Presented by stackArmor& Carahsoft
Automating compliance evidence collection will deliver limited value if agencies keep the same approval processes around it. Johann Dettweiler, Chief Information Security Officer at stackArmor, a Quantum Sky Company, said government AI adoption should include a careful examination of the workflows that determine how information becomes a decision.
Speaking with Fed Gov Today at the Google Public Sector Summit, Dettweiler argued that emerging technology often enters processes designed for an earlier operating model. Agencies can acquire capable tools while retaining requirements that prevent those tools from delivering their expected benefits.
He focused on the meaning of human oversight. Putting a person into a workflow does not guarantee that person can perform a useful review. If an AI system generates an enormous report and an already overworked employee must approve it, the volume may make meaningful scrutiny unrealistic.
Compliance provides a concrete example. Skilled security professionals can spend substantial time collecting evidence from monitoring systems, service management tools, and audit logs. Taking screenshots to demonstrate individual controls consumes time that might otherwise support analysis. Dettweiler described those repetitive activities as a strong opportunity for automation.
AI can collect telemetry, correlate information from different services, and assemble material for review, he said. A person can then examine the output and make a risk-based decision. The division of work gives the employee information to evaluate without requiring the same manual gathering effort.
Dettweiler also saw opportunities beyond a single compliance task. An engineer who has time to assess evidence may notice related patterns across multiple systems. Those relationships can be difficult to identify when the employee’s attention is absorbed by documenting one control after another.
That broader view can lead to better questions about risk. Outputs from one system may become more meaningful when compared with findings elsewhere. Security professionals can use their technical experience to investigate those connections and develop more effective workflows for examining the environment.
Although Dettweiler acknowledged possible financial benefits, he emphasized the security value of using employee expertise more effectively. Reducing the time spent on routine evidence gathering can create room for people to interpret information, assess consequences, and decide what requires action. Those activities depend on judgment that a simple approval button does not capture.
His message for agencies was to modernize the process alongside the technology. Automating a task should prompt a review of the steps around it, the evidence people need, and the decisions they are responsible for making. In compliance, that means establishing a workable relationship between machine-generated information and human assessment. The result can be a process in which security professionals spend more time understanding risk across the organization and less time manually proving that individual controls exist. That is the opportunity Dettweiler wants agencies to examine as AI adoption grows.