Netskope Outlines a Four-Step Approach to Securing Federal AI Use Cases

Federal agencies are rapidly fielding AI use cases, with OMB inventory reporting thousands already documented across dozens of agencies. The shift raises cybersecurity risks around data exposure and agent behavior, requiring protection measures that can operate inline.

Research Overview

The Office of Management and Budget (OMB) documented 3,611 AI use cases across 56 submitting agencies in a 2025 inventory. The brief says several civilian agencies have since reported more than 300 additional use cases.

It frames the current rollout as a repeat risk from the federal Cloud First period, when security architecture gaps made it difficult to meet expectations for returns on investment. It also points to a recent White House executive order calling for voluntary pre-release access of AI models for government use.

Key Findings

The post says traditional enterprise security approaches often fail to manage AI workflows because legacy tooling may lack visibility into AI usage and cannot inspect prompts or model interactions. It describes this as creating lifecycle blind spots for AI use cases.

The brief also argues that agency teams need to understand how AI handles sensitive data, including what it does and how it operates. It calls for automated testing against known LLM attack types and early red teaming during deployment.

Operational Impact

To handle “compliant acceleration,” agencies are directed to deploy AI use cases rapidly while meeting requirements for security, transparency, and risk management. The post links these expectations to the NIST AI Risk Management Framework, OMB M-25-21, and guidance issued by CISA.

It emphasizes that agencies using AI for work with sensitive data without human intervention must support ongoing assessment of AI behavior and interactions. It also highlights that subscription services can be acquired without broader procurement review.

Technical Breakdown

The post presents a four-step approach: discovery, risk classification, agent visibility, and installation of gateways and safeguards. It states discovery should include AI tools, embedded AI in SaaS platforms, and unmanaged AI usage across the enterprise.

For agent visibility, it describes the need to understand which agents are present and which assets they connect to, including upload activity, authentication patterns, and request-response interactions. For safeguards, it calls for inline enforcement and continuous red teaming for self-hosted deployments, including adversarial simulations against automated test cases before and after deployment.

It references a 2025 NIST finding that novel attacks against AI agents succeeded 81% of the time, using that result to support the need for controls as use cases move from chatbots to agents that can act across systems.

Leadership Perspective

The post positions security planning as a requirement for scaling AI in government operations, rather than a follow-on activity. It says agencies that implement discovery, risk classification, agent visibility, and inline enforcement will be better positioned to deploy AI safely.

It also includes vendor information on AI security offerings for federal agencies, but the core guidance in the brief centers on internal processes and continuous testing aligned to NIST, OMB, and CISA expectations.

This summary describes a federal AI rollout accelerating through thousands of documented use cases, while arguing that security programs must be adapted for AI lifecycle risks including prompt and interaction visibility, automated adversarial testing, and inline enforcement. The “Blog Signals brief” reflects the vendor blog’s stated recommendations as a fact-based summary for enterprise IT and security decision-makers.

Blog post, originally published by Mark Mitchell at netskope.com.