Cyber attacks using artificial intelligence increased by 89 percent in 2025 as compared to 2024. And this year the use of AI in cyber attacks is only increasing.
That’s why the Federal Chief Information Security Officer’s Council is bringing agencies together in early November to prepare for an ever-challenging cyber threat environment.
Mike Duffy, the federal CISO, said the Federal CISO Council will host a governmentwide cyber tabletop exercise in the early November, specifically focused on AI-enabled cyber attacks.
“We are preparing for the second all full government CISO level tabletop exercise. We had the first one last year to exercise what it means for not only individual agencies to exercise their incident response playbook, but what does it mean for all agencies?” Duffy said at ACT-IAC’s Cybersecurity Summit on Oct. 14. “All the CISOs at the CISO Council come together with their security operations center directors to have a conversation about how the government, how the enterprise, the federal enterprise, ensures that we have the capabilities, the processes and the people we need to respond to anything that comes our way.”
Duffy said the first governmentwide exercise focused more on general cybersecurity readiness and resilience. But with the rise of AI-fueled attacks, he said the need to address how to withstand and even get ahead of these threats is clear.
CrowdStrike says in its 2026 report hackers using AI-accelerated phishing and automated reconnaissance are shortening the time from initial access to impact. The company says AI attacks elevated less sophisticated threat actors and amplified the most advanced ones.
Cyber and AI remain key focus areas for the Trump administration, both in terms of defending against AI-enabled attacks as well as using these capabilities to defend networks and data.
Duffy said in March he convened an event at the White House where he brought together industry and agency cyber experts to discuss what is currently available for cyber defensive operations. He said the discussion focused on what agencies today can bring into their cyber tool stack to make sure they are optimizing their defenses.
Two new working groups
More recently, the CISO Council breathed new life into their AI working group focused on security governance with two focus areas.
“One is to think about decision making with [artificial] intelligence in the future, but it’s also to make sure that we have the requisite framework to govern these systems to understand how the workforce and the capabilities can mesh, so that we are rapidly making better decisions today, so that we can slowly move and migrate to the concepts of machine to machine in the future,” he said. “Someone mentioned human in the loop, governance in the loop. How do we make sure that we’re building frameworks that we can repeat and standardize so the government is confident in the decisions being made with technology, not just hoping the technology makes the right decisions? We are in this driver’s seat. We want to make sure that risk is being calculated in a way that makes sense to the mission, and CISOs are empowered by this leap forward in technology and not just playing catch up.”
Duffy added that the working group is helping CISOs “cut through the noise” when it comes to AI and cybersecurity. He said he wants to help agency CISOs make decisions more quickly and manage risks both around cybersecurity and IT modernization, which includes the integration of AI tools to mission areas.
In addition to AI, the CISO Council recently initiated a post-quantum cryptography (PQC) working group.
“This is going to be a really critical multi-year effort where those on the front lines of the workforce, the migration will be absolutely critical. There aren’t enough people in government who are expert in migrating to post quantum cryptography. We have great team members over at the National Institutes of Standards and Technology, the Cybersecurity and Infrastructure Security Agency and other parts of government determining what is next along our path,” Duffy said. “I think agencies have made terrific progress just in the past year, convening and sharing information and building up their programs. Frankly, having industry at the forefront of this has been incredibly important as well. If there’s any way that an industry partner can scale a solution to move towards PQC today, it helps the entire community.”
Duffy added the PQC working group just kicked off in the last month and it will bring agency leaders together in a more focused way to prepare for post-quantum computing.
Reprioritization is driving cyber
Along with this upcoming exercise and the new working groups, Duffy said he has several other near term priorities.
A lot of his efforts over the last two years have been around turning strategy into action. The Trump administration released the national cyber strategy in March and several initiatives came from that document.
Duffy said OMB’s focus has been to build up the policies, procedures and capabilities necessary to defend against cyber attacks today and in the future. He said one change is around the cyber logging architecture policy.
“We heard from agencies for the past several years, this requires a lot of resourcing. This requires a different level of architecture. How can we make sure that we’re prioritizing and focusing on the right things?” he said. “We are prioritizing for the right security outcomes today, so that we can free up resources on what’s to come. That’s one area that we took the strategy and transitioned that into action.”
Duffy said CISA took a similar approach with the known exploited vulnerabilities (KEV) catalog. He said that took an understanding that agencies can’t fix every vulnerability just because it has some risk score. The change was to have agencies prioritize the KEVs based on several factors, including what likely will be exploited, what the worst challenge an organization is experiencing is and what will impact the mission negatively.
Duffy said this reprioritization approach has been playing out over the last few months as agencies meet the binding operational directive (BOD) to secure and modernize end point devices.
“Right now [we are] running a sprint within the CISO Council to say how far can we go with existing resources before the end of the fiscal year? Can we close out this gap that we currently have? Let’s take as many of these outdated edge devices and bad infrastructure out of the federal government and modernize immediately,” he said. “We’ve seen some really good uptake within agencies of being able to accelerate their progress right now within their current resourcing, and that’s great to see because it means we are truly reducing that risk. We’re reducing this exposure that we’re experiencing.”
Duffy added the long term goal isn’t just to fix something and forgetting about it, but to sustain these efforts so agencies are continually looking and relooking at their mission areas and deciding what systems or infrastructure devices need the most attention to ensure operational resilience.
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.