Guide · IT and cybersecurity

AI in government IT and cybersecurity

How many of the AI uses federal agencies listed for 2025 are filed under IT or cybersecurity, what they are, how far along they are, and the rules and frameworks that apply to them.

Updated 29 October 2026 · Every number links to its source. The inventory was read on 28 October 2026; the CISA, NIST and OMB documents on 29 October 2026.

What counts here

Each use case in OMB's 2025 inventory carries one topic chosen by the agency from a fixed list. Two of the fifteen topics are "Information Technology", which the file shortens to "IT", and "Cybersecurity".[2] This guide counts the rows that carry one of those two values. The topic is required only for use cases that are pre-deployment, piloted or deployed, so retired use cases mostly carry no topic and are largely absent from these counts.[2]

The topic says what the use case is for, not what it does. A chatbot for an IT help desk is filed under IT; a chatbot for the public may be filed under service delivery. The counts are of the agencies' own filing, not an outside review of the systems.

How many

447 of the 3,611 use cases are filed under IT or cybersecurity: 394 under IT and 53 under cybersecurity.[1] Of the 447, 146 are marked deployed, 69 are pilots and 218 are still before deployment.[1]

Data: it-cyber-by-stage-2025.csv

Who lists them

24 agencies list at least one IT or cybersecurity use case. The Department of Energy lists 98, Health and Human Services 88, the Treasury 56 and Justice 37.[1] The Department of Veterans Affairs lists 27, of which 9 are under cybersecurity, the most of any agency.[1] The Tennessee Valley Authority's 12 rows carry no stage, because its list had no stage column.[1]

A long list says what an agency chose to report and how finely it split its reporting. The Department of Energy, for example, lists many commercial products one by one.[1]

What kind of AI

The two topics lean on different kinds of AI. Under IT, 223 of the 394 use cases, 57%, are labelled generative AI.[1] Under cybersecurity, classical machine learning leads with 28 of 53, and generative AI has 14.[1] The label is the agency's choice of the one that "most closely aligns" with the use case.[2]

What the uses are

The IT rows are, by their own names, mostly the tools of an IT shop: help-desk and support chatbots such as "Chatbot for IT Customer Help Desk" and "Helpdesk chat assistant for common data system tasks", code assistants such as "GitHub Copilot" and "Intelligent generation of modernized code", search and records tools such as "AI and natural-language powered search" and "OpenText for Records Management (File share auto-classification)", and office software with AI built in, listed product by product.[1] Those product rows sit in the individually reported file even though OMB created a separate consolidated file for common off-the-shelf tasks.[3]

The 22 cybersecurity use cases marked deployed are a shorter and more specific list: anomaly and threat detection, phishing and compromised-email detection, security monitoring, supply-chain risk research, and one redaction tool.[1]

Data: cybersecurity-deployed-2025.csv

The high-impact share

OMB's memorandum M-25-21 defines high-impact AI as AI whose output "serves as a principal basis for decisions or actions" with a legal, material, binding or significant effect on rights, access to programs and services, health and safety, critical infrastructure or strategic assets.[4] Its list of purposes presumed high-impact includes "control of access to, or the security of, government facilities".[4]

Agencies marked 19 of the 447 IT and cybersecurity use cases as high-impact: 12 under IT and 7 under cybersecurity.[1] That is 4%, against 12% for the whole file, where 445 of 3,611 are high-impact.[1] Another 6 were presumed high-impact and then determined not to be, and 31 carry no answer.[1] The Department of Veterans Affairs accounts for 7 of the 19.[1]

Data: it-cyber-high-impact-2025.csv

The rules and frameworks

OMB. M-25-21, issued on 3 April 2025, gave agencies 270 days to revisit their internal policies on IT infrastructure, data, cybersecurity and privacy, naming "information system authorizations, continuous monitoring, continuous authorizations for AI" among the cybersecurity items, and 270 days to write a generative AI policy.[4] It asks that agency policies prefer, where possible, models "built with less data" that need less compute and are "inherently more explainable".[4]

CISA. The Cybersecurity and Infrastructure Security Agency's Roadmap for AI is described as "a whole-of-agency plan aligned with national AI strategy" with three aims: to "promote the beneficial uses of AI to enhance cybersecurity capabilities", to ensure AI systems are protected from cyber-based threats, and to deter the malicious use of AI against critical infrastructure.[6] Its overview page sets out five lines of effort, the first of which is that CISA will use "AI-enabled software tools to strengthen cyber defense" and support its critical infrastructure mission, and the second that CISA will "assess and assist secure by design, AI-based software adoption" across federal civilian agencies, companies and state, local, tribal and territorial governments.[5] The page still frames the roadmap around Executive Order 14110 of 30 October 2023.[5] The roadmap page also records the Guidelines for Secure AI System Development, released with the United Kingdom's National Cyber Security Centre and "developed in cooperation with 21 other agencies and ministries".[6]

NIST. The AI Risk Management Framework, NIST AI 100-1 of January 2023, was written "as directed by the National Artificial Intelligence Initiative Act of 2020" and is "intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic".[7] Its core has four functions: govern, map, measure and manage.[7] The generative AI profile, NIST AI 600-1 of July 2024, is "a cross-sectoral profile of and companion resource for" that framework and names twelve risks, one of them information security.[8] On that risk it says generative AI "could potentially discover or enable new cybersecurity risks" by lowering the barriers to offensive capabilities, and at the same time "expands the available attack surface", being itself open to attacks such as prompt injection and data poisoning.[8]

The earlier version of this site ran a dozen general posts on AI in IT, test automation, software delivery and threat detection. They are retired; the counts and documents above are what can be checked.

Counting caveats

• The inventory excludes AI in national security systems and the intelligence community, AI used for basic or applied research, and Department of War use cases (the Department of Defense, under the name OMB's file uses), so a part of the government's security-related AI is outside it by design.[3]
• Common tasks done with commercial off-the-shelf products belong in a separate consolidated file, but some agencies listed such products individually; the IT count above includes them.[3][1]
• Topic, classification and the high-impact answer are each one choice by the reporting agency, and the topic is required only for three of the four stages.[2]
• The Tennessee Valley Authority's list carries no stage column; its rows count in every total and in no stage.[1]
• The CISA pages were read on 29 October 2026; the record used for the quotations is the text of the two pages as read that day, and no other CISA document was consulted.

See also: Generative AI in government, AI in the public sector, Data science in government, and the data story 3,611 uses of AI on the federal list.

Sources

1. Office of Management and Budget, 2025 Federal Agency AI Use Case Inventory, file of individually reported use cases (3,611 rows; the repository says "as of April 13, 2026"), counted by this site: 2025_individually_reported_AI_use_cases.csv. Read 28 October 2026.
2. Office of Management and Budget, 2025 inventory data dictionary. Read 28 October 2026.
3. Office of Management and Budget, 2025 Federal Agency AI Use Case Inventory repository, README (summary, submission schedule and exclusion criteria). Read 28 October 2026.
4. OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, 3 April 2025. Read 29 October 2026.
5. Cybersecurity and Infrastructure Security Agency, Artificial Intelligence (the roadmap overview page, with its five lines of effort). Read 29 October 2026.
6. Cybersecurity and Infrastructure Security Agency, Roadmap for AI (resource page). Read 29 October 2026.
7. National Institute of Standards and Technology, NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023. Read 29 October 2026.
8. National Institute of Standards and Technology, NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, July 2024. Read 29 October 2026.

How this page was counted: one row per use case in OMB's file, read on 28 October 2026; a use case counts as IT when its topic_area column is exactly "IT" and as cybersecurity when it is exactly "Cybersecurity"; stages, classifications and high-impact answers are those columns as given, with an empty cell counted as "no stage given", "no classification given" or "no answer". The CSV files beside this page carry the counts, the source address and the read date; README.txt beside them repeats the rule.