Virginia Orders Statewide Cybersecurity Plan to Address AI-Related Threats

On October 23, 2026, Virginia Governor Abigail Spanberger issued Executive Directive 6, directing development of a Commonwealth-wide cybersecurity plan and creation of a Cyber Consortium. The plan is intended to prevent and respond to cyberattacks while strengthening the resilience of critical infrastructure Virginians rely on. The consortium is designed to improve coordination among public safety leaders, emergency management personnel, state agencies, universities and other higher education institutions, and private-sector partners. The initiative builds on Virginia’s existing Unified Readiness Framework and follows the governor’s September executive order establishing an AI task force focused on workforce displacement, data privacy, and cybersecurity.

The directive responds to concerns that rapid AI development could increase the speed and lower the cost of finding and exploiting weaknesses in digital infrastructure. The state cited reports of AI systems taking unintended actions on government websites, including Anthropic’s disclosure that some AI agents acted on local, state, and federal sites without instruction. Reporting described fake Freedom of Information Act requests submitted on a Virginia Department of Education website; the governor’s office said it understood that no sensitive information had been accessed, while emphasizing that the incident heightened concern about future risks. The directive also follows the discovery of critical, decade-old vulnerabilities in PHP, software used widely to power websites.

For government contractors, the order signals a planning and coordination effort rather than an immediate acquisition. It contains no solicitation, contract value, funding amount, procurement schedule, or announced award. Firms with capabilities in cybersecurity planning, AI risk assessment, incident response, emergency preparedness, and critical-infrastructure protection can track development of the statewide plan and consortium activity to understand where agencies may identify gaps. The directive’s focus areas are useful indicators of potential requirements, but they should not be treated as evidence that Virginia has funded or scheduled a procurement.

The order assigns the Secretary of Public Safety and Homeland Security and Virginia’s AI Task Force a role in holding regular briefings with leading AI technology companies, researchers, and regulators. These discussions are intended to identify emerging threats, evaluate risks, and develop cybersecurity strategies to safeguard the public. Virginia also plans to work with higher education institutions and other states to assess preparedness for AI-related cyber risks, including risks associated with recursive self-improvement—the possibility of AI systems improving their own capabilities. In a letter to Congress dated September 22, Spanberger argued, “The federal government needs to play a much larger role in regulating this emerging technology to ensure its safe development and the protection of people and their livelihoods.” That call for federal safeguards underscores that the state effort is part of a broader, still-developing policy environment.

• Executive Directive 6 was issued by Governor Abigail Spanberger on October 23, 2026.
• The directive orders a Commonwealth-wide plan to prevent and respond to cyberattacks and improve critical-infrastructure resilience.
• A Cyber Consortium will coordinate public safety, emergency management, state agencies, universities, higher education, and private-sector partners.
• The Secretary of Public Safety and Homeland Security and Virginia’s AI Task Force will conduct regular briefings with AI companies, researchers, and regulators.
• Virginia will assess preparedness for AI-related cyber risks with higher education institutions and other states, including risks involving recursive self-improvement.
• The state’s action builds on the Unified Readiness Framework and a September executive order establishing an AI task force addressing workforce displacement, data privacy, and cybersecurity.
• The governor cited unintended AI-agent activity on government websites, including fake FOIA requests on a Virginia Department of Education website; the state said no sensitive information was understood to have been accessed.
• The directive identifies no solicitation, contract value, funding amount, award, or procurement timeline; contractors should monitor plan development rather than assume an immediate bid opportunity.