Defending Essential City Services
From turning on their taps to crossing an intersection to paying their utility bills, residents and visitors across Los Angeles rely on a complex digital ecosystem to keep their days running smoothly and safely. Behind those daily moments is a vast, constantly changing technology environment serving the second-largest city in the United States: nearly four million residents, half a million businesses, close to 50 million visitors a year, and more than 40 city departments.
A cyber incident in this environment can affect public safety, civic life, and the city’s ability to deliver essential services.
“The City of Los Angeles is a big target,” explained Ted Ross, Chief Information Officer, City of Los Angeles. “We oversee a massive infrastructure that runs everything from public safety and ports to LAX and the Department of Water and Power. We’re also hosting the world for three straight years with major global events including the World Cup, the Super Bowl, and the Olympics and Paralympics. The scale is enormous, and our mission is to keep these civic services resilient and secure 24 hours a day.”
Intercepting Threats Earlier in the Attack Chain
Each municipal department across Los Angeles operates with its own mission, technology stacks, deployment workflows, and security maturity. To bring order to this fragmented landscape, the city established its Integrated Security Operations Center (ISOC). The ISOC acts as a hub providing a central point of coordination across departments and with federal, state, and local partners.
As ransomware strains and cyber threats grew increasingly automated, the city needed endpoint protection that could keep pace with evolving attacker behavior. Earlier tools relied more heavily on signature-based detection frameworks, often forcing IT staff into tedious machine re-imaging cycles. The city standardized on the SentinelOne Singularity Platform. Powered by behavioral AI, SentinelOne grants defenders visibility into suspicious activity as it unfolds, providing autonomous execution controls to kill malicious processes, quarantine compromised devices, or execute a patented one-click rollback before an incident can spread laterally across city networks.
Securing a Decentralized Municipal Architecture
Deploying a uniform security standard across a municipality as vast as Los Angeles presents immense operational hurdles. By utilizing bulk-import capabilities to transfer hundreds of pre-existing endpoint exclusions, the security team successfully rolled out SentinelOne citywide across 20,000+ endpoints in just three to six months.
SentinelOne’s native multi-tenant site architecture maps cleanly onto the city’s distributed structure. Flexible Role-Based Access Control (RBAC) grants individual departments localized administrative sites and scoped permissions to oversee their own endpoints, while the central ISOC maintains citywide telemetry and cross-departmental visibility.
As the program has matured, the city has expanded its SentinelOne footprint beyond endpoint protection. Singularity Network Discovery continuously scans network segments to identify unmanaged hardware and rogue IoT devices, while the city supports investigation, retention, and broader operational visibility with Singularity Data Lake. Singularity Identity monitors Active Directory and domain controller behavior to block credential harvesting and lateral privilege escalation.
Multiplying Team Capacity Without Increasing Headcount
Like many state and government organizations, the city operates with a lean internal IT staff facing exponentially growing operational demands. Acting as a seamless extension of the internal team, the MDR service provides 24x7x365 tier-one triage, filtering out background noise so senior defenders can focus strictly on high-severity escalations, deep forensics, and active threat hunting.
“From a leadership perspective, Wayfinder MDR is a profound force multiplier,” Lee said. “It adds the operational equivalent of nine full-time employees, providing 24x7x365 coverage. By filtering lower-priority alerts, it frees our senior team to focus on deeper investigation, proactive hunting, and incident response.”
Hyperautomation has become one of the team’s most valued capabilities for extending response across its decentralized environment. Analysts use customizable workflows to search for specific file artifacts or indicators, package forensic bundles directly into the Data Lake, and handle operational or administrative tasks across departments.
Streamlining Investigations and Building Departmental Trust
To accelerate the path from initial signal to full contextual understanding, defenders rely on SentinelOne Storyline, which automatically stitches scattered processes and execution paths into a clean visual tree. For newer SOC analysts, Purple AI translates complex threat data by answering natural-language queries in plain English, helping tier-one analysts summarize events and determine immediate next steps.
This technical architecture is backed by a dedicated SentinelOne Technical Account Manager (TAM) who understands the city’s unique multi-site layout and operational constraints. Having a dedicated subject-matter expert allows the ISOC to resolve technical edge cases rapidly.
“We have to build trust with departments, and it’s important for us to resolve issues quickly,” Lee said. “Having SentinelOne as a partner that works with us to resolve challenges fast makes a real difference.”
Confidently Safeguarding the Future of Los Angeles
With faster detection, automated response, and around-the-clock MDR support, the City of Los Angeles has extended the reach of its lean security team. For the analysts protecting the city every day, the impact comes down to a single word.
“Empowering,” Scott said. “I’m no longer struggling with alert fatigue or burnout. I have the ability to be proactive, and all of these capabilities right at my fingertips.”
That stronger operational posture is especially important as Los Angeles prepares for three straight years of major global events.
About SentinelOne
SentinelOne is a leading AI-powered cybersecurity platform. Built on the first unified Data Lake, SentinelOne empowers the world to run securely by creating intelligent, data-driven systems that think for themselves, stay ahead of complexity and risk, and evolve on their own. Leading organizations — including Fortune 10, Fortune 500, and Global 2000 companies, as well as prominent governments — trust SentinelOne to Secure Tomorrow™. Learn more at sentinelone.com.
About the City of Los Angeles
The City of Los Angeles is the second-largest city in the United States, serving nearly four million residents and hundreds of thousands of businesses across more than 40 departments. Consistently ranked among the top digital cities in the nation, Los Angeles delivers essential public services spanning public safety, water and power, transportation, ports and aviation, sanitation, libraries, and parks while preparing to host major global events, including the FIFA World Cup, the Super Bowl, and the Summer Olympics and Paralympics.
