Bridging the Divide: Report Finds Significant Visibility and Governance Gaps in Federal AI Readiness

This gap is particularly concerning given the current security climate. The report notes that 35% of organizations are actively loosening security or compliance restrictions to facilitate wider access to AI tools, even as AI-related incidents are on the rise. Furthermore, while 20% of organizations are currently developing a governance framework, being "in progress" is not the same as being governed. True governance is only achieved when an agency can accurately identify its AI tools, understand their usage patterns, detect behaviors that fall outside of expectations, and produce the necessary evidence for rigorous oversight.

Federal AI Adoption Meets Complex Mission Environments

While the media often portrays AI adoption as "aggressive," the report suggests a more measured reality within the public sector. Only 27% of respondents described their organization’s adoption as aggressive, while a majority (60%) characterized it as methodical. Nevertheless, the exploration of AI is nearly universal; only 5% of respondents reported that no AI tools are currently in use or planned.

The challenge for federal and defense agencies is compounded by the complexity of their operating environments. Over half of the respondents (54%) work in hybrid environments, and 29% cited legacy infrastructure as a major barrier to successful AI integration. Among those who identified legacy incompatibility as a vulnerability, a staggering 81% view it as a significant risk.

In the federal context, the infrastructure is rarely "greenfield." AI tools, many of which are designed for cloud-first commercial architectures, must be integrated into environments that include on-premises servers, operational technology (OT), and classified or air-gapped networks. Sensitive missions may require accredited, purpose-built alternatives rather than standard commercial offerings. If an agency cannot see where AI is operating or which systems it can reach across these diverse environments, it cannot manage the inherent risks effectively.

The Defense Logistics Agency (DLA) provides a practical look at how these challenges are being addressed in the field. DLA CIO Adarryl Roberts has noted that the agency is utilizing "digital employees"—autonomous agents that operate across mission workflows. To manage the risks associated with these agents, the DLA’s approach emphasizes persona-based access, zero-trust architecture, and the establishment of "trusted data." The DLA’s experience underscores a vital lesson for the broader federal community: agentic AI requires an accountable identity, clearly defined permissions, and continuous behavioral visibility to remain safe and effective.

Why AI Observability Matters for Federal Agencies

For a federal agency, observability is not just a technical luxury; it is a requirement for accountability. An agency cannot enforce a governance framework, investigate a security incident, or demonstrate compliance with mandates like the Executive Order on Zero Trust if it cannot see what an AI tool is doing in real-time.

Currently, AI tool behavior is the most frequently cited monitoring gap (19%) and the top perceived AI-related vulnerability (39%). Traditional monitoring tools are often designed to show whether a system is "up" or "down," but they frequently fail to capture the nuance of AI capabilities. They may not show what data an AI touched, what specific actions it initiated, or whether those actions deviated from the tool’s approved purpose.

In the government sector, this lack of detail is a major hurdle. Federal decisions are subject to audits, congressional oversight, and legal reviews. Without a clear and immutable record of what a system did and why, an agency may find itself unable to explain an automated decision, distinguish a simple AI error from a sophisticated security breach, or prove that its internal controls were functioning as intended.