be done at both levels that are lower cost as well as higher cost.
And again, it goes back to that return on the investment and what you’re willing to pay and accept in return for that. But some examples of that are having true hot sites of your running operating environment. Again, that’s higher cost, but, I mean, you’re looking at seconds, even if that, of data loss and downtime. And, again, more expensive, but on the less expensive side, if that’s not an available option, at least having some sort of off-site backups of your data so at least you could restore from it.
That’s a relatively low cost or uploading it to the cloud. Again, lower cost, you’ll have more downtime and probably more data loss, but it’s something and that’s a great place to start.
Josh Henderson: It sounds to me, Dani, that you’re speaking to kind of the like, as a monetary hit is going to affect leadership more than anybody else, obviously. So, there’s a leadership component here that’s kind of overarching with all of these things. So, what sort of role does leadership play in shaping a strong cybersecurity culture across the organization?
Danielle DeMillo: Oh, it’s absolutely critical. One of the biggest mistakes that I see leading a security monitoring services team that provides support to clients when they’re going through an incident that the biggest mistake is not having an executive in charge during an incident who can provide steady, calm leadership and decision making. And the minute you don’t have that, it’s pure chaos. It is absolutely critical for things to be handled, not even just from an incident perspective.
But when you look at day to day operations, you need to have someone in an authoritative position who can make the decisions on accepting that risk or not, a lot of what Sonya and I have been talking about. And then it goes down into a middle layer that executes and does the more tactical work to ensure that that’s being done. So, it really does start at the leadership level, and this is cybersecurity is a leadership problem. It’s very much a leadership concern, and they should be approaching it as a business issue and not just a technical issue.
Josh Henderson: Stay tuned. We’ll be right back with more of the Tyler Tech Podcast.
Every day, government leaders are being asked to do more with less, manage growing workloads, meet rising expectations, and address staffing and budget challenges.
Jade Champion: And while efficiency is a priority for nearly every organization, today’s challenges require a different approach. It’s not just about improving individual processes; it’s about expanding capacity without adding resources.
Josh Henderson: That means connecting systems, simplifying workflows, reducing manual work, and giving staff more time to focus on the services that matter most.
Jade Champion: Across the country, public sector agencies are improving operations through automation, artificial intelligence, integrated systems, and smarter ways of working.
Josh Henderson: Discover how agencies are reducing complexity, freeing up staff time, and creating more capacity to serve their communities. Visit the link in our show notes and download our free eBook, How Governments Build Efficiency at Scale, to learn from real-world examples, client stories, and expert insights.
Jade Champion: Now let’s get back to the Tyler Tech Podcast.
Josh Henderson: And now when we talk about monetary hits, you know, if you’re speaking to that specifically, some organizations, especially in the public sector, might be dealing with limited resources. How can teams prioritize effectively and make that meaningful progress even with budget or something like staffing concerns or things like that?
Sonya Newell: You know, for me, technical assessments, understanding where your current vulnerabilities are, that always points out where your biggest immediate risks are. So, taking you know, if you haven’t had an external pen test done, a really good conversation to have is always like an IT risk assessment as well because it gets into your infrastructure. It’s a conversation. People can talk about their experiences.
So, if you have both the I don’t want to call it theoretical, but the, you know, this discussion based examination and then the technical based examination, you get a good feel for where you might want to be investing money. Mean, of course, when you have solutions that are out of support, you either need to put money into upgrading that system or finding ways to secure it so others can’t take advantage of its out of date nature. But those IT risk assessments can really help you prioritize, I think, you know, high, medium, low. Where do we see our biggest risk?
What is the easiest to fix? What are the biggest investments?
Danielle DeMillo: To add to that, certainly, in the public sector, resource constraints, I mean, we we’ve been saying it this whole time, and it will always be, you know, part of the story because the budgets are approved well in advance, and things don’t always go according to plan. Things come up after that. And that in and of itself, along with budget surplus being a possibility, you know, makes it a this is a real issue that our clients and prospects are having.
So, focusing on using what you have available to you, for example, when you are partnering with a technology vendor, it’s worth taking the time to invest in understanding what you’re getting for a service and spending time with your legal counsel to ensure that there are clauses in your contract that protect you and continue to reduce your risk, whether it be and again, I am not a lawyer. I’m a cyber professional but have just seen a lot of organizations transfer a lot of the risk they hold through the form of contracts with their vendors saying, you need to meet this SLA, or we have the right to be compensated for not being met.
And that’s how you help offset the risk. That’s a huge thing that can be done that, again, that’s just part of the normal contract negotiation process. But there are also a lot of really great, wonderful, free resources out there that can be used that are targeted for the public sector. CISA has many different templates that you can use and resources you can use.
There are business impact analysis assessment templates, which will guide you to doing an exercise at your organization just to understand what’s the impact to our business if we lose this function or that system and can make decisions on the limited resources you do have based on how that tiered assessment comes out. So, leaning on those things to spend the money and the time where it really matters with the really hard things to do that are not easy to implement in house is the in my opinion, the best approach.
Josh Henderson: I wanted to speak specifically to the assessments, too. From a Tyler perspective, what have you all been seeing in that sort of initial assessment with organizations? What are what are some of these big pain points that are coming up with these assessments that you’re undergoing?
Sonya Newell: Sometimes it’s just basic configuration, making sure that password settings are the way that, you know, Mist recommends or other organizations recommends, looking at their current, you know, patching schedule, just basic operations. You know, I think a lot of organizations have gone through change either with, you know, personnel moving in or out of their organization and, you know, processes get lost. So sometimes just recovering what may have been in place years ago or, you know, even like a few months ago through those discussions, I think, is a big win a lot of the times. The other things are the bigger items, which always seem, you know, so large to take on.
At least raising those so it’s there can be a leadership discussion about, do we move forward with investigating a path forward out of these out of date systems, or do we find different ways to secure them and live with the risk? You know, it’s definitely challenging, I think, for a lot of organizations because with the small staff, if you come out with a list of, you know, 20 things that they have to accomplish, it feels weighty. And I think the real goal of these assessments isn’t just to give people a list of items.
It’s almost to give them a road map and to really help them, okay, say, well, maybe we can do these things this year, and next year, we’ll take on doing these other assessments just to make sure that we make progress.
Josh Henderson: Like, kind of alleviating some of the overwhelming feelings of, you know, all of this stuff that is coming at them all at once. So, yeah, I get that. I get that. There seems to also be a growing need for education and awareness too within cybersecurity. What role does training both for IT teams and for the broader organization play in improving cybersecurity resilience?
Danielle DeMillo: Well, I think with that one very startling statistic that we’ve been sharing recently is that phishing successes have seen a 400% increase just in their successes between 2024 and 2025. So, we are seeing phishing emails as still the number one means to gain access to an organization’s environment because people are always the weakest link. And investing in the training for them is one of the best investments that can be made.
That’s a nontechnical investment. It’s preparing your staff, making sure they they’re equipped with the right resources and education to make good decisions as we’re seeing as email phishing attempts are getting more sophisticated with AI and, you know, specialized targeting with spear phishing for industries or individuals, spoofing the domain. So, I mean, things are really ramping up as we’ve seen, and the proper training to pause and to look for indicators that it is not a legitimate email, always verify, things like that still stand and are absolutely critical for the frontline defense.
Josh Henderson: We recently did a CIO playbook based on NASCIO’s top ten c I CIO priorities, and cybersecurity dropped to two. Still very much a top priority, but artificial intelligence came in at number one for the first time. So, I feel like those two things are going to continue to be the top two priorities kind of moving forward. But for organizations that are early in their journey, what are the most important first steps they can take to start building that foundation for a resilient cybersecurity force?
Sonya Newell: Well, I think I think a good segue is, you know, education. But it’s really education not just to the end users of systems, it’s education to leadership, understanding the systems they’re implementing and the risks they bring. And then there is also education for your IT staff who are supporting those systems and how should they implement them, how should they control them, what are things that they should look for. And then of course the end users.
The big thing I don’t want to forget is, you know, there’s a lot of weight on end users. There’s a lot of weight on everyone in the organization because I think for the most part, people want to help. They’re trying to get the job done. They’re trying to get through it as efficiently as possible.
And, unfortunately, the bad guys have all the time in the world. They can try as many times as they need to, but it just takes one mistake from someone who’s trying to help to have an incident happen, and that’s the biggest thing.
Josh Henderson: It’s great. This has been a wonderful conversation. Appreciate you both taking the time. Lots to unpack, obviously, but I’m hoping that this this conversation can help a little bit.
Danielle DeMillo: Thank you for having us.
Josh Henderson: As we heard today, cybersecurity is no longer just a technology challenge. It’s a business and leadership challenge. Building resilience requires organizations to look beyond individual tools and focus on the broader combination of people, processes, technology, and decision making that together create a stronger security foundation.
Danielle and Sonya highlighted that while every organization faces different risks and constraints, meaningful progress often begins with understanding where the greatest vulnerabilities exist and taking practical steps to address them, whether through risk assessments, employee training, stronger vendor relationships, improved backup strategies, or executive engagement, organizations can make measurable improvements without trying to solve every challenge at once.
One message that feels especially relevant during Cybersecurity Awareness Month is that cybersecurity is everyone’s responsibility. If you’d like to learn more about the cybersecurity topics discussed in this episode, be sure to check out the show notes for additional We’d also love to hear your feedback. Fill out the listener survey linked in the notes or reach out anytime at podcast@tylertech.com.
And be sure to subscribe, rate, and review the show so you never miss an episode.
Tyler Technologies, I’m Josh Henderson. Thanks for listening to the Tyler Tech Podcast.