Bridging the Divide: Report Finds Significant Visibility and Governance Gaps in Federal AI Readiness

As federal and defense agencies accelerate their adoption of artificial intelligence, a growing disconnect between leadership perception and operational reality is emerging. While senior officials often see a streamlined path toward innovation, the practitioners tasked with maintaining these systems report a more complex and precarious environment. According to the recently released Public Sector AI Readiness Report, the push to integrate generative and autonomous tools is currently outpacing the development of the systems, policies, and oversight practices required to manage them safely and effectively.

The report highlights a central challenge that goes beyond mere adoption: the ability of federal leaders and technical practitioners to share a unified view of AI behavior. In an era of budget constraints, workforce shortages, and mounting pressure to maintain a competitive edge, the lack of consistent visibility across cloud, on-premises, hybrid, and classified environments is becoming a critical vulnerability. For agencies handling sensitive data and mission-critical infrastructure, the stakes of this "visibility gap" could not be higher.

Why Federal AI Readiness Is Also a Visibility Challenge

One of the most striking findings in the report is the disparity between how leaders and individual contributors perceive the state of AI monitoring. When asked if AI tool behavior is fully integrated into existing monitoring systems, 62% of leaders responded in the affirmative. However, only 19% of individual contributors—the practitioners who work directly with the technology—agreed with that assessment.

This discrepancy suggests a fundamental breakdown in operational awareness. While senior leaders may be looking at high-level dashboards and strategic reports that suggest a smooth rollout, practitioners are dealing with the day-to-day realities of tickets, alerts, exceptions, and the manual troubleshooting required to keep complex systems running. This "dashboard vs. trenches" perspective creates a false sense of security at the top levels of management.

A similar pattern is evident in the perceived benefits of AI. The report found that 56% of leaders believe AI has already reduced the workload for IT and security staff. In contrast, only 41% of individual contributors feel the same way. Perhaps more tellingly, 17% of individual contributors stated that their organization has seen no meaningful benefits from AI at all, a sentiment shared by only 2% of senior leaders.

For federal and defense agencies, these statistics are more than just a difference of opinion; they are an operational signal. If the people running the environment and the people making the decisions do not share a reliable view of how AI is behaving, the agency’s ability to prioritize risk or validate mission impact is compromised. Without unified observability—grounded in the same operational evidence used by practitioners—it becomes nearly impossible to identify where additional controls are needed or to explain why a system acted in a specific way during a critical event.

How AI Governance Gaps Affect Federal Agencies

The rapid pace of AI adoption has also created a significant gap in governance. On the surface, the numbers look promising: 79% of respondents say that governance is either keeping pace with or is ahead of AI adoption. However, a closer look reveals a lack of depth in these frameworks. Only 37% of respondents report having a formal, actively enforced AI governance framework in place.

This suggests that many agencies may have "paper-only" governance. A framework can be documented and policies can be approved, but if they are not translated into technical controls, monitored behaviors, escalation paths, and verifiable evidence, they do not constitute true governance. In many cases, policy remains a high-level aspiration rather than a set of enforced rules that dictate how a system functions in the real world.

This gap is particularly concerning given the current security climate. The report notes that 35% of organizations are actively loosening security or compliance restrictions to facilitate wider access to AI tools, even as AI-related incidents are on the rise. Furthermore, while 20% of organizations are currently developing a governance framework, being "in progress" is not the same as being governed. True governance is only achieved when an agency can accurately identify its AI tools, understand their usage patterns, detect behaviors that fall outside of expectations, and produce the necessary evidence for rigorous oversight.

Federal AI Adoption Meets Complex Mission Environments

While the media often portrays AI adoption as "aggressive," the report suggests a more measured reality within the public sector. Only 27% of respondents described their organization’s adoption as aggressive, while a majority (60%) characterized it as methodical. Nevertheless, the exploration of AI is nearly universal; only 5% of respondents reported that no AI tools are currently in use or planned.

The challenge for federal and defense agencies is compounded by the complexity of their operating environments. Over half of the respondents (54%) work in hybrid environments, and 29% cited legacy infrastructure as a major barrier to successful AI integration. Among those who identified legacy incompatibility as a vulnerability, a staggering 81% view it as a significant risk.

In the federal context, the infrastructure is rarely "greenfield." AI tools, many of which are designed for cloud-first commercial architectures, must be integrated into environments that include on-premises servers, operational technology (OT), and classified or air-gapped networks. Sensitive missions may require accredited, purpose-built alternatives rather than standard commercial offerings. If an agency cannot see where AI is operating or which systems it can reach across these diverse environments, it cannot manage the inherent risks effectively.

The Defense Logistics Agency (DLA) provides a practical look at how these challenges are being addressed in the field. DLA CIO Adarryl Roberts has noted that the agency is utilizing "digital employees"—autonomous agents that operate across mission workflows. To manage the risks associated with these agents, the DLA’s approach emphasizes persona-based access, zero-trust architecture, and the establishment of "trusted data." The DLA’s experience underscores a vital lesson for the broader federal community: agentic AI requires an accountable identity, clearly defined permissions, and continuous behavioral visibility to remain safe and effective.

Why AI Observability Matters for Federal Agencies

For a federal agency, observability is not just a technical luxury; it is a requirement for accountability. An agency cannot enforce a governance framework, investigate a security incident, or demonstrate compliance with mandates like the Executive Order on Zero Trust if it cannot see what an AI tool is doing in real-time.

Currently, AI tool behavior is the most frequently cited monitoring gap (19%) and the top perceived AI-related vulnerability (39%). Traditional monitoring tools are often designed to show whether a system is "up" or "down," but they frequently fail to capture the nuance of AI capabilities. They may not show what data an AI touched, what specific actions it initiated, or whether those actions deviated from the tool’s approved purpose.

In the government sector, this lack of detail is a major hurdle. Federal decisions are subject to audits, congressional oversight, and legal reviews. Without a clear and immutable record of what a system did and why, an agency may find itself unable to explain an automated decision, distinguish a simple AI error from a sophisticated security breach, or prove that its internal controls were functioning as intended.

The rise of agentic AI—systems that can take autonomous actions—raises the stakes even further. The report found another significant perception gap here: 74% of leaders claim to have comprehensive monitoring for AI agents, while only 38% of individual contributors agree. This suggests that leadership confidence may be at its highest exactly where unseen behavior could have the most significant consequences.

Three Priorities for AI-Ready Federal Environments

To address these challenges and build a foundation for responsible AI scaling, the report outlines three strategic priorities for federal and defense agencies.

1. Inventory Before Deploying
Agencies must create a comprehensive map of their AI tools, including the systems and data they can access, the identities and credentials they utilize, and their connections across cloud, legacy, and operational technology environments. This inventory should serve as an operational baseline that is updated continuously as vendors introduce new capabilities or as mission requirements change.

2. Monitor AI Behavior, Not Just AI Traffic
While 57% of organizations currently monitor for unauthorized network traffic, 39% still report insufficient visibility into AI behavior. Monitoring must evolve to answer specific questions: What did the tool actually do? What data did it access? What actions did it initiate? Did it behave differently from its approved purpose? Moving from traffic monitoring to behavioral monitoring is essential for managing autonomous systems.

3. Measure Enforced Practice
Policy is only as good as its implementation. Currently, only 36% of organizations report having AI-specific security policies, and among those with a governance framework, only 37% describe employee adherence as strong. Agencies must bridge the gap between written policy and technical reality.

The Small Business Administration (SBA) is currently modeling this approach. According to an advisory published by the SBA Office of the Inspector General (OIG) in September, the agency is developing an AI governance board, a generative AI policy, and a comprehensive compliance plan. Crucially, the SBA is creating an agencywide use-case inventory to identify high-impact applications. This type of inventory is essential for connecting high-level policy to the specific systems and decisions that require oversight.

Readiness Is the Ability to See, Govern, and Explain

As federal and defense organizations continue to integrate artificial intelligence into the heart of their missions, the definition of "readiness" must expand. It is no longer enough to simply deploy a tool; readiness now requires the ability to see where AI is operating, understand its behavior across complex and fragmented environments, and enforce controls against real-world activity.

The agencies that will be most successful in scaling AI responsibly are those that treat observability as a foundational requirement rather than an afterthought. By closing the visibility gap between leaders and practitioners, federal organizations can ensure they have the evidence needed to explain their decisions, protect their data, and fulfill their missions in an increasingly autonomous world.