Kenyon Wells is a senior vice president and strategic lead for cybersecurity and critical infrastructure protection within CGI Federal, where he manages a diverse group of technical, organizational and business process experts.
For years, cybersecurity experts warned that artificial intelligence would change the nature of risk, for both attackers and defense. That future has arrived and AI-powered cyber-attacks are here. Robust technology is enabling adversaries to move fast—often faster than their targets can respond.
AI can create better disguised phishing bait, such as faked audio and video. It can also test network defenses and find vulnerabilities with lightning speed and adapt to environments in near real-time. One of many examples of this new threat landscape happened in July 2026, when models OpenAI was testing escaped their sandbox environment and breached a company called Hugging Face. The agents used a malicious dataset to run code in Hugging Face’s data systems and reached a production environment and as a result, some internal data and service credentials were exposed. Hugging Face said it found no sign that public models or datasets were changed, but the incident showed something important: automated systems can chain one weakness into another faster than older defense plans assumed. This was a real platform incident with a public timeline, not a thought experiment.
Another example happened in early 2024 when engineering firm Arup confirmed that scammers used AI deepfake video and audio to impersonate company executives during a fraudulent conference call and tricked staffers into sending about HK$200 million (roughly US$25million) from its Hong Kong office.
In this case, there was no network breach or defense penetration. AI aided the criminals by helping them trick people. For federal agencies whose work involves moving money, benefits or credentials, that kind of attack is just as potentially consequential.
Counting losses
The FBI’s Internet Crime Complaint Center reported $20.9 billion in losses for 2025 — up 26% from 2024 — on more than a million complaints.
AI has transformed ransomware from an experimental risk into a precise, highly automated operational threat. Advancements in generative AI and autonomous agents have collapsed traditional multi-week attack timelines into hours or minutes, driving a 275% year-over-year surge in ransomware data exfiltration.
Ransomware complaints rose from 2,825 in 2023 to 3,156 in 2024 to 3,611 in 2025. Critical manufacturing, healthcare and government were among the hardest-hit sectors. Microsoft reported that attacks aimed at user identities rose 32% in the first half of 2025. IBM put the average cost of a U.S. data breach at $10.22 million in 2025, up 9% from the year before.
Money isn’t the only measure of the damage attackers can do. A 2026 study of U.S. hospital ransomware attacks found that during the attack, patient volume fell sharply — and among people already admitted when the attack started, in-hospital deaths rose by roughly a third.
AI-aided attackers are also stealing encrypted data now so they can try to read it later when quantum computing matures — a risk the White House flagged in June 2026 when it told agencies to move high-value systems to post-quantum encryption. I write this from an insider’s perspective. CGI Federal supports more than 100 agencies and more than 570,000 government systems, including the Cybersecurity and Infrastructure Security Agency (CISA)’s Continuous Diagnostics and Mitigation (CDM) DEFEND program for more than 75 agencies.
Mounting a defense before it’s too late
Defenders are not empty-handed. The same kinds of AI tools attackers use are available to government agencies and to the companies that support them. AI is already helping those entities spot threats, prioritize alerts and respond to attacks.
Too many organizations, however, have not put those tools to work. Waiting for the perfect tool or the perfect plan is a luxury the timeline no longer allows. For those who need a jump start, there are three tracks to take simultaneously. That last word is the key: Do these things concurrently, not one after another.
One: Turn up the heat on the basics. You need the strongest access controls, network architecture, patch management and data security, and you need it yesterday.
This applies across the board. Civilian agencies aren’t immune. Military and intelligence organizations are obvious targets, but civilian federal systems also hold data and services attackers want. If multi-factor login is optional, if people have more network and data access than they need for their roles, or if no one really knows what connects to what, your organization is more vulnerable than it needs to be. AI just helps the attacker move faster to exploit that vulnerability. Double down on the fundamentals — and where the risk is highest, triple down — before chasing the new shiny thing.
Two: Get more from what you already have and fill talent gaps fast. Maximize the tools, people and know-how you have today. Close the gap between what the policy says and what people actually do. Ruthlessly remove unneeded access, speed up incident detection and practice how to isolate systems under attack. Fix weaknesses in software before it ships.
Many organizations need stronger security policies, but even more of them need more stringent enforcement of the policies they have in place. If you do not have the capacity in-house, do not wait until you do. Use managed services available today — from government or from industry — to fill the gaps. The CDM program is one clear path agencies can use now.
Three: Future-proof through AI and security alignment. Some organizations will move quickly to adopt AI, others more slowly, but almost all will eventually embrace it. Security leaders must be in that conversation from the start, providing guidance on how systems are designed, who and what can access data and how automated tools are allowed to act, so that security is built in from the start. Security cannot be the office that only says no. If it is, the mission will go around it, and the gaps will become openings for attackers.
Looking ahead, AI-powered cyberattacks will test not only technical flaws but also fuzzy rules: different definitions across agencies, loose agreements between partners and weak identity chains that stretch across federal, state, local and industry networks all provide entry points for attacks. The answer is to work with those partners to tighten the rules and the controls — find the gaps that become footholds and close them before an automated attacker does.
AI is not going away. For agencies to keep doing their jobs, the question is not whether defenses will catch up someday. It is whether leaders will treat today’s losses as real, use the defenses already on hand, and keep security in the room while AI is built into the next generation of government systems.
That is the work we do every day at CGI Federal: helping agencies close the gap between written policy and real defense, at the speed the threat already demands.
Throughout October, in recognition of Cybersecurity Awareness Month, WashingtonExec will feature op-eds from GovCon cybersecurity experts exploring emerging threats, evolving technologies, challenges shaping the field and practical strategies for strengthening cyber defenses.