This piece is authored by Aron Hubbard, ICF’s Senior Director, Cyber Operations, and Kyle Tuberson, ICF’s CTO.
Artificial intelligence is changing the economics of cyberattacks. Threat actors no longer need years of specialized experience to understand complex systems, identify weaknesses and move quickly. AI can help them analyze technical documentation, automate portions of an attack and scale familiar tactics across more targets.
That does not mean every threat is new. In many cases, AI simply makes known vulnerabilities easier to find and faster to exploit. For federal civilian, defense and critical infrastructure organizations, the question is how to modernize at the speed the mission demands without introducing unnecessary risk.
The answer is not to slow modernization. It is to make security and resilience foundational to it.
Critical infrastructure environments have always presented unique challenges. Many assets are geographically dispersed, requiring remote management tools and external services to monitor and maintain them. Those connections improve efficiency and visibility. They can also create pathways into systems that organizations believe are isolated.
That distinction matters. An “air-gapped” network is only as isolated as its actual operating environment. Management tools, remote access, vendor connections and undocumented dependencies can bridge otherwise separate systems. Architecture diagrams show how an environment was designed. They do not always reflect how it operates today.
Agencies therefore need to continually validate network separation through testing and monitoring rather than rely on assumptions established when systems were deployed. They should identify every authorized and unauthorized connection across operational technology, management systems, enterprise networks and external services—then remove unnecessary exposure and secure the access that remains.
The same principle applies more broadly to modernization. Security cannot be a layer added after cloud platforms, applications, data environments or operational technologies are deployed. It must be built into the architecture from the beginning through Zero Trust principles, DevSecOps, automated controls and continuous monitoring.
AI adoption also requires governance proportionate to risk. Agencies should begin with practical, lower-risk applications and expand as they gain confidence. Access to sensitive data and mission-critical systems should be tightly controlled, with clear accountability, traceability and human oversight. The objective is not to prevent AI use. It is to create the trusted environment needed to use AI responsibly and scale what works.
Finally, agencies must plan for disruption. Even strong defenses cannot eliminate every risk. Protected backups, regularly tested recovery procedures and alternate operating environments help ensure mission-essential functions can continue during an attack. Resilience is not simply the ability to restore a network. It is the ability to sustain the mission when technology is degraded or unavailable.
AI is accelerating the speed and scale of cyber threats, but agencies are not powerless. By modernizing securely by design, auditing connectivity, governing AI according to risk, validating isolation and preparing for recovery, they can adopt advanced technology with greater confidence.
The goal is not just to protect systems. It is to preserve operational performance, mission continuity and public trust, no matter how the threat landscape evolves.
Throughout October, in recognition of Cybersecurity Awareness Month, WashingtonExec will feature op-eds from GovCon cybersecurity experts exploring emerging threats, evolving technologies, challenges shaping the field and practical strategies for strengthening cyber defenses.