Federal Cyber Chiefs Put Agencies Through AI Threat Drill

The Federal Chief Information Security Officer's Council plans to bring agencies together in early November for a governmentwide exercise on AI-enabled cyberattacks. Federal systems and personnel will face a test of how they’ll respond when digital defenses fail. The exercise follows an 89 percent increase in cyberattacks using artificial intelligence in 2025 compared with 2024, according to the report.

Who Has the Power

Mike Duffy, the acting federal CISO, said the exercise will assess the capabilities, processes and personnel agencies need to respond to cyber events. Speaking at ACT-IAC's Cybersecurity Summit on Oct. 14, he called it the council's second all-government CISO-level tabletop. The first, held the previous year, focused more broadly on cybersecurity readiness and resilience.

“We are preparing for the second all full government CISO level tabletop exercise,” Duffy said. “We had the first one last year to exercise what it means for not only individual agencies to exercise their incident response playbook, but what does it mean for all agencies?” Council members will meet with security operations center directors to discuss how the federal enterprise can make sure it has the people, processes and capabilities needed to respond.

The threat isn’t confined to sophisticated hackers. Duffy said CrowdStrike's 2026 report found that AI-accelerated phishing and automated reconnaissance were shortening the time from initial access to impact. The report said AI attacks had elevated less sophisticated threat actors and amplified the most advanced ones.

The CISO Council has brought back its AI working group, focused on security governance, and started a post-quantum cryptography working group in the previous month. Duffy called the post-quantum effort a multiyear project that will require expertise and workforce migration. He cited the National Institutes of Standards and Technology and the Cybersecurity and Infrastructure Security Agency among the government organizations working on what comes next.

Orders, Directives and the Cost of Exposure

The Trump administration released a national cyber strategy in March, while the Office of Management and Budget has focused on policies, procedures and capabilities for defending against cyberattacks, including changes to cyber logging architecture policy. The Cybersecurity and Infrastructure Security Agency has changed its known exploited vulnerabilities catalog to prioritize vulnerabilities based on factors including likely exploitation and potential mission impact.

Agencies are also working under a binding operational directive to secure and modernize endpoint devices. A sprint within the CISO Council is assessing how much progress agencies can make with existing resources before the end of the fiscal year, including removing outdated edge devices and infrastructure. Duffy said the long-term aim is to sustain operational resilience by repeatedly assessing which systems and infrastructure need attention. The account identifies the task, but gives no figure for the resources agencies already have.

The Department of Homeland Security ordered federal civilian agencies to remove AI developed by China's DeepSeek from their systems and prohibited future purchases of its products and services. The order also covers third-party services developed using DeepSeek. DHS said the company's models “present multiple threat vectors” and their use “may result in the transfer of sensitive data to the [People's Republic of China] if used by US government employees or vendors.”

DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018, after reviewing a recommendation and supporting evidence from the Federal Acquisition Security Council. The notice didn’t detail the security concerns or set a deadline for agencies to act. The Commerce Department banned DeepSeek from government devices the previous year, and the U.S. Navy told its members not to use the model over potential security concerns. New York state also barred it from government devices and networks, citing “serious concerns” about possible data privacy and censorship risks.

Keeping Systems Running—and Who Shapes the Data

In a Federal News Network commentary, Travis Rosiek, public sector chief technology officer at Rubrik, argued that agencies should plan to keep critical missions operating during cyberattacks, rather than rely only on preventing intrusions. He cited the Office of the Director of National Intelligence's 2026 Annual Threat Assessment, which said adversaries were exploiting supply chains to compromise software source code and position themselves inside federal networks, seeking persistent access to shut down critical services, disable power grids and disrupt military readiness.

Rosiek cited the self-replicating Shai-Hulud worm, which attackers deployed into developer pipelines in 2025. He wrote that it bypassed perimeter defenses, harvested cloud credentials and moved into private- and public-sector networks. Disaster recovery plans designed for natural disasters, power outages, floods and hardware failures don’t adequately address cyberattacks, he said. His proposed measures include isolating breached segments while maintaining core mission functions, testing recovery plans with security, cloud, IT and backup administrators, and mapping data owners and dependencies. He also cited the Cybersecurity and Infrastructure Security Agency's CI Fortify initiative for defense, health and telecommunications operators, and called for federal, state and defense networks to meet standards applied to critical infrastructure operators.

A separate community-led effort from the Data Foundation aims to guide a national data strategy. Taka Ariga, vice president for data policy and impact at the Data Foundation, argued that the United States has no national strategy, while the United Kingdom published one in 2020 and China developed national policy and a dedicated agency around data as a strategic asset. The effort plans to create a living document for feedback, discussion and critique, with outreach across sectors and communities. Ariga said it isn’t meant to create a new federal strategy, but to build on the existing federal foundation and extend it across society.

Data.gov provides public access to many federal, state and local open datasets. The Foundations for Evidence-Based Policymaking Act, signed by President Donald Trump in 2019, requires a standard application process for researchers seeking restricted federal data; the Federal Data Strategy, released in 2019, encouraged agencies to manage data better and drew on input from industry and researchers. Ariga said generative artificial intelligence has made public data more valuable and more sensitive as states and localities build data capacity, investment flows into projects combining public and private data, and privacy expectations change. The discussion draft and updates will be available through NationalDataStrategy.us. Institutional plans are extensive. The people expected to live with their consequences have yet to speak in the account.