Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Federal agencies are moving artificial intelligence beyond experiments and into operational cyber defense, according to Michael Duffy, the acting federal chief information security officer. The work includes using AI to find vulnerabilities at scale, reviewing cyber-focused AI applications, streamlining security tools and strengthening readiness for AI-related incidents.

What federal agencies are doing with AI for cybersecurity

Speaking at FedTalks in Washington, D.C., Duffy described agencies as increasingly bringing AI into production across government missions. His account points to several strands of work, rather than one government-wide AI defense system.

Finding vulnerabilities at scale

One objective is “leveraging AI to identify vulnerabilities at scale.” Applied to vulnerability management, that means using AI capabilities to help surface weaknesses across large environments; Duffy did not specify particular tools, agencies, or measured results.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Assessing cyber-focused AI applications

Duffy said officials will assess agencies’ existing cyber defense capabilities and explore “cyber-centric AI use cases.” The emphasis is on evaluating where AI can contribute to cyber defense, not on a named application or a stated deployment schedule.

#1 Best Overall
Fortinet FortiGate 60F Hardware, 36 Month Unified Threat Protection (UTP), Firewall Security
  • HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 3 year of FortiCare Premium and FortiGuard Unified Threat Protection.
  • UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
  • OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
  • RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
  • EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.

Rationalizing security tools and using shared services

Agencies are working with their CISOs to review cybersecurity tool stacks, identify redundant or ineffective systems, and consider enterprise-wide capabilities and shared services. The stated aim is to improve agencies’ posture for an evolving threat environment while gaining efficiencies and scale. The remarks do not identify which tools will be consolidated or establish that agencies have completed such changes.

Building resilience and incident-response capacity

Duffy also said agencies are working to increase operational resilience and their collective capacity to respond to AI incidents. That describes a preparedness goal; his remarks did not provide an incident-response framework, timetable, or readiness metric.

Rank #2
Trade up to WatchGuard Firebox M290 with 3-yr Total Security Suite
  • Enterprise-grade prevention, detection, correlation and response from the perimeter to the endpoint with our Total Security Suite.
  • Gain critical insights about network security, from anywhere and at any time, with WatchGuard Cloud.
  • Built-in compliance reports, including PCI and HIPAA, mean one-click access to the data you need to ensure compliance requirements are met.
  • Up to 18 Gbps firewall throughput. Turn on all additional security services and still see up to 2.4 Gbps throughput.

Is federal AI cyber defense already in production?

Yes, according to Duffy: he said the government is not only putting AI into production but finding ways to accelerate emerging technology across missions. That is a broad statement about federal adoption, not evidence that every agency has deployed AI for cyber defense or that every use case listed is already operational. The report does not name specific deployments or quantify their maturity.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Duffy attributed this readiness to advances made in federal government over the preceding decade, saying agencies were positioned to take advantage of new capabilities and make them serve their missions. His comments describe the direction of travel, not a formal inventory of agency systems.

Rank #3
Sale
Deeper Connect Mini DPN Router, 1Gbps ARM64 Quad Core Hardware Gateway with Layer 7 Firewall, Smart Routing, Multi Device Coverage and Lifetime Decentralized Privacy VPN Router
  • Entry-Level Privacy Gateway: Designed for users who want simple online privacy protection at an affordable level—ideal for basic home networking and daily internet use.
  • Secure Browsing for Everyday Needs: Perfect for email, social media, online shopping, and standard streaming—protecting your connection while keeping setup and operation easy.
  • Lightweight Protection Against Common Online Threats: Helps reduce exposure to unwanted ads, trackers, and risky websites, improving online safety for your household.
  • Simple Setup, No Technical Skills Required: Plug it in, follow the quick steps, and start using—an excellent choice for beginners who don’t want complicated network configurations.
  • Decentralized VPN (DPN) Included – No Monthly Payments: Get built-in decentralized VPN access with lifetime free usage, helping you stay private without paying recurring subscription fees

What safeguards are part of the approach?

Duffy said adoption should protect sensitive information, support secure public interactions, and include safeguards to ensure AI is used properly. These are the principles he identified; the report does not detail specific technical controls, approval processes, or agency-level implementation requirements.

The policy context includes reconsideration of OMB Circular A-130, the federal policy on managing information resources. CyberScoop reported that the circular was last updated in 2016 and that executive-order direction calls for an update within three years. The report does not identify a completed revision or give a new publication date.

Rank #4
FortiGate-30G Network Security Appliance Plus 3 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-30G-BDL-950-36)
  • Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
  • Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
  • User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
  • Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
  • Including award-winning FortiGate hardware and 3-year FortiGuard AI-powered UTP security services. Services cover IPS, Advanced Malware Protection, Application Control, URL, DNS & Video Filtering, Antispam Service, and FortiCare Premium customer support.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What the announcement does—and does not—establish

  • Established: The acting federal CISO said agencies are moving AI into production and described priorities spanning vulnerability discovery, cyber-focused use cases, tool rationalization, shared services, resilience, and AI-incident response.
  • Not established: Which agencies or products are involved, how many deployments are operational, what performance gains have been measured, or what detailed safeguards apply to each implementation.

The remarks were reported by CyberScoop senior reporter Tim Starks on September 18, 2025, from Duffy’s appearance at FedTalks in Washington, D.C. Read the CyberScoop report.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.