Federal AI Push Puts Cyber Control at the Center

The U.S. Army Corps of Engineers is building cybersecurity into its artificial intelligence strategy as it expands AI across agency operations, including systems linked to hydropower dams and locks. The infrastructure, and the decisions made around it, sit inside federal institutions. The Corps says cyber protection must accompany the technology at every stage.

Who Controls the Systems

The Corps’ strategy rests on three pillars: accelerating AI adoption, educating and training the workforce, and building AI capabilities described as enduring, tested, trusted and verified. Matt Parks, the chief artificial intelligence officer for the Corps of Engineers, said cybersecurity must be integrated across all three.

“I've made it a real point to include cyber in everything that I do to make sure that the AI ecosystem triad of capabilities, authoritative data, and modern IT infrastructure are operating at a high, high level,” Parks said during a discussion on AI and cybersecurity strategy.

Parks said the Corps is making targeted capital investments in modern infrastructure, designing resilient systems, strengthening data governance and investing in Army Vantage to operationalize data and make it accessible. The work also requires a culture of cybersecurity awareness, he said. The agency is pairing expanded use of data and AI with more formal control over how it manages data and infrastructure.

The Corps uses digital twins in an operational technology monitoring initiative intended to protect critical infrastructure, including hydropower dams, locks and similar facilities. “We do get constant cyber attacks from bad foreign actors on those things. So we're always trying to mitigate that risk,” Parks said.

Automation, With a Human in the Loop

The Corps is considering AI-powered threat detection to sort thousands of cyber risk alerts, many incorrect, so staff can focus on those judged important. The proposed system would sit between a flood of warnings and the workers responsible for assessing them. Staff would still decide what warrants attention.

At the Department of Agriculture, the cybersecurity and privacy operations center uses AI tools to monitor agency networks, conduct continuous monitoring and threat analysis, and provide centralized awareness, analytics and reporting. Rudy Rojas, an information technology manager and security specialist at the department, said staff review the reports.

“I'll review those reports and determine whether we need to do a whitelist or whether we need to create a blacklist,” Rojas said. The agency isn't giving AI total control, he said, and keeps a human involved in cybersecurity. “So far, it's working good,” he said, adding that vendor-based tools are moving quickly toward AI-powered predictive analytics.

Rojas said AI is also part of the USDA's zero trust effort. The agency's chief information officer has made endpoint protections a priority to protect data and systems and manage software updates. Staff remain in the decision process while automated monitoring runs across department networks. That division of work keeps people involved.

Dependencies Behind the Promise

At the Idaho National Lab in the Energy Department, cybersecurity leaders assess AI by asking how to secure from AI, secure with AI and secure AI. Scott Bowman, the technical lead for cyber-physical systems at INL, said the COGNITO program assesses consequences before AI adoption, including effects on workflows and systems that will depend on the technology, and how critical AI could become to a system.

Bowman questioned what would happen if an application programming interface, a cloud API or Codex became unavailable, or if a budget or token limit were reached. AI can help people understand their processes in greater detail, he said, but INL also examines AI tools’ code and architectures through what he called a “mechanistic analysis.” “You're never going to get comfortable, and if you do get comfortable, then it's probably not the right direction,” he said.

Chris Cardran, a federal security advisor for defense and intelligence at Splunk, recommends that federal clients consider a smart machine model approach. He described creating a model, training it on a customer’s data and searches, extracting information, grading it and operationalizing it. These models handle specific tasks and require less computing power than a large frontier model. Teams can keep them self-contained, take them offline for updates or retraining, grade them again and return them to operation.

Kevin Dorsey, the director of federal solutions development at Optiv+Clearshark, said customers need bespoke large language models that meet AI governance requirements and perform the work required. “We don't have the luxury of, maybe call it luxury, going to Deep Seek and pulling in a Chinese model with our customers,” he said. Dorsey said agencies need models small enough to run in data centers with limited space. Budgets are constrained, including for GPU purchases, so organizations are looking for practical uses such as helping detect and collate information on customer tactics, techniques and procedures or standard operating procedures.