Cyber Warriors Emerge: 25 Fresh Faces from NYC’s Elite Academy
Summary
- NYC Cyber Academy graduated 25 city employees from 22 city agencies in March 2025.
- The four-week program, run by NYC Cyber Command, focuses on incident response and threat intelligence.
- Graduates serve as Cyber Command liaisons for their agencies.
- The academy has now trained 75 public servants from 61 agencies since it started in 2022.
A New Class of City Cyber Defenders
New York City’s Cyber Academy has graduated its latest class of 25 public servants. City Chief Technology Officer Matthew Fraser and Chief Information Security Officer Kelly Moan marked the graduation in early March 2025. The graduates come from 22 city entities and will now act as liaisons between their agencies and NYC Cyber Command.
Inside the Cyber Academy
NYC Cyber Command, part of the city’s Office of Technology and Innovation, developed and runs the four-week program. It covers incident response and network security, along with cyber threat intelligence work. The goal is a larger, better-trained cyber workforce across city government and closer coordination between agencies and Cyber Command.
The program grew out of a 2022 mayoral mandate that each city agency appoint a Cyber Command liaison to share information and security best practices.
Start your morning with the signal that matters.
Get the weekday cyber brief for the AI risk, regulation, abuse, and enterprise security changes this article could not cover.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why the City Is Training Its Own
Hiring is hard. New York City’s agencies run services that millions of people depend on every day, from water to schools to emergency dispatch, and skilled security staff can usually earn more elsewhere. Training existing employees gives each agency someone who knows both its systems and Cyber Command’s procedures.
“As cyber threats continue to pose real-world dangers, New York City remains committed to staying current and expanding the skills, knowledge, and coordination of its cyber professionals throughout city government to ensure the resilience of the critical services that New Yorkers depend upon,” Fraser said.
How Cyber Command Works with Agencies
NYC Cyber Command leads citywide cybersecurity. It sets security policy and works with more than 100 municipal agencies to prevent and respond to threats.
It also partners with state and federal agencies at the Joint Security Operations Center (JSOC) in Brooklyn, which monitors threats around the clock. Moan said that in just over two years the academy has produced a better-trained and more collaborative cyber workforce in city government.
What the Graduates Will Do
Back at their agencies, the graduates will strengthen security practices and coordinate with Cyber Command during incidents.
With this class, the academy has trained 75 public servants from 61 city agencies since 2022.
A Growing Network
Each class adds people across city government who know whom to call and what to do when an attack hits.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
“Today’s Cyber Academy graduates play a frontline role in our continuous efforts to keep our city and its government safe from constant online threats,” Fraser said.
What Other Cities Can Learn
It’s cheap to copy. Train a security liaison inside each agency, and connect them all to a central security team.
For cities that cannot hire enough security specialists, building skills from within is often the most practical way to close the gap.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.