How North Carolina Uses Tanium and AI to Harden Statewide Cybersecurity

The Problem SecureNC Is Actually Solving

Before you can appreciate the solution, you need to understand the staffing reality inside most local governments.

In many North Carolina counties and cities, one person handles IT operations, cybersecurity, network management, and whatever else breaks that day. There’s no SOC team. There’s no dedicated security analyst. There’s just a very tired human being doing 10 jobs at once.

State CISO Bernice Russell-Bond saw this clearly when she joined NCDIT over a year ago. Her first move was assessing cybersecurity maturity across agencies — and what she found was a patchwork of coverage gaps, resource constraints, and organizations flying blind on their own threat exposure.

SecureNC exists to close that gap without requiring every local entity to build a security team from scratch.

Why Tanium? The Platform Logic

Tanium’s core value proposition fits this use case almost too neatly.

It gives operators a single pane of glass across all endpoints — real-time visibility, automated threat investigation, and centralized patch management. For an organization where one person is responsible for everything, that kind of consolidation isn’t a nice-to-have. It’s the only way the math works.

The patch management improvement alone tells the story. Monthly remediation cycles mean adversaries have weeks to exploit a known vulnerability after a patch is available. Under Tanium, North Carolina is cutting that window to less than 10 days — and shrinking it further as the program matures.

“We’re cutting in half or more the time span that an adversary can exploit us,” Russell-Bond said. That’s not a marketing line. That’s operational reality.

The AI Angle: Threat Acceleration Goes Both Ways

Here’s where it gets genuinely interesting — and a little uncomfortable.

AI tools are making security teams faster. They’re also making adversaries faster. Russell-Bond is clear-eyed about this dynamic: frontier AI helps defenders identify and respond to threats more quickly, but it hands the same acceleration to attackers trying to find and exploit vulnerabilities.

This isn’t a hypothetical future concern. It’s the current threat environment, and it’s why the shift from reactive to proactive security matters so much right now.

Real-time data and automated investigations — Tanium’s core capabilities — are the operational response to an AI-accelerated attack surface. You can’t manually triage fast enough when adversaries are using AI to scan for weaknesses at scale. Automation isn’t optional anymore; it’s the baseline.

Why North Carolina Is a High-Value Target

The stakes here aren’t abstract. North Carolina has a lot worth stealing or disrupting.

Charlotte is the second-largest banking center in the U.S. outside New York City. The Research Triangle — anchored by Duke, UNC-Chapel Hill, and NC State — is dense with intellectual property in biotech, technology, and academia. Nine active military facilities, including Fort Bragg and Camp Lejeune, add a national security dimension to the threat profile.

Ports. Universities. Financial infrastructure. Research institutions. Cybercriminals optimize for disruption and data value — North Carolina checks both boxes repeatedly.

Russell-Bond put it plainly: “Cyber criminals look for targets where they can cause disruption and we have a lot of avenues where [a cyberattack] will cause a lot of disruption.”

How the Rollout Works

SecureNC is voluntary, which is worth noting. Participation isn’t mandated — it’s earned through demonstrated value.

The program is rolling out in phases across local governments, higher education institutions, and other public entities. Counties, cities, libraries, schools, and healthcare organizations have already expressed interest. NCDIT plans to continue outreach and onboarding through the summer.

The voluntary model is actually smart design. It creates early adopters who generate real results, which then become the case studies that bring in the next wave of participants. The 40% posture improvement in 60 days is exactly the kind of data point that converts skeptical IT managers.

What This Looks Like as an AI Use Case

Strip away the government context and this is a clean AI-augmented security operations playbook:

Centralize visibility first. You can’t automate what you can’t see. Tanium’s endpoint consolidation gives operators the data foundation everything else depends on.

Automate the repetitive, time-sensitive work. Patch management and threat investigation are high-frequency, high-stakes tasks. Automating them frees the one-person IT team to focus on judgment calls that actually require a human.

Use real-time data to shift from reactive to proactive. Monthly reporting cycles are a relic. Real-time telemetry changes the operational posture entirely — you’re responding to what’s happening now, not what happened last month.

Account for AI on both sides of the equation. Any security strategy that doesn’t factor in AI-accelerated attacks is already behind. The tools your adversaries use should inform the tools you choose.

The Takeaway

North Carolina’s SecureNC program is a useful case study in what statewide AI-augmented security actually looks like in practice — not as a concept, but as a phased rollout with measurable outcomes and a clear operational rationale.

The most honest line from Russell-Bond might also be the most compelling argument for the whole initiative: “At the end of the day, it’s my data too, right? Because I live here.”

That’s the kind of CISO you want running this program. And increasingly, Tanium is the kind of platform that makes the program possible.