Cybersecurity Awareness Month and campus cyber events: how public-sector CISOs run outreach

Two ways to run outreach

Public-sector security leaders reach people in more than one way, and two primary sources show different approaches. One is a state press release from Oklahoma's Office of Management and Enterprise Services (OMES), dated October 1, 2026. The others are Stanford University IT's pages for its 2024 Cybersecurity and Privacy Festival, known as Cyberfest.

Oklahoma's campaign runs for a full month and is aimed at the whole state. Stanford's festival was a single day built for a campus and higher education audience. Each one puts a chief information security officer in front of the people it wants to reach.

Oklahoma: a proclamation, a national theme and four habits

The OMES release says Gov. J. Kevin Stitt, working with OMES, has declared October 2026 as Cybersecurity Awareness Month in Oklahoma, which the release presents as a matter of shared responsibility among individuals, organizations and government.

According to the release, the state ties its campaign to a federal message: the governor's proclamation matches the theme set by the Cybersecurity and Infrastructure Security Agency (CISA), Securing the Next 250, which marks America's 250th anniversary.

The release gives the state's security leadership a public voice. It quotes State Chief Information Security Officer Daniel Langley, who leads Oklahoma Cyber Command, saying that "the strongest cyber defenses are built before an incident ever occurs."

It describes Oklahoma Cyber Command as the state's central cybersecurity team, which works around the clock to monitor, identify and respond to cyber threats while protecting state users, networks, data and applications.

The public-facing content is short. The release passes on CISA's four core steps for everyone: use strong passwords and a password manager, turn on multifactor authentication, recognize and report scams, and update software and systems regularly.

Turning organizations and residents into participants

The Oklahoma campaign asks for action as well as attention. The release says businesses, government agencies and other organizations in Oklahoma can become "Oklahoma Champions" by pledging to practice good cybersecurity habits.

Organizations that sign up get public credit for it, because the release says Champion organizations will be recognized on the OK-ISAC website.

For individuals, the release points to OK-ISAC's "31 Days of Cybersecurity" challenge, a daily set of easy ways to secure devices, learn about cyber threats and practice online safety.

The organization running these programs has a defined history. The release says the Oklahoma Information Sharing and Analysis Center was set up in August 2020 as a multiagency effort led by OMES, and that it offers monitoring, vulnerability identification, incident response and threat intelligence to members and partners.

The campaign also tells people where to send a report, and that route depends on who is reporting. According to the release, state employees who want to report cyber incidents or suspicious activity to Oklahoma Cyber Command should open a ticket with the OMES Service Desk.

Everyone else is directed to federal channels. The release says non-state employees can report incidents such as theft of funds, identity theft and other fraud to the FBI's Internet Crime Complaint Center (IC3) and the Federal Trade Commission.

Stanford's Cyberfest: a one-day festival built around AI

Stanford's approach is an in-person event. The festival page lists the 2024 Cybersecurity and Privacy Festival for October 17, from 8 a.m. to 4 p.m., at the Frances C. Arrillaga Alumni Center, with AI as its central topic.

The audience reached beyond the university itself. The page invites Stanford University, Stanford Health Care, SLAC and the wider higher education community.

The talks covered AI from several sides: a venture investor on AI in cyber, a Stanford Health Care data scientist on AI in healthcare, a Harvard engineer on deep learning for compromised account detection, and a Stanford Ph.D. student on machine learning security. The speakers page describes the student's talk as one that focuses on finding and fixing weaknesses in large AI systems.

The festival also offered hands-on activities alongside the talks. According to the page, lockpicking tables ran all day in McCaw Hall, and attendees were given the knowledge and tools to pick locks while listening to the sessions.

A vendor expo ran from 10 a.m. to 4 p.m. outside McCaw Hall, and the Stanford University Privacy Office appeared on the list of participants with the commercial vendors.

Students had their own segment. The page describes a pitch competition in which Stanford students presented security and AI ideas to industry experts, investors and potential partners.

Putting CISOs on stage

At Stanford, the CISO is part of the program. Amy Steagall, Stanford's Chief Information Security Officer, gave the welcoming remarks. The speakers page says she oversees Stanford's efforts to protect its computing and information assets and to comply with information-related laws, regulations and policies.

Her biography is relevant to anyone following career paths. The page says she joined Stanford in 2020 after 25 years in the United States Air Force, a career that ended at the Joint Force Headquarters-Cyber at NSA Texas.

The afternoon included a live recording of the CISO Series Podcast, hosted by David Spark, with Steagall and Harvard's Michael Tran Duff as guests. The page bills it as the show's first university appearance and says it is open to current and aspiring security professionals.

Duff's path links the two universities. The speakers page says he became Stanford's CISO in 2013, added the Chief Privacy Officer role in 2018, and then moved to Harvard.

What the two programs share, and what is changing

The sources show both programs using the CISO as a public face, giving people something to do beyond reading, and pairing awareness with a specific threat theme. In Oklahoma that theme is evolving threats and AI. At Stanford it is AI security and privacy.

The formats are still changing. Stanford's festival page says the Cyberfest organizers and the IT Unconference organizers have joined to create Converge, a single community event scheduled for December 11, 2025.