The Center for Digital Government's 2025 Digital Cities Survey winners aren't just celebrating new apps and streamlined services; they are revealing a tactical roadmap for modern government IT. For cybersecurity professionals, the true value of these awards lies not in the "what" (the cool tools) but the "how" (the foundational security and data governance required to deploy them).
This year's 54 winning cities and counties demonstrate that the top priority remains Cybersecurity (holding the top spot for the eleventh consecutive year), closely followed by AI/Generative AI, Business Process Automation, and Disaster Recovery/Continuity of Operations.
Here is a breakdown of the most critical innovations across the winning categories and what they mean for the future of government security.
The 2025 winners in each population category are demonstrating a profound shift from managing legacy infrastructure to enabling transformative digital services.
Population 500,000 or more: City of San José, CA
Innovation: San José's strategic approach to Generative AI Governance stands out. The city actively shaped the GovAI Coalition's policy agenda and applied privacy-first analytics to prevent housing evictions.
Cybersecurity implication: Moving AI from pilot to policy is the next frontier. San José is leading the way by ensuring that new AI models are built on clean, governed, and privacy-protected data sets. This demands a massive investment in data classification, anonymization tooling, and internal data governance processes to mitigate the risks associated with large language models.
In San Jose, CIO Khaled Tawfik is putting people first. "We believe in the need to educate before we can innovate, so we have been pushing really hard to upskill our team on how to identify data, how to manage it, how to display it in dashboards and more importantly, how to preserve it and protect it," he said.
The city also is working to be more forward-looking in responding to resident issues. Rather than wait for people to complain about a pothole or graffiti, "we’re trying to change the business model to be more proactive and predictive," Tawfik said.
"If we can use every camera that we own—on street sweepers, on trash collectors, and parking enforcements—and we catch graffiti and potholes before the public, then we have an opportunity to fix it and take care of the issue before the public sees it," he said.
Population 250,000 – 499,999: City of Long Beach, CA
Innovation: Long Beach focused on Digital Equity and Trust, with programs like "Pitch Long Beach!" and the Long Beach Collaboratory. Crucially, they hired a full-time AI Program Manager and actively lowered their Technology and Innovation Department vacancy rate through personalized professional development.
Cybersecurity implication: The focus on staff retention and upskilling is a direct cybersecurity measure. As the industry faces a crippling skills gap, Long Beach is building its defense from within. Their commitment to increasing resident trust from 47% to more than 95% suggests strong transparency in data handling and security protocols—proving that trust is a security posture.
"One of the things I'm really proud of is our creation of our 2028 strategic road map," said CIO Lea Eriksen. The map is the product of a robust process, with strong participation from residents and city employees.
"We even had workshops with community members, and a survey. From there, we identified 31 actionable recommendations that are helping to guide us as a technology organization to support the city's 2030 strategic vision and also our preparedness for the 2028 Olympics," she said.
Population 125,000 – 249,999: City of Scottsdale, AZ
Innovation: Scottsdale is aggressively modernizing public services via an AI-driven Smart Water Grid and drone-assisted public safety.
Cybersecurity implication: This is a clear move into the OT (Operational Technology) realm. The security team must rapidly adapt from securing business networks to securing SCADA systems, sensors, and remote assets. A breach of a Smart Water Grid is a critical infrastructure event, requiring specialized training in industrial control system security (ICS) and heightened focus on network segmentation.
Bianca Lochner sees her mission as Scottsdale's CIO clearly: "to deliver better service for a world-class community," she said. "And that translates to us really delivering reliable, secure, innovative technologies and solutions that enhance the quality of life for every resident," as well as for the 11 million visitors the city draws annually.
To that end, she's been looking for ways to put AI to work. "We start with a problem. What are the challenges or problems, the services that we want to enhance? And from there, we co-create solutions," she said. That collaborative process includes both internal stakeholders and external partners.
Population 75,000 – 124,999: City of South Bend, IN
Innovation: South Bend demonstrated success in scaling AI by deploying Microsoft Copilot to more than 1,000 users and launching pilot projects in finance, HR, and permitting. This was underpinned by a city-wide AI policy and training to raise employee confidence.
Cybersecurity implication: Mass deployment of GenAI tools introduces huge risk via shadow AI and data leakage. South Bend's success relies on having robust Data Loss Prevention (DLP) and Cloud Access Security Broker (CASB) controls in place, ensuring that sensitive city data is not inadvertently exposed to public-facing AI models.
Chief Innovation Officer Denise Linn Riedl has helped establish policies and governance for the use of generative AI in procurement and other areas in South Bend. In the past year, she's doubled down on training, to ensure people can put the new capability to work safely and effectively.
"We've worked a lot in last-mile training and workplace empowerment around generative AI," she said. That includes a GenAI user group, and the IT staff runs introductory classes for city staff. There's also a "generative AI roadshow, where we go to different city offices and city teams, brainstorm AI use cases and projects."
Population up to 75,000: City of Tamarac, FL
Innovation: Tamarac replaced a decade-old call center with an Omni-Channel Call Center (integrated with phone, SMS, web chat, and smart home devices), and launched AI-powered virtual tours for economic development.
Cybersecurity implication: The shift to an omnichannel environment significantly expands the attack surface. Security teams must now protect multiple customer communication vectors (phone, text, web, API endpoints), all of which can be targeted by advanced phishing or vishing attacks. The focus must be on API security and strong session management.
CIO James Twigger points to three pillars supporting IT transformation: "Innovation, collaboration, a culture that embraces change," he said. "Without those key elements, it really would be hard to do any of this."
Twigger sees potential for the metaverse as a way to help the city connect to younger residents. The IT team has worked with Meta to create a 3D rendering of City Hall and has learned enough to start moving ahead with other use cases.
"Our goal is to be able to engage all demographics, and that includes the younger crowd. I can envision them going to the virtual reality world and contacting us through there. Or maybe they want to take part in a VR aerobics class," he said. "We can make the city available through that VR world."
Beyond the first-place cities, several other winners demonstrated key security and resilience trends:
City of Delray Beach, FL: Expanded its resilience by building a remote disaster recovery data center 400 miles from the primary site. This emphasizes the crucial need for geopolitical and physical distance in recovery planning, especially in hurricane-prone regions. They also piloted an AI-powered virtual receptionist for accessibility, showcasing AI's role in digital equity.
City of Wichita, KS: Launched a public-facing IT Transparency Registry that catalogs compliance and every department's use of approved AI tools. This focus on transparency serves as both a governance control and a trust-building measure, critical for public accountability. They also implemented real-time threat reporting and updated their continuity of operations plan with specific cyberattack protocols.
Westchester County, NY (Digital Counties Survey Winner): Leveraged regional technology partnerships to deliver major cost savings—including discounted broadband for neighboring localities. This shared service model requires formal agreements and a unified security posture across multiple government entities, increasing the complexity of identity and access management.
Chesterfield County, VA (Digital Counties Survey Winner): Implemented an automated penetration testing tool, reducing dependence on costly third-party services. This shift to continuous, in-house security validation is a smart response to budgetary pressures.
The Digital Cities winners are not just buying technology; they are formalizing the risk management required to use it. For security teams in government, the implications are clear.
AI governance is the new data governance: Security teams must partner with Legal and IT governance to establish strict policies on data input (what can be fed to an LLM) and output (what data can be generated). This means treating GenAI tools as high-risk applications that require mandatory CASB monitoring and DLP enforcement.
The convergence of IT and OT is here: Critical infrastructure protection is no longer a separate discipline. Security teams need to acquire specialized skill sets or partner with MSSPs familiar with industrial protocols (Modbus, DNP3) and the unique operational demands of water, power, and traffic systems.
Resilience requires physical distance: The widespread adoption of geographically separate disaster recovery sites (like Delray Beach's 400-mile remote center) confirms that traditional co-location is insufficient. Teams must regularly test failover to these remote, air-gapped recovery environments.
For residents in these award-winning regions, the innovations translate directly into three core benefits.
More resilient services: When Wichita updates its continuity plan with cyberattack protocols or Delray Beach separates its data centers, citizens are protected from service disruption. Critical city functions—like emergency services, water supply, and transportation—are designed to stay online even during a major incident.
Higher trust and transparency: Cities launching public transparency registries (Wichita) or actively measuring citizen trust (Long Beach) are building faith in government data handling. Citizens are assured that their data privacy is central to the deployment of new technologies like AI.
Equitable access: The focus on digital accessibility (e.g., Delray Beach's AI receptionist) and omnichannel access (Tamarac) ensures that government services are available to all residents, regardless of physical ability, device, or technical literacy.