Outdated compliance processes are continuing to slow the deployment of advanced artificial intelligence (AI)-powered cyber defenses across the federal government, a senior Office of Management and Budget (OMB) official said Tuesday.
Speaking at the Digital Government Institute’s 930gov conference in Washington, D.C., Nick Polk, branch director for federal cybersecurity at OMB, said reducing compliance burdens remains a top priority as agencies work to operationalize AI-powered cyber defenses.
“We are continuing to work on removing the compliance burden that’s stopping agencies from getting advanced capabilities in the time they need it – they’re needed at the speed of relevance,” Polk said.
He added that OMB is working with agency chief information officers “to root out all those compliance bottlenecks.”
The urgency is growing, according to Todd Hemmen, deputy assistant director of the FBI Cyber Division’s Cyber Capabilities Branch, who warned that AI is dramatically accelerating cyber intrusions.
Hemmen cited data from Palo Alto Networks showing that the fastest cyber intrusions have compressed from days to minutes between initial access and data exfiltration.
“We are in a space today where if we are not implementing AI defense, we are well behind the curve,” Hemmen said.
Additionally, Polk said agencies must continue improving their understanding of their full attack surface, including third-party services and shadow IT systems that may process federal data outside traditional enterprise environments.
“The biggest thing … [is] really, truly understanding their network attack surface,” Polk said, adding that many agencies still are working to ensure every component, endpoint, and third-party service is properly accounted for.
The two officials also discussed emerging AI-related security risks, including the growing ability of frontier AI models to discover software vulnerabilities.
Hemmen pointed to Anthropic’s Mythos model as an example, which can identify vulnerabilities across major operating systems, browsers, and widely used open-source software.
“It presents future challenges for law enforcement,” Hemmen said of Mythos, warning that as those capabilities become available to “our cyber adversaries, cyber criminals, and nation-state actors,” the FBI expects to see more attempts to exploit AI-discovered vulnerabilities.
“We haven’t seen this kind of operationalized at scale,” he said. “I think the expectation is that there is a future date where that is coming.”