Pennsylvania Buys Cyber With Receipts: $10M More, Against $37M In Claimed IT Savings

Pennsylvania's 2026-27 budget, signed by Gov. Josh Shapiro, adds $10 million for cybersecurity and $3.7 million for the Commonwealth Office of Digital Experience, known as CODE PA ^[1][2]. Alongside that, state officials say the Office of Administration and CODE PA have together saved $37 million on IT spending ^[3], and that adjacency is the part security leads in other states should study.

The cyber increase is cumulative, not a one-off. Officials put the total rise in cybersecurity spending under the Shapiro administration at $30 million over three years ^[4], which means this cycle's $10 million is a third of that total and the earlier two years accounted for roughly $20 million ^[1]. Against the claimed savings, the new cyber money is about 27 percent of $37 million ^[2]. That ratio matters more than either figure on its own: a security ask that consumes a minority of demonstrated savings is arithmetically easy for a budget office to approve, because the program still nets out cheaper than the year before.

Where the savings supposedly came from is the other half of the argument. The state attributes the $37 million to system upgrades, using in-house resources, and improved financial management ^[3]. CODE PA, which stood up in 2023, has consolidated dozens of websites into a single PA.gov platform ^[5]. Consolidation of that kind reduces the number of distinct properties someone has to patch, certify and monitor, though the source material does not quantify any security effect from the website work ^[3].

Two cautions before anyone copies the slide. First, the reporting, which SC Media attributes to StateScoop, does not say the $10 million was appropriated out of the $37 million in savings; the two numbers are presented next to each other, not reconciled in a single ledger ^[4]. The credibility of the "we paid for it with efficiency" pitch depends on that link being auditable, and here it is asserted by the same officials who generated both figures ^[3]. Second, the CODE PA numbers are loose: the office receives $3.7 million in the budget but is described as spending nearly $4 million on updating permitting processes ^[2][6]. That is a small gap, and it is the kind of gap that gets asked about in a hearing.

The stated purpose of the increase is conventional and worth noting for what it concedes: strengthening IT defenses, reducing the risk of technological disruption, and keeping data and systems secure and available ^[7]. Availability language in a cyber appropriation usually means outage risk is doing at least as much persuasive work as breach risk.

What to watch. Whether the $37 million savings claim is ever itemised by an independent auditor, since the transferability of this model rests entirely on that number surviving scrutiny ^[3]. Whether the $10 million is recurring baseline or a single-year plug, because a savings-funded program that has to re-earn its savings annually is a treadmill. Whether the permitting modernisation at CODE PA arrives with its own security review, given the office is simultaneously running consolidation work ^[5][6]. And whether other states start presenting consolidation savings and security asks in the same document, which is the cheapest structural change a public-sector security lead can make this cycle.