For years, Department of Commerce Chief Information Security Officer and Deputy CIO Ryan Higgins has organized teams around three pillars: increasing visibility and insight, filling gaps, and reducing risk.
While the technology, threats, and demands surrounding that framework continue to change, Higgins sees value in keeping the direction steady.
“There’s far too much work to be done to be meandering and wavering about,” Higgins told MeriTalk. “Everything we do is rooted in those pillars.”
That discipline is shaping how Higgins thinks about fiscal year 2027 (FY27) as federal cyber leaders contend with funding and workforce uncertainty, increasingly sophisticated threats, and a technology environment in transition due largely to super intelligence (SI).
Navigating that environment requires federal technology leaders to think beyond the technology itself, he observed.
“What’s unique about fed tech leadership today is the need to evolve one’s thinking beyond leading technology – to leading people to drive organizational outcomes,” he said.
That shift is especially important as technologies such as agentic SI increasingly blur the distinction between people and technology, Higgins said. Leaders first need to understand the problem they are trying to solve, how the technology they’re using works, and what people and processes are required to use it effectively.
Setting the foundation
Higgins’ three pillars give his team a framework for deciding where to focus and how individual efforts fit into Commerce’s broader cybersecurity mission.
The first pillar – increasing visibility and insight – includes consolidating cybersecurity services and capabilities where it makes sense. Common services and tools can give Commerce greater visibility across the enterprise while still maintaining clear lines of responsibility.
The second pillar, filling gaps, often involves something less technical.
“We found gaps in people’s perception versus reality hinder progress more than anything technical,” Higgins said.
Closing those gaps requires attention to organizational culture and trusted partnerships, he explained. Those relationships, in turn, support his third pillar: reducing risk.
“When you have common services and solutions combined with trusted partnerships, then you can have frank and honest conversations about risk,” Higgins said. “That, in my view, is essential to driving true risk reduction.”
Navigating through uncertainty
Heading into FY27, Higgins pointed to questions around labor funding and resources for deploying and maintaining enterprise cybersecurity capabilities as challenges that could affect Commerce’s plans.
At the same time, increased threat activity is putting pressure on the department not only to maintain existing defenses, but also to accelerate efforts that support the mission.
Maintaining the right mix of skilled federal employees and contractors will be part of that equation. Technology can increase speed and scale, Higgins said, but experienced professionals are still needed to interpret information, make risk-based decisions, and determine the appropriate response.
Higgins said greater flexibility in acquiring, deploying, and sustaining enterprise cybersecurity capabilities could help agencies respond more effectively.
“Cyber threats evolve at machine speed, while government acquisition, funding, and approval processes often operate on much longer timelines,” he said.
More direct and flexible resources for enterprise cybersecurity programs could give agencies greater agility in sustaining mission-critical defenses as threats change, Higgins said.
Augmenting the analysts
When it comes to SI, Higgins is focusing on workflows and use cases that can help cybersecurity professionals perform their jobs more effectively.
The emphasis, he said, should be on augmenting analysts rather than replacing them. That could mean helping correlate large volumes of data and telemetry, accelerating threat hunting and investigations, summarizing incidents, identifying patterns, and reducing time spent on repetitive analytical tasks.
Higgins also said agencies can do more to educate their customers and workforce and “demystify SI,” including through greater transparency about what the technology can accomplish when used responsibly and the risks that come with irresponsible use.
The objective is to create an environment in which the workforce understands the technology well enough to use it effectively.
“Engagement is key,” he said.
Giving the team room to act
For Higgins, preparing for FY27 starts with making sure his team knows where it is going – and has what it needs to get there.
His first responsibility, he said, is providing employees with a clear vision, along with the funding, personnel, and other resources needed to carry it out.
Just as important is giving them his “unwavering support” to act quickly and removing barriers that could stand in the way of their success.
That means continuing to improve Commerce’s ability to see, understand, and respond to threats across the enterprise.
“Threat actors don’t operate according to organizational boundaries,” Higgins said.
Agency defensive capabilities, telemetry, and response processes therefore cannot operate as isolated efforts inside individual organizational units, he said. They need to function with an enterprise mindset.
That enterprise approach also depends on relationships outside the cybersecurity organization.
“Cybersecurity works when the mission program offices understand we’re their partners protecting their mission data and systems,” Higgins said.
Without that partnership – and a shared understanding of both the benefits and risks of emerging technologies – agencies leave themselves more vulnerable to threat actors, he said.
Looking beyond technology
Amid the attention surrounding new cyber and AI capabilities, Higgins sees a fundamental lesson for technology leaders.
“Technology alone will not save us,” he said.
Cybersecurity depends on people, processes, and technology, Higgins said, but also on leadership and organizational culture.
“Buying another tool does not automatically reduce risk,” he said. What matters is how well an organization deploys and integrates that technology, operates it, and acts on the information it provides.
That helps explain why organizational culture repeatedly surfaces in Higgins’ cyber strategy.
His formula for strengthening it is straightforward: transparency, openness, engagement, and frequent communication. That applies whether cyber leaders are working with customers, stakeholders, or their own employees.
Leaders also need to be forthright about what their organizations can and cannot do, he said.
The approach connects directly back to Higgins’ three pillars. Better communication can close gaps between perception and reality. Trusted partnerships allow more candid conversations about risk. Shared services and enterprise visibility give organizations better information on which to act.
Together, Higgins said, those pieces can make cybersecurity an enterprise capability supporting the mission rather than a collection of disconnected technology efforts.
“Cybersecurity must be approached as an enterprise-wide mission enabler rather than a collection of individual technology initiatives,” he said.
The opportunity is to connect “our people, telemetry, capabilities, and decision-making” so agencies can identify risks early and respond accordingly.
“Organizations that do this,” he said, “start off in a better position for whatever FY27 brings.”