FEDINSIDER

AI introduces new vulnerabilities – such as data leakage, model manipulation, and uncontrolled access – even as agencies are still figuring out how existing risk and security frameworks apply. Recent news articles have reported that Anthropic’s newest AI model, Mythos, found 2,000 vulnerabilities in just seven weeks of testing commercially available software; Mozilla, for instance, reported Mythos identified 271 security vulnerabilities in Firefox 150. There have been instances where security teams are pulled in late and asked to “make it safe” after deployment decisions are already underway.

There are cybersecurity constructs in place that can help control access to AI tools and data. For example, the Zero Trust mandate already in place – “never trust, always verify” – strengthens requirements for access. Having an “identity-first” security structure can minimize the risks associated with AI adoption.

Learning Objectives:

• Identify existing cybersecurity weaknesses in existing processes, such as where security is being bypassed or bolted on too late
• Understand how to apply Zero Trust concepts to AI workflows
• Confirm cybersecurity alignment with guidance provided by the National Institute of Science and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA)

Major, globally visible events—such as the World Cup or Olympic Games—fundamentally change how cyber-physical risk must be identified and prioritized. Events such as these usually are designated as National Special Security Events (NSSEs), based on factors like national significance, projected attendance, and potential threat levels, with the U.S. Secret Service leading security operations.

Cyber-physical risk is the potential for cyberattacks on networked systems—such as IoT devices, industrial control systems, or medical equipment—to cause real-world damage, including physical injury, environmental catastrophes, or destruction of infrastructure. These risks occur at the intersection of digital, networked software and physical, mechanical processes. NSSEs increase the potential for attacks on such devices as credential readers, environmental control systems (heating, cooling, and water), and hospitals near the events.

Join us as thought leaders from government and industry discuss how organizations can prepare to support a major event by identifying, quantifying, and prioritizing cyber-physical risks pertaining to operational technologies (OT) deployed for the event.

Learning Objectives:

• Understand the distinct risks to OT in major event environments, especially when systems are temporary, shared across public and private owners, or rapidly deployed
• Identify which OT-related threats or vulnerabilities tend to have the most significant downstream or cascading impacts, and which are most often underestimated during planning
• Learn how to assess and model cyber-physical risk across interconnected systems, such as venues, transportation, and broadcast infrastructure
• Delineate what effective integration between cybersecurity, physical security, and operational stakeholders looks like in practice – and where it breaks down most often

In a time of rapid change spurred by AI, the federal conversation about cybersecurity is becoming less about individual technologies or modalities and more about operational effectiveness. Agencies have invested heavily in cybersecurity, yet many still struggle to answer critical questions quickly enough to reduce risk.

Meanwhile, security tools have multiplied faster than agencies’ ability to make coordinated trust decisions. The technology stack has evolved, but security decisions haven’t. Common frustrations include tools that don’t work together the way agencies’ missions do; more data available than ever but less confidence in making decisions; and security decisions that require too much manual coordination across disconnected systems.

Learning Objectives:

• Identify ways to make trust dynamic – responding in real time to real threats – rather than assume trust
• Outline methods to enable AI without creating security blind spots
• Review steps you can take to make faster, more confident security decisions for your agency, such as network segmentation/microsegmentation, using AI to control traffic flow to prevent data loss

After the hard work of assessing cyber-physical risks in advance of National Special Security Events (NSSEs) such as the Olympics or World Cup, the next step is discussing systemic vulnerabilities and planning for blind spots. Every major event runs on a complex, interconnected web of systems, yet the full chain of critical dependencies is rarely mapped and tested. 

This session explores complex “what if” scenarios that challenged common assumptions underlying security and resilience planning, with a particular focus on limited visibility into the operational technology (OT) environments connected to IT systems. 

Join us as thought leaders from government and industry share how they approach mapping dependencies, looking for unsuspected connections, and work to avoid making assumptions about roles and responsibilities. 

Learning Objectives:

• Outline the process for “gaming out” possible scenarios
• Establish methods for decision-making during moments of uncertainty or ambiguity
• Evaluate criteria for partnerships to strengthen responses
• Delineate best practices for developing effective incident response plans at a scale appropriate to the NSSE
  Identify where regulatory frameworks may conflict with operational needs

• How cyber incidents escalate into a kinetic attack, affecting the ability to respond to the critical incident

• What first responders need to manage the incident

• What preparations should be made in advance of a critical event

• When a cyber incident escalates into real-world public safety impacts, how CISA defines its operational role in the first 24–72 hours—coordinating with DHS components, FEMA, state and local emergency management, and private sector owners—while balancing the need for decisive federal coordination with respect for state authority and private ownership

• The importance of executing a coordinated recovery plan to rapidly restore safety and service to the event

AI success is often isolated, limited to pilot efforts that tackle one specific challenge or workflow. AI pilots are most focused on getting the technology right; implementing an enterprisewide AI strategy requires alignment across leadership, workforce, procurement, and mission teams, though definitions of success, ownership, and ROI remain unclear.

How agencies can move beyond the isolated success in a pilot and achieve similar results across their organizations is more a strategic challenge than a technical one. It requires shifting from a use case to capability, from technology experiment to an operational effort, by prioritizing scalable infrastructure, robust data governance, and change management.

Learning Objectives:

• Identify organizational and work culture barriers that need to be addressed
• Review your agency’s budget and procurement activities to ensure funding is available as scaling up takes place
• Delineate your agency’s automation and AI priorities to maximize both effectiveness and impact

Thought leaders from government and industry discuss how several innovative trends are combining to change the way agencies deliver services

Innovation Summit 2026 – AI Dominates the Landscape

ChatGPT was officially released by OpenAI on November 30, 2022, launched as a free public research preview. It quickly became one of the fastest-growing technology products in history and accelerated the release of competing generative AI platforms across the market.

Federal agencies are following directives such as the Office of Management and Budget’s “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust.” According to the Federal Agency Artificial Intelligence Use Case Inventory, 56 federal agencies reported AI use cases at all stages of development. It shows that the number of submitted use cases rose from 1,757 in 2024 to 3,611 in 2025 – of which 1,818 have been deployed or piloted.

Learning Objectives:

• Scale AI from pilot programs to enterprise adoption
• Build governance, security, and Zero Trust frameworks for AI
• Strengthen workforce readiness, change management, and mission measurement
• Modernize data, infrastructure, and legacy environments for AI workloads
• Improve resilience across hybrid, multi-cloud, edge, and distributed operations
• Address emerging AI threats, security risks, and operational challenges