Federal AI Push Puts Cyber Control First

The U.S. Army Corps of Engineers is building cybersecurity into all three pillars of its artificial intelligence strategy as federal agencies weigh how much operational work to hand to AI systems. The strategy calls for faster AI adoption, workforce training, and capabilities that are enduring, tested, trusted and verified. Matt Parks, the Corps’ chief artificial intelligence officer, said cybersecurity must run through each part.

Cybersecurity Across the System

Parks said the Corps is investing in modern infrastructure, designing resilient systems, strengthening data governance and investing in Army Vantage to make data accessible and operational. The effort also requires a culture of cybersecurity awareness, he said.

“I've made it a real point to include cyber in everything that I do to make sure that the AI ecosystem triad of capabilities, authoritative data, and modern IT infrastructure are operating at a high, high level,” Parks said during the discussion “How AI Is Reshaping Cybersecurity Strategy and Security Operations.”

The Corps uses digital twins in an operational technology monitoring initiative intended to protect critical infrastructure, including hydropower dams and locks. Parks said foreign actors launch constant cyber attacks against the agency, which is considering AI-powered threat detection to sort thousands of alerts, many incorrect, so staff can focus on the important ones.

AI can help agencies analyze more data more quickly and mitigate risks faster, federal and industry experts said. But that operational value comes with questions about system dependence and oversight, which agency officials and industry representatives described as central to deployment.

Human Review and System Dependence

At the Department of Agriculture, the cybersecurity and privacy operations center uses AI tools to monitor agency networks, conduct continuous monitoring and threat analysis, and provide centralized awareness, analytics and reporting. Rudy Rojas, an information technology manager and security specialist at the department, said staff review reports before making decisions about whitelisting or blacklisting.

The agency isn't giving AI total control, Rojas said, and keeps a human involved in cybersecurity. “So far, it's working good,” he said. Vendor-based tools are also moving quickly toward AI-powered predictive analytics, he said. AI is part of the USDA's zero trust effort, while the agency's chief information officer has made endpoint protections a priority for protecting data and systems and managing software updates.

At the Idaho National Lab in the Energy Department, cybersecurity leaders assess AI by considering how to secure from AI, secure with AI and secure AI. Scott Bowman, INL’s technical lead for cyber-physical systems, described the COGNITO program, which assesses consequences before adoption. That review includes effects on workflows and systems that will depend on AI, as well as how critical AI could become to a system.

Bowman also raised questions about dependence on an application programming interface, a cloud API or Codex, including what would happen if one became unavailable or a budget or token limit was reached. INL examines AI tools’ code and architectures through what Bowman called a “mechanistic analysis.” He warned that people won't understand every dependency well enough to feel comfortable. “You're never going to get comfortable, and if you do get comfortable, then it's probably not the right direction,” he said.

Models, Costs and Procurement Choices

Chris Cardran, a federal security advisor for defense and intelligence at Splunk, said he often recommends federal clients start with a smart machine model approach because AI models are complex. He described creating a model, training it on a customer's data and searches, extracting information, grading it and putting it into operation. These models handle specific tasks and need less computing power than large frontier models. Teams can keep them self-contained, take them offline for updates or retraining, grade them again and return them to operation.

Cardran said such models can help protect operational technology systems and support machine-based questions about cyber logs and metrics. Kevin Dorsey, Optiv+Clearshark’s director of federal solutions development, said customers are seeking practical uses for bespoke large language models that meet governance requirements and improve mission success.

“We don't have the luxury of, maybe call it luxury, going to Deep Seek and pulling in a Chinese model with our customers,” Dorsey said. Agencies need models small enough to run in data centers with limited space, he said, while budgets are constrained, including for GPU purchases. He cited AI assistance in detecting and collating information on customer tactics, techniques and procedures or standard operating procedures as a practical use under consideration.