5 state and local governments detect threats faster and protect citizens

As cyber threats increase, state and local governments remain prime targets. Fragmented systems limit visibility, and traditional approaches struggle to scale. Without timely insight, agencies risk falling short of both mission outcomes and public trust.

The pandemic accelerated this complexity. Remote work and digital services expanded rapidly, exposing gaps in infrastructure and increasing operational fragmentation. Agencies were forced to adapt their operations to create accessible services for citizens and employees. As systems became more decentralized, agencies lost a unified view of their environment, making it harder to monitor activity, detect issues, and respond effectively. 

Without modern approaches, visibility breaks down — and so does response.

To keep pace, agencies are moving toward a different model: one platform that unifies how data is collected, searched, and acted on.

Modern cybersecurity starts with search. It’s not just about storing data. It’s about making it instantly accessible, contextual, and actionable in real time.

State and local government agencies use the Elasticsearch Platform to unify search, observability, and security in one place. This creates a single, real-time view across systems, without needing to move or duplicate data.

With this foundation, agencies can detect anomalies earlier, investigate faster, and respond with confidence. Teams move from reactive workflows to proactive operations, using search to connect signals across environments and surface what matters most.

The result is not just better security — it’s better decision-making. Faster insights. Stronger resilience. And the ability to deliver reliable, secure services at scale.

US state agency

• Challenge: Fragmented visibility after shifting to a distributed IT environment

• Solution: Elastic Observability on Elastic Cloud Hosted (AWS)

• Result: Up to 80% improvement in efficiency through automation

Arizona Department of Homeland Security

• Challenge: 12+ terabytes of daily logs across multiple sources 

• Solution: Elastic Security/AI-driven security analytics 

• Result: Unified visibility across billions of events; reduced alert fatigue

Arbetsförmedlingen

• Challenge: Tool sprawl and technical debt across legacy vendor systems 

• Solution: Elastic Observability and Elasticsearch 

• Result: 75% reduction in APM license and storage costs 

California Employment Development Department

• Challenge: Data silos across ~3,000 servers; balancing security with accessibility during claim surges 

• Solution: Elastic Security on Elastic Cloud + AWS 

• Result: 850+ billion records searchable with consistently strong performance 

City of Sacramento

• Challenge: Thousands of pages across 10+ city websites; residents couldn't find basic answers 

• Solution: Elasticsearch + SacGPT, a RAG-based virtual assistant

• Result: Public-facing AI search delivered 30% faster than the original timeline

For this US state agency, shifting to remote work during the COVID-19 pandemic came with significant challenges. Moving to a distributed model exposed vulnerabilities in service delivery, monitoring, and cybersecurity in its previously centralized IT environment.

The agency urgently needed to strengthen its IT resilience, increase visibility, and meet the rising expectations for remote and digital services. To do this, the agency needed to modernize its IT infrastructure by consolidating monitoring tools and improving visibility into operational and cybersecurity data through a single pane of glass.

Supporting multiple departments and services across a complex IT environment, this US State Agency handles large volumes of sensitive data and depends on secure, streamlined performance.

However, its systems had been designed for a centralized workforce. Therefore, the pivot to a fully distributed environment prompted an urgent need to restructure its technology networks, systems, and infrastructure.

The primary obstacle facing this US state agency was the lack of a unified view across operations. As digital demands surged and systems decentralized, different teams struggled to maintain a consistent understanding of operational data and performance. Without a comprehensive view, monitoring and troubleshooting became more complex, limiting the agency's ability to respond quickly to emerging issues.

Traditional transactional dashboards fell short, leaving teams reacting to issues rather than proactively identifying and preventing them. Issues were often identified only after they had impacted employees or service delivery. The lack of visibility made it challenging to pinpoint problems and implement timely solutions, frustrating staff and constituents alike. Additionally, handling sensitive data increased pressure to maintain system reliability and trust.

“We looked at the technology issues we were trying to solve and realized that we needed to move away from transactional data dashboards, which make it hard to find issues, to ones that could handle more complex and streaming data, moving us toward being proactive,” said the chief digital and data officer.

• No unified view across a newly decentralized, distributed operating model
• Reactive, transactional dashboards that surfaced problems only after they disrupted employees or service delivery
• Growing pressure to maintain reliability and trust while handling sensitive data at scale

In response to these challenges, the US state agency recognized the need to transform its IT infrastructure by consolidating monitoring tools and improving visibility into operational and cybersecurity data. It needed a solution that could integrate complex, dynamic data and provide a comprehensive operational view. 

Faced with the challenges of a rapidly changing operational landscape, the US state agency deployed Elastic Observability as its monitoring platform.

Migrating applications to Elastic Cloud Hosted on AWS helped break down silos that previously hindered data access and analytics. This migration made applications accessible to remote teams while providing the scalability needed to support a distributed work environment.

With Elastic Observability, the agency established a single pane of glass across its systems. Teams can now seamlessly search operational data, visualize system performance, and monitor systems in real time.

After struggling with reactive monitoring, Elastic allowed the agency to adopt a more proactive approach to problem-solving. Elastic enabled the agency’s teams to visualize performance metrics and gain insights into system health for quicker identification of potential issues.

Elastic’s comprehensive monitoring capabilities covered all aspects of the US state agency’s IT processes. From data replication when transferring data from mainframes to various applications, to real-time performance tracking, Elastic provided the context needed to make faster, more informed decisions with end-to-end monitoring and streamlined operations.

The agency's partnership with Elastic Consulting proved invaluable during this transition. Through strategic guidance and support, the agency effectively designed its architecture to collect and analyze the critical data required for a successful deployment and continuous performance.

“Every month, we gain a deeper understanding of IT functions across the agency and can clearly see trends and anomalies in our systems. In these ways, the observability the Elastic platform provides has been a game-changer for our infrastructure resilience,” says the US State Agency CIO.

As a result of its modernization efforts, the US state agency has significantly improved its operational efficiency and service reliability. It reported up to 80% improvement in efficiency thanks to automation, freeing up resources for more strategic initiatives.

For example, implementing Elastic Observability into the agency’s internal total cost of ownership (TCO) app created a data dashboard that completes financial data analysis that would have taken over a week in a single day.

“With Elastic, the finance department is saving about a week’s worth of time each month on spending analysis,” says a consultant and technical lead with the US state agency. “With the transparency of data, questions can now be answered from information we couldn't see before.”

Thanks to Elastic Observability, the agency’s operational efficiency upgrades include:

• Centralized visibility across infrastructure and applications: Elastic Observability provides a unified view into infrastructure and applications, letting teams identify performance issues and opportunities for improvement.
• Increased efficiency through automation and shared dashboards: The agency transformed its operational processes with automation and shared dashboards to decrease manual reporting.
• Significant time and cost savings: Automation helped the US state agency save as much as a week of staff time per month.

By achieving centralized visibility across its IT landscape, the agency enhanced its ability to monitor and respond to service demands and focus on its core mission of delivering high-quality services to the public.

For the US state agency, modernizing IT infrastructure meant moving from reactive dashboards to real-time, unified visibility — in turn freeing teams to focus on service delivery instead of chasing down problems after the fact. Read the full case study.

The Arizona Department of Homeland Security is a state agency that, charged with protecting private citizens and enforcing public safety, must maintain robust cybersecurity. AZDOHS plays a pivotal role in safeguarding the state's vital assets and ensuring the security of its information technology infrastructure.

AZDOHS supports multiple departments and services to ensure the resilience of Arizona's infrastructure against evolving threats. Dedicated to protecting the state’s critical infrastructure and enhancing public safety, AZDOHS implements many comprehensive cybersecurity measures and advanced technologies, all while attempting to safeguard large volumes of sensitive data at scale.

AZDOHS generates over 12 terabytes of daily logs. Identifying meaningful threats within massive volumes of daily security telemetry from multiple sources is overwhelming — especially when relying on traditional tools.

Monitoring a vast array of data points made it difficult to create efficient processes to handle the high volumes of data being ingested every day. Unlike other agencies, AZDOHS couldn’t simply store all its data. As a state agency in the public sector, timely analysis of data is crucial to identifying legitimate threats.

AZDOHS needed to centralize data ingestion to make its data searchable and actionable in real time and to identify and respond to cyber threats faster and more efficiently.

• Over 12 terabytes of daily logs to sift through for meaningful threats
• Traditional tools unable to keep pace with high-volume security telemetry from multiple sources
• Needed to centralize data ingestion to make it searchable and actionable in real time

Looking to centralize security data ingestion, AZDOHS turned to Elastic Security for AI-driven security analytics.

By leveraging Elastic's prebuilt alerts, AZDOHS streamlined anomaly detection amid billions of data events. Their teams could customize the prebuilt models for their specific public sector needs for simple implementation with a large impact. AZDOHS can now focus on high-priority activities instead of being overwhelmed by irrelevant data.

Integrating Elastic’s AI-driven security analytics enabled AZDOHS to centralize data management and move toward more proactive security posture. With a more efficient data storage system, AZDOHS can more precisely search through billions of data events processed through the platform. Centralized data and AI insights help rapidly identify malicious activities and reduce alert fatigue from false positives.

"AI-driven insights were instrumental in elevating our cybersecurity posture,” said Austin Eakin, senior information technology engineer at AZDOHS. “The enrichment and correlation Elastic provided enabled us to leap into action immediately, shifting from mainly reactive measures to a more proactive stance."

Implementing Elastic’s solutions equipped the AZDOHS with the tools and insights needed to:

• Gain unified visibility of high data volumes: Deploying Elastic centralized AZDOHS’s security data, providing unified visibility across various data sources — enabling faster threat identification.
• Reduce alert noise and speed up investigations: Streamlined alert management means fewer irrelevant alerts, minimizing alert fatigue and allowing analysts to focus on genuine threats.
• Increase proactive threat detection and response: With enhanced data visibility, AZDOHS can proactively take preventive measures to address vulnerabilities before they escalate into critical issues, ultimately safeguarding Arizona's critical infrastructure.

By leveraging Elastic, AZDOHS has strengthened its ability to monitor, detect, and respond to threats at scale, even as cyber threats continue to evolve and more data funnels through its systems. 

By leveraging Elastic, AZDOHS strengthened its ability to monitor, detect, and respond to threats at scale. What was once reactive alert triage has become proactive, AI-driven defense. Read the full case study.

Arbetsförmedlingen, a Swedish employment agency, manages multiple solutions across multiple vendors to support its IT infrastructure. However, this tool sprawl left Arbetsförmedlingen in technical debt, with fragmentation making it difficult to integrate processes and reduce operational costs. The agency needed a more cohesive and streamlined approach to its IT infrastructure.

As an employment agency, Arbetsförmedlingen efficiently matches job seekers with employers and provides services such as information, analysis, and employment forecasts. As a major public sector agency, it relies on over 12,000 employees, including 1,000 dedicated IT specialists. Its operations span labor market services, unemployment benefits, and employment support programs for millions of Swedish citizens and employers.

Arbetsförmedlingen assists both job seekers and hiring organizations in navigating the complexities of the labor market. By analyzing employment trends and offering insights, Arbetsförmedlingen supports informed decision-making for stakeholders across Sweden.

The agency focuses on innovation to create a more user-friendly experience for individuals seeking employment. By continually adapting to changing regulations and new technologies, Arbetsförmedlingen supports the nation's workforce in a dynamic economy.

As a government agency responding to employment and market trends, Arbetsförmedlingen must adapt to evolving government regulations and operations. To meet these requirements, Arbetsförmedlingen digitalized its IT infrastructure to help communicate with citizens and businesses and connect job seekers with potential employment opportunities.

However, the agency faced significant obstacles related to data volume, system efficiency, and the need for improved visibility.

One of the most pressing challenges is managing large volumes of structured and unstructured data across multiple systems. As job market dynamics fluctuated, the agency needed to respond quickly, but its existing legacy systems struggled to keep pace with the increasing demands for accurate and timely data.

The agency also faced considerable technical debt due to deploying solutions from numerous vendors over the years. This fragmentation complicated integration, reduced operational efficiency, and increased costs.

"Our observability solution had long response times and was out of date. The APM platform was expensive and complicated, and we wanted to consolidate several search tools into one solution," said Tobias Ström, product owner, operation center at Arbetsförmedlingen.

The rising expectation for faster search capabilities and better analytics intensified these challenges. Analysts required quicker access to insights to inform decision-making, but traditional methods fell short in providing the speed and reliability necessary for effective responses.

Arbetsförmedlingen recognized the need for a modern IT infrastructure. The challenge was not just technical; it was also cultural, as employees accustomed to older systems had to adapt to new ways of working that could potentially streamline operations.

• Large volumes of structured and unstructured data across multiple systems that legacy tools couldn’t keep pace with
• Technical debt from deploying solutions across numerous vendors, complicating integration and raising costs
• Rising expectations for faster search and analytics that traditional methods couldn’t meet

In light of these challenges, Arbetsförmedlingen had to find a solution that could simplify and enhance its operations. During the search for a resolution, Ronny Bergh, an IT specialist, discovered that some Java developers had transitioned to an open source version of Elasticsearch for system logging.

The agility of this deployment prompted the agency to reconsider its data management approach, ultimately enabling a significant increase in user capacity. By implementing Elastic Observability and Elasticsearch, the agency streamlined its data management capabilities, allowing teams to quickly analyze data and reduce the time spent on data retrieval.

Transforming data management was especially beneficial for internal analysts who rely on accurate, timely data to make informed decisions regarding job market trends and employment forecasts. With the ability to index and search through large datasets quickly, the agency increased its overall productivity without sacrificing security or quality.

Elastic also helped Arbetsförmedlingen overcome challenges posed by technical debt from its prior reliance on multiple vendor solutions. The unified Elastic platform streamlined its technology ecosystem and provided significant cost savings by reducing reliance on previous costly solutions while enhancing performance.

For a holistic view of its IT operations, the agency implemented an integrated platform for observability, search, and application performance monitoring (APM) to track and analyze data more effectively, improving decision-making and streamlining processes.

With Elastic, Arbetsförmedlingen reduced APM license and storage costs by 75%. Searchable snapshots enabled Arbetsförmedlingen to comply with data archiving standards while reducing dependency on costly storage, without sacrificing performance.

"The use of searchable snapshots capability means that we can search infrequently accessed and read-only data in the frozen data tier, which reduces our dependency on expensive solid-state storage," says Stefan Jonsson, product owner at Arbetsförmedlingen.

With Elastic's machine learning capabilities, the agency could identify trends and behaviors in the job market, assisting policymakers in making informed decisions that impact employment strategies.

With the implementation of Elastic, the agency has made significant strides in improving its operations and service delivery and transformed its approach to data management with:

• Improved data access for analysts and decision-makers: Real-time access to comprehensive datasets allows analysts to draw insights and make informed decisions quickly.
• Faster, more flexible search: The agency can now execute faster searches across various complex datasets for higher productivity and efficiency.
• Data-driven insights to improve employment services: The ability to analyze trends effectively helps the agency proactively address labor market challenges and adapt to the needs of job seekers and employers alike.

The partnership with Elastic has brought about a transformative shift in Arbetsförmedlingen's operations, moving it away from fragmented and costly legacy systems to a cohesive and integrated data management platform.

Arbetsförmedlingen’s shift from fragmented tooling across several vendors to a unified Elastic platform reflects a common trend across public sector agencies: Consolidating data unlocks the ability to move faster and spend less. Read the full case study.

The California Employment Development Department (EDD) is a large government agency responsible for delivering services that directly impact the lives of residents and their families.

EDD manages a significant volume of sensitive data generated from its high-availability digital systems, making cybersecurity and privacy critical. To manage large volumes of data across complex datasets, EDD requires better visibility into more agile systems.

As one of the largest state departments in California, EDD administers essential benefit programs, including unemployment insurance, disability benefits, and Paid Family Leave. These programs provide crucial support to millions of Californians, from recovering from illness to navigating job transitions.

Millions of citizens mean millions of datasets, creating an ever-growing database across digital systems that support residents, employers, and partner agencies statewide.

The department was undergoing a multiyear modernization effort to help improve both customer and employee experiences. However, digitization could not come at the cost of ensuring that customers remained supported and protected across its systems and applications.

In a rapidly evolving cybersecurity landscape, EDD needed a solution that could quickly process, visualize, and analyze data.

The complexity of monitoring nearly 3,000 servers across various programs came with additional challenges. The varying systems and applications created data silos that obscured critical insights necessary for informed decision-making. Teams at EDD required faster investigation capabilities without introducing additional operational complexity. The challenge is compounded by the need for real-time insights, making centralized monitoring increasingly important.

EDD also needed improved visibility into application performance and system behavior. Teams must quickly identify service disruptions, performance bottlenecks, and security incidents to respond effectively and maintain operations. Traditional tools often could not analyze large-scale data efficiently.

Balancing accessibility and security was a key challenge. While it’s essential to have robust security measures in place, overly stringent protections can hinder genuine beneficiaries from accessing the aid they need. EDD understood that security mechanisms should not impede the provision of critical services, particularly in urgent situations where timely assistance is key.

This is especially important during periods of economic disruption when claims surge. Events such as economic downturns, natural disasters, or health crises can lead to an influx of claims, putting an immense strain on the department’s resources. As demand increases, maintaining service availability and security becomes crucial. The risks included potential exploitation by bad actors seeking to access personal information or submit fraudulent claims, necessitating multiple layers of protection.

• Monitoring nearly 3,000 servers across varying systems and applications, creating data silos
• Need for real-time insights without adding operational complexity
• Balancing accessibility and security so legitimate claimants aren't blocked — especially during demand surges

To address the challenges of data management in complex, high-demand systems, EDD implemented Elastic Security, running on Elastic Cloud and AWS, to centralize observability and security insights across its environments. Elastic provided real-time visibility into application performance, critical threats, and suspicious activity.

By consolidating data from multiple sources, Elastic provides EDD with a comprehensive view essential for swift decision-making and effective incident management. With Elastic’s powerful infrastructure hosted on AWS, the department can leverage the scalability and reliability needed to support its operations, particularly during surges in service demand.

"Moving to Elastic Cloud on AWS speeds up performance for the security team, eliminating downtime and providing faster search and analysis of data,” says Douglas Leone, chief information security officer at EDD. “EDD currently has over 850 billion records in Elastic, and even as data volumes grow, performance remains strong."

Advanced dashboards provide clear visibility into traffic patterns, alerts, and overall system behavior, making it easier to identify potential vulnerabilities and prioritize action, shifting from reactive measures to a more proactive stance.

Elastic's AI-driven features, such as Attack Discovery, help teams prioritize alerts based on their severity. Security teams can focus on genuine threats while significantly reducing the time taken to detect and respond to security incidents.

The partnership with Elastic consulting provided customized support, including training and custom visualizations, helping teams fully adopt and optimize the platform. This collaboration facilitated a seamless onboarding experience and reinforced the department's commitment to maintaining security and efficiency across its operations.

By implementing Elastic alongside AWS, EDD improved operational efficiency while strengthening data protection and service reliability.

EDD improved its ability to manage high-demand systems and protect critical services, allowing the agency to better serve millions of Californians while protecting sensitive data.

Integrating Elastic Observability has helped:

• Unify visibility across distributed systems: EDD can now monitor applications and infrastructure components in real time, identifying potential issues and maintaining critical services.
• Speed up detection and resolution: Real-time insights into application performance and system health reduce the average time needed to identify and resolve anomalies.
• Strengthen monitoring and security: Advanced dashboards and AI-driven features enable proactive monitoring.
• Improve operational resilience during high demand: Elastic’s scalability, combined with AWS, allows EDD to handle surges in claims and inquiries.

By improving visibility, accelerating response times, and strengthening monitoring capabilities, EDD is better positioned to provide reliable and effective services to millions of residents.

EDD’s move to Elastic shows what’s possible when observability and security run on the same platform, resulting in faster detection, less manual overhead, and services that hold up under surge demand. Read the full case study.

The City of Sacramento serves more than half a million residents across a diverse Northern California community. With thousands of pages of data spread across more than 10 city websites, residents often struggled to find basic answers — from what to do about a stray dog to how to replace a broken garbage can. As a result, they often turned to email or the city’s 311 hotline instead.

By building AI-powered search and a virtual assistant on Elasticsearch, Sacramento gave both residents and staff a faster way to find the information they needed.

The City of Sacramento is California’s capital. It doesn’t just serve its diverse community. It is also home to instrumental government agencies and services. And as a Northern California hub — proximal to centers of technological innovation like Silicon Valley and San Francisco — the city has embraced the spirit of innovation through its use of technology.

"Working for the City of Sacramento is like working for both a startup and a local government. We're encouraged to experiment and use technology to deliver new and better services, and we get to see the impact on our community as well," says Mrudul Sadanandan, assistant director of IT at the City of Sacramento.

The City of Sacramento’s public agencies serve its community through essential utilities like water and garbage services alongside investments in arts, culture, and public spaces. Over the past several years, the city has focused on modernizing its digital experiences to enhance its public services. 

The City of Sacramento was struggling with an inefficient search infrastructure. With fragmented systems running across legacy platforms, data was spread across multiple sites, making it difficult for internal teams and citizens alike to find information.

With thousands of pages across more than 10 websites, residents often couldn’t find the answers they needed. And when they couldn't find something online, they emailed city departments directly or called the 311 customer service hotline instead — adding to staff workload in the process.

• Thousands of pages spread across multiple websites
• Inefficient workflows due to lack of data visibility and manual alert resolution
• Unsatisfying resident experiences due to limited search capabilities

The City of Sacramento first deployed Elasticsearch to modernize its web search and unify its data. While undertaking a major website redesign, the city took the chance to build a new information architecture. After evaluating the market, the team chose Elasticsearch to overhaul its search infrastructure to improve visibility.

"Elastic checked all of the boxes, balancing functionality with ease of use. It met our scaling needs, brought in data from multiple sites, and provided capabilities such as semantic search and machine learning right out of the box,” says Sadanandan.

Elasticsearch, running on Elastic Cloud on Google Cloud, provides core search and indexing for all of the city’s websites. The city built on that initial foundation, using Elastic as the indexing and data retrieval layer for SacGPT, an internal virtual assistant built with Elastic consultants using retrieval augmented generation (RAG) methodology.

Sacramento’s AI search now helps both staff and the public find data faster thanks to increased visibility and unified data, building public confidence in what the city’s AI tools can do.

Other outcomes of modernizing search with Elastic included:

• A virtual assistant built in six months: City staff and Elastic consultants delivered SacGPT using RAG methodology 30% faster than originally planned.

• Faster answers for staff: The virtual assistant lets staff focus on improving services for residents across Sacramento.

• Trusted, cited results for the public: Elastic and Google Cloud power a precise AI search that residents can trust, with every answer backed up by clearly cited sources.

• More capacity at the 311 call center: A public-facing agent for the city’s 311 line handles more work than four full-time employees daily.

Sacramento now treats its data as a service after transitioning from basic web search to public-facing AI search. This foundation made it possible for the city to now support a public records platform, Cara, that helps residents obtain documents and records in accordance with the California Public Records Act. Read the full case study.