Page 202 - Cyber Defense eMagazine RSAC Special Edition 2025

AI Cyber Risk – and Responsibility – Are Mounting

Federal Chief AI Officers (CAIOs) overwhelmingly agree on the transformative potential of AI – 85% say
it will transform agency operations by 2030. But cybersecurity and risk management have become central
to the AI conversation: 57% of CAIOs rank implementing security, privacy, and risk management as a
top-three priority for 2025.

Additionally, just 29% of CAIOs say they currently have the authority needed to advocate for meaningful
change. And 66% report their agency lacks the infrastructure, talent, and funding to meet AI goals.

These shortfalls can significantly impact cyber posture. Unsecured models, unvetted tools, and
fragmented governance all increase the surface area for attack. With more AI tools in play, the risk isn’t
abstract – it’s operational.

Growing Governance Alongside Execution

CAIOs report strong internal backing for AI governance and compliance – currently their most supported
initiative area. But support drops off sharply for more strategic needs. Scaling infrastructure and
computing, expanding AI talent, and strengthening interagency collaboration all rank as some of the
lowest on the leadership support scale – even though they’re critical for secure implementation.

The takeaway is clear: governance isn’t just red tape – it’s the roadmap. But without infrastructure and
talent to execute, that roadmap leads nowhere.

Security Starts with Authority

The report highlights a leadership paradox: while 88% of CAIOs hold multiple titles, 100% say the CAIO
role should be full-time and stand-alone. Lack of structural authority is slowing progress – and
cybersecurity is caught in the fallout.

Agencies operating in compliance-first mode may appear risk-aware, but there are blind spots – pilot
tools that aren’t hardened, AI services without defined ownership, and models that operate outside
enterprise visibility. As AI use grows, so does the risk of unmanaged endpoints and shadow AI.

Scaling AI Without Breaking Trust

Agencies that have started scaling AI are seeing results. But these scaling efforts should include
foundational cybersecurity planning, from the onset – and as use cases increase in complexity.

Integration with legacy systems remains a major challenge, with 50% of CAIOs citing it as a top barrier.
That’s a critical inflection point: every legacy interface added to an AI implementation increases the
likelihood of vulnerability. And as data quality and accessibility issues persist – identified by 67% of CAIOs
– AI tools may be built on shaky ground, further compounding cybersecurity concerns.

202