Earlier this year, we announced the launch of CyberSim and Take9 for Civic Digital Resilience, a new national initiative with Craig Newmark Philanthropies and Aspen Digital at the Aspen Institute to help local governments and civic leaders build the skills, partnerships, and awareness needed to protect critical community infrastructure.
Our premise was simple: cybersecurity isn’t a side issue for civic health — it’s foundational to it. A breach doesn’t just cost money; it erodes the public trust that makes participation, service delivery, and democratic engagement possible in the first place.
Since that announcement, we’ve been busy!
Listening First: A Survey and a Focus Group
Before we built a single scenario, we wanted to hear directly from the local municipal staff, leaders, and elected officials who’d actually be in the room. So, we ran a survey across our audience, followed by a focus group to go deeper.
A few findings stood out:
When asked what would most help employees improve their digital security awareness, running simulation exercises was the top response — narrowly edging out regular mandatory training, and well ahead of bringing in outside experts or improving documentation.
Asked directly how they’d most like to learn about digital security, respondents ranked simulated, real-world tabletop exercises as the single most effective method available to them — ahead of self-paced online modules, live workshops, and gamified learning.
Perhaps most telling: 82% of respondents said they already take a short pause before clicking a link or downloading a file to check its legitimacy — making it, by a wide margin, the most common cybersecurity habit people report practicing regularly. This tells us Take9’s core idea — pause for nine seconds before you click — isn’t a hard sell. It’s already how people are trying to protect themselves; we just need to help make it second nature.
On the concern side, respondents named attacks that lock critical city systems (911 dispatch, water utilities, and the like) as the greatest cybersecurity threat facing local governments today, ahead of data breaches and insider threats.
And when we asked what gets in the way of good cybersecurity habits, lack of training topped the list of barriers — reinforcing that awareness, not just infrastructure, is where the gap lives.
“What stands out in these results is how the surveyed municipal staff and leadership already use the “Take9” method of the short pause as their most consistent cybersecurity practice – validating the premise of the campaign that this is the first line of defense to protecting yourself. Take9 is important because with other security recommendations, the barriers will always be there while, with Take9, anyone can integrate the pause on a daily basis, making individuals feel like they have agency in their digital security. The good news is that people are taking the step, now it’s about using the momentum to build our public servants’ cyber preparedness. Through the CyberSim tabletop exercises, we believe that we can make cyber preparedness a reality in places where critical infrastructure is on the line.” –Take9 .
Focus Group Findings
The focus group added color and nuance to the survey results. Participants described phishing attempts that have become dramatically more convincing — often powered by AI, often impersonating someone the target actually knows and trusts. They talked candidly about the uneven rollout of generative AI tools like Copilot across departments, the absence of clear policy, and the cultural (not just technical) work of getting staff to safely use these tools. And one theme kept resurfacing: cybersecurity has stopped being “an IT problem.” As one participant put it:
“Protecting a community now depends less on firewalls and more on whether every employee, at every level, understands what’s at stake and feels empowered to act on it.”
Several also pushed us toward a specific design choice: rather than training people to recognize a single attack, help leadership practice making sound decisions under pressure — because a real incident is rare enough that most people never get to practice for it.
Turning Insight Into a Scenario
We took what we learned and built a scenario specifically for local government audiences — then put it to the test. This summer we piloted the new CyberSim scenario at the 2026 All-America City Award event, bringing representatives from this year’s finalist communities into an immersive session designed to deepen their understanding of how to protect critical infrastructure and maintain public trust while navigating a realistic cyber incident.
Unlike traditional tabletop exercises, which often focus on preparing for or responding to a single potential catastrophic event, CyberSim challenges players to manage a broad range of cybersecurity incidents unfolding in rapid succession. During the 60-minute simulation–led by digital security strategist Sarah Moulton and NCL Program Manager Ibrahim Bazyan–participants took on fictional roles within a city government working to build public support for an upcoming bond measure to fund repairs to aging critical infrastructure. As they balanced efforts to engage the public with the demands of keeping city operations running, participants confronted an evolving series of digital threats that tested their ability to respond under pressure, maintain essential operations, protect public trust, and preserve the city’s credibility.
Following the simulation, the facilitators led a discussion examining how participants responded to each event and connecting their decisions to real-world security policies and best practices that can help prevent or mitigate similar incidents and their potential impact.
The pilot session at AAC confirmed both that the scenario resonated with local government participants and that we had a format worth scaling.
What’s Next
With a tested scenario in hand, we’re taking CyberSim on the road — and welcoming our first pilot communities.
Join Us in Long Beach or Nashville
A cyber incident hits. What does your community do next?
If you’ve ever wondered how your team would hold up when systems go dark and residents start calling, this is your chance to find out, in a room where mistakes cost nothing and the lessons are real. This fall, we’re bringing CyberSim to two of the largest gatherings of local government leaders in the country.
In each fast-moving tabletop exercise, you’ll step into a role in a fictional community, make tough calls with your colleagues, and watch the situation shift based on your decisions. It’s lively, challenging, and (as our All-America City participants can tell you) a lot of fun. You’ll:
- Navigate the cascading impacts of a cyber incident
- Clarify roles and responsibilities across departments
- Build stronger partnerships with peers from other communities
- Leave with practical ways to strengthen preparedness back home
Each session closes with a facilitated debrief on the choices made, their consequences, and the lessons to bring home.
ICMA Annual Conference, Long Beach
Tuesday, October 20 | 2:00–5:00 p.m.
Hyatt Regency Long Beach, Seaview Ballroom C
Register here
NLC City Summit, Nashville
Friday, November 20 | 9:00 a.m.–12:00 p.m.
Omni Nashville Hotel, Music Row 5
Register here
Space at both sessions is limited, so we encourage you to register soon.
CyberSim is Coming to Four Communities!
Over the coming months, four communities will host full CyberSim simulations with their own staff. We’ll share the lessons they generate broadly to help even more communities strengthen their digital resilience.
Looking Ahead
When we launched this initiative, we said cybersecurity isn’t a side issue for civic health. It’s foundational to it. Everything we’ve heard since has reinforced that. Local leaders already understand the stakes, from attacks that could take down 911 dispatch or water systems to AI-powered phishing that impersonates a trusted colleague. Many are already practicing the pause at the heart of Take9. What’s been missing is a chance to practice the harder part: making sound decisions together, under pressure, while an incident unfolds and public trust hangs in the balance.
That’s what CyberSim is built to provide. In the months ahead, we’ll share what we learn from ICMA, NLC, and our four pilot communities so that every local government, whatever its size or budget, can be better prepared. In the meantime, take nine seconds before you click. And if you’ll be in Long Beach or Nashville, come practice with us.
Learn more about CyberSim and Take9 for Civic Digital Resilience.
