Frontier AI Models: The Future of Cybersecurity and Prospects for Government Information Technology

One theme appeared throughout the discussion: speed.

AI can find vulnerabilities faster, process larger volumes of information, support continuous testing of systems rather than periodic reviews, and eventually help organizations patch vulnerabilities more quickly as well. At the same time, these capabilities can increase the speed of attacks. A vulnerability that once seemed difficult to exploit may become more dangerous when an AI system can instantly connect it with other weaknesses. Organizations may therefore face more vulnerabilities and have less time to decide which ones need immediate attention.

This creates a fundamental tension for government. Technology can change very quickly, while public organizations operate through laws, budgets, responsibilities, approval processes, and existing infrastructure that cannot always change at the same speed. Spear illustrated this problem through election security. Election systems operate within strict rules, certification requirements and fixed election schedules. Some systems have also been in use for many years. Even when new technology makes a weakness easier to identify, election administrators cannot simply change critical systems immediately.

The lesson is not that government should try to make every decision as quickly as an AI system. Government has good reasons for testing, oversight, accountability, and careful decision making. The challenge is to build institutions that can respond to rapid technological change without giving up these public responsibilities.

This leads to a second and deeper issue: governance.

Pardo suggested that “the biggest cybersecurity challenge of the AI era” may not be protecting government from AI, but “governing a government that increasingly relies on AI.” When AI systems can analyze information, recommend decisions, or take actions with less direct human involvement, cybersecurity is no longer only about keeping an outside attacker away from government systems. Public organizations also need to decide how their own AI-enabled systems should behave.

What information should an AI agent be allowed to access? What actions can it take on its own? Who is responsible when it acts? How much authority should cybersecurity leaders have? How should these responsibilities be established across agencies and levels of government? These are not only technical questions. They are questions about authority, responsibility, law, management, and risk. This also helps explain why AI governance cannot be separated from cybersecurity. A technically powerful security tool is not enough if an organization has not decided who can use it, what it can do, and what level of risk is acceptable.

A third insight from the discussion concerns resilience.

Cybersecurity often focuses on preventing attacks and fixing vulnerabilities. These activities remain essential. But an environment shaped by AI may make it increasingly difficult to assume that every disruption can be prevented. For government, this matters because a cyber incident is not only an information technology problem. Government information systems support elections, emergency services, public health, water systems, benefits and many other services people depend on. Pardo therefore emphasized resilience, including the ability to anticipate disruption, withstand it, recover from it, and adapt afterward.

This changes the question from only “How do we prevent an attack?” to also asking “Can government continue to perform its mission when something goes wrong?” That shift has practical consequences. Governments need strong defenses, but they also need recovery plans, clear responsibilities, reliable backups, coordination mechanisms, and the ability to learn from incidents. In an environment where technology and threats continue to change, resilience becomes part of cybersecurity rather than simply a response after cybersecurity fails.

The panel also raised an important question about where cybersecurity capacity comes from. Government organizations have very different resources. A large state agency may have specialized cybersecurity staff and access to advanced technology. A small local government may have only a few employees and depend heavily on outside vendors.

Expecting every organization to build the same AI and cybersecurity capabilities is therefore unrealistic.

The discussion pointed toward a broader model of capacity. States can support local governments. Larger governments can share expertise. Professional associations can connect practitioners and spread knowledge. Universities and organizations such as CTG can help translate research into practice. Vendors also play an important role because many governments depend on systems they do not build themselves. This leads to another insight: in an AI-enabled environment, cybersecurity capacity may increasingly be a property of networks, not only individual organizations.

Pardo captured an important part of this challenge by asking, “Who is the we?” When we say that “we” need to prepare for AI-related cyber risks, that group may include state agencies, local governments, federal partners, critical infrastructure providers, vendors, researchers and professional communities. Effective governance requires not only identifying these actors, but also deciding how they share responsibilities, information, resources and risk.

Lessons for Government Capacity in the AI Era

The panel discussion suggests that the deeper challenge created by AI is not simply a new generation of cyber threats. It is a challenge of adaptive government capacity. Readiness may therefore be less about reaching a fixed level of technological expertise and more about building institutions that can continue to learn, coordinate and adapt as technology changes.

The discussion about workforce development and organizational learning reinforced this point. Goel emphasized the need to give employees time to learn new technologies, while Pardo and Spear discussed learning as part of organizational practice and professional networks. In a rapidly changing environment, government capacity depends not only on existing expertise, but also on the ability to continuously develop, apply, and share new knowledge.

A related challenge is translating that knowledge into administrative action. Technical experts may understand how AI is changing cybersecurity, but public leaders still need to turn that knowledge into decisions about authority, staffing, training, resources, risk and service delivery. Broad principles can provide direction, but public managers also need practical guidance about what to do next. From this perspective, preparing government for AI is not only about adopting new technology. It is about developing the institutional capacity to continuously learn, adapt and translate technological change into responsible public action.

Looking Ahead: What Should Governments Consider Next?

AI is accelerating the pace of technological change. However, public institutions cannot respond to that change through speed alone. At the same time, they must build the capacity to manage risk and adapt while maintaining accountability, continuity of public services, and public value. The central challenge, therefore, is to preserve these responsibilities while strengthening the ability to respond, learn, and adapt more quickly.

As a result, an important question remains: As AI systems become faster and more autonomous, how can governments build institutions that are not only secure and resilient today, but also capable of continuously learning, adapting, and serving the public tomorrow? This timely discussion highlights the urgency of addressing that question as governments navigate the next phase of AI-enabled transformation.