As federal cyber leaders gather for the 17th Annual Billington CyberSecurity Summit, the event’s theme – “Reducing Risk in An Age of AI-Enabled Threats,” – captures the reality agencies face today. Faster-moving adversaries, AI-enabled attacks, critical infrastructure risk, and growing dependence on interconnected technologies and suppliers are raising the stakes for cyber professionals working to protect systems and sustain operations.
New research from MeriTalk and Billington CyberSecurity, underwritten by General Dynamics Information Technology (GDIT) and Horizon3.ai, uncovers a widening gap between agencies’ understanding of cyber risks and their abilities to act on them at speed.
Eighty-three percent say organizations understand their cyber risks better than they can execute against them, and just 21% say they are reducing risk faster than new threats are evolving.
Zero trust advances, but enterprise-wide adoption remains limited
Federal agencies recognize zero trust as a priority, but implementation still has significant room to grow. Only 23% of respondents say zero trust is operational across the enterprise. As agencies work to expand adoption, 80% say they need modular solution options to protect their assets and accelerate their progress.
“As threats accelerate, extending zero trust principles across AI and operational technology environments is essential to advancing agencies’ progress and addressing the challenges still ahead,” said John Sahlin, vice president of cyber solutions at GDIT. “Building modular zero trust capabilities around existing investments helps bridge that gap, delivering advanced cyber capabilities today.”
AI urgency is outpacing execution
The push to advance zero trust comes as agencies confront a rapidly evolving cyber landscape, with AI adding new pressure to keep pace. Ninety percent of respondents said cyber attackers are adopting AI faster than defenders. While 48% said their defenses are keeping pace with the threat environment, another 31% said they are losing ground, operating reactively, or are unsure.
The findings suggest that progress is falling short in areas that respondents consider critical to cybersecurity. The difference is most pronounced for AI-enabled threats and defense, where reported progress trails perceived importance by 32 percentage points. A similar challenge exists in critical infrastructure and operational technology security, where progress trails perceived importance by 19 percentage points.
As agencies look to AI to help strengthen their cyber operations, threat detection and behavioral analytics topped the list of priorities at 51%. Incident investigation and automated response followed at 47%, alongside vulnerability management and prioritization at 47%.
“As adversaries increasingly operate at machine speed, periodic assessments are no longer enough,” said Corey Brunkow, director of federal operations, at Horizon3.ai. “Leaders need to continuously test their environments from an attacker’s perspective, identify and prioritize the attack paths that pose the greatest mission risk, remediate them, and verify that those fixes actually worked. Compressing the hack-fix-verify cycle will be critical to staying ahead of AI-enabled threats.”
Cyber barriers facing government today
Supply chain dependencies add another layer of risk. Ninety-four percent of respondents said supply chain interdependencies are turning individual vendor weaknesses into systemic risk, yet only 24% reported meaningful progress in addressing software supply chain risk over the past year.
Not all challenges were entirely technological. When asked about barriers to stronger cyber resilience, 51% cited competing investment priorities or budget constraints, followed by legacy infrastructure and technical debt at 48% and shortages of specialized cybersecurity skills at 45%.
In a separate question focused on critical infrastructure, 90% said unclear ownership across IT, cybersecurity, and operations is a major barrier to securing those environments.
Against those constraints, respondents ranked greater automation of repetitive work as the No. 1 opportunity to strengthen cyber operations and give cyber teams more capacity.
Recommendations for cyber resilience
To strengthen resilience, the report recommends that agencies design for disruption by identifying mission-critical dependencies, establishing alternatives, and testing their ability to maintain operations through supplier, identity, cloud, or infrastructure disruptions.
Agencies are also encouraged to prioritize AI where speed and scale can improve cyber outcomes while keeping humans involved in high-consequence decisions.
For zero trust, agencies should move toward funded, scalable implementation across hybrid environments. That includes strengthening identity and continuous verification while integrating modular capabilities into existing technology stacks rather than opting for wholesale replacement.
Finally, the report calls on cyber leaders to “clarify ownership across IT, cybersecurity, operations, mission teams, and external partners, then reinforce those roles through shared escalation paths, rapid threat-information exchange, and joint response exercises.”
The “Reducing Risk, Increasing Resilience: Cybersecurity in the Age of AI-Enabled Threats” report is based on a survey of 100 federal cybersecurity professionals in July and August 2026.
To access the full report, visit: https://www.meritalk.com/study/cybersecurity-in-the-age-of-ai-enabled-threats/