“AI doesn’t eliminate the need for discipline. If anything, it increases it in highly regulated environments like government agencies…The agencies that are going to succeed in 2026 will not be the ones that adopt AI the fastest, they’ll be the ones that adopt it responsibly and securely.” — Steve Boone, Director of Product Marketing, Checkmarx
AI moves from pilots into agency workflows
The year 2025 marked a clear shift across the federal government: artificial intelligence stopped being an experiment and began to run inside core agency workflows. On the Government Technology Insider podcast, host Lucas Hunsicker and Steve Boone described AI’s reach as extending well beyond chatbots and customer-facing tools. Analysts now use AI to synthesize threat intelligence; procurement teams rely on it to accelerate documentation; developers employ AI-assisted refactoring and code generation to modernize legacy codebases.
For agencies burdened by years-long modernization backlogs, Boone said, automation is reducing friction across DevSecOps pipelines and producing more output without proportional increases in staff or budget — a tangible realization of long-promised digital transformation returns.
Security trade-offs inside DevSecOps pipelines
That increased velocity carries trade-offs. As Boone put it, “when development velocity doubles, vulnerability volume rarely remains flat.” AI-generated code, expanded automated pipelines, and wider reliance on external models broaden the attack surface. Prompt injection, model supply chain integration, data leakage, and unsanctioned “shadow AI” usage are now mainstream security concerns.
Security has therefore moved to the center of deployment conversations: teams must contend not only with finding vulnerabilities but with the reality that AI can both create and help remediate risk within the same toolchain.
From “find and fix” to fixing the right vulnerabilities faster
The defining governance challenge Boone described is alignment — ensuring productivity gains are matched by commensurate increases in security and governance maturity. Traditional “find and fix” approaches to application security struggle to scale in an AI-accelerated environment, so agencies are rethinking priorities.
Boone highlighted several shifts under way: agencies are exploring AI-assisted remediation, automated vulnerability prioritization, and measures designed to reduce mean time to resolution (MTTR). The operational objective is not simply to identify more issues but to fix the right issues faster, folding remediation into accelerated development pipelines.
Emerging governance frameworks and the SBOM analogy
Governance frameworks are materializing as agencies seek visibility into AI components the way they did for software supply chains. The conversation borrows the Software Bill of Materials (SBOM) model: agencies are beginning to consider how to inventory and track AI components, models, and data dependencies.
Boone stressed that transparency — into how models are trained, what data they rely on, and where they are deployed — will become essential in regulated government environments. That visibility, the argument goes, is a prerequisite for defensible risk management and for meeting regulatory or operational constraints.
Why strategic partnerships matter across hybrid and classified boundaries
Boone and the podcast noted that agency environments are complex: hybrid architectures mix on-premises systems, cloud infrastructure, legacy frameworks, and classified boundaries. Embedding AI-enabled workflows across these environments requires architectural fluency and security expertise that many in-house teams lack.
Accordingly, the right AI partner, Boone said, does more than accelerate development: they help balance velocity with assurance, integrate security controls into AI-enabled workflows, deliver defensible remediation guidance, and support operations across complex hybrid and classified environments.
What this means for technologists, procurement teams, and agency leaders
- Technologists and security teams: Expect AI-assisted refactoring and automation to remain central to modernization work, while also having to prioritize automated vulnerability triage, remediation, and reduced MTTR to keep pace with increased code generation and pipeline velocity.
- Procurement teams: As procurement leverages AI to accelerate documentation, teams will need to account for model and data dependencies in acquisition decisions and consider inventorying AI components as part of procurement records.
- Agency leaders and policymakers: Leaders must decide which partnerships will provide the necessary security integration across hybrid and classified environments and how to operationalize transparency into model training, data reliance, and deployment to meet regulated requirements.
Boone’s closing note on the podcast distilled the practical question agencies now face: adoption alone is not the metric of success — responsible, traceable, and secure integration of AI into core workflows is. The next chapter for federal AI will be written not by pilots, but by the governance choices agencies put into production.
https://governmenttechnologyinsider.com/ai-governance-defines-the-next-stage-of-federal-ai-adoption/
