Federal CISO’s Four Priorities to Strengthen Cybersecurity

Acting Federal CISO Michael Duffy outlined four priorities his council is focused on to strengthen federal cybersecurity as agencies confront rapidly evolving threats and emerging artificial intelligence capabilities.

Those priorities reflect a shift away from a reactive approach to cybersecurity toward anticipating threats and taking action before incidents disrupt government services. 

“We don’t have the time to quickly pivot when something happens, and that’s a message that I carry in all these discussions to make sure that all of us understand as we’re thinking about the future what are the types of decisive steps we need to take today so that we are prepared for that future,” he said Wednesday at the ACT-IAC Cybersecurity Summit.

The council’s goal is to find how to be more resilient and unified against a threat. It also aims to understand how technology is changing and how the federal government can “transform and reduce risk along the way.” 

Here’s a look at the CISO Council’s four main priorities: 

Reducing Cyber Exposure  

The council’s first priority is reducing the government’s cyber exposure, particularly by removing outdated infrastructure that adversaries could exploit. 

Duffy pointed to a directive addressing end-of-support edge devices and said the council has launched a sprint to determine how much agencies can accelerate their remediation efforts using existing resources before the end of the fiscal year. 

The effort builds on a broader push to modernize vulnerable infrastructure and prioritize remediation based on real-world threats. Rather than attempting to address every vulnerability equally, agencies should focus on known exploited vulnerabilities and weaknesses that could disrupt critical services. 

Duffy said the goal is to move beyond treating vulnerability management as a checklist exercise and concentrate resources on risks that could affect agency missions. 

Operational Resilience 

The second priority, operational resilience, addresses the need to maintain essential government services even when attackers succeed in breaching defenses. 

The council is preparing for its second government-wide CISO tabletop exercise. The next exercise will bring together agency CISOs and security operations center directors to evaluate incident-response capabilities, coordination and preparedness across the federal enterprise. 

“How do we improve the way that we, as a government, are preparing for the worst day? We take every step to make sure the bad guys don’t get in, that the adversary isn’t successful,” he said. “We need to say, ‘How can we continue to deliver on the critical missions that we have? … How do we make sure that we can continue the mission no matter what hits us?’” 

Integrating AI and Securing Modernization  

The third priority is incorporating advanced AI capabilities into federal cybersecurity tools and operations. 

Duffy said he convened industry and agency representatives at the White House to identify technologies that agencies can deploy today, rather than relying on capabilities that remain years away from widespread adoption. 

The council has also established a working group focused on AI security governance. Its objectives include developing repeatable frameworks for managing systems, supporting human oversight and enabling agencies to make faster, risk-informed decisions. 

Duffy said agencies need governance structures that establish how technology and human expertise work together, particularly as automation advances toward machine-to-machine operations. 

Securing a Modern Federal Government  

The fourth priority, securing a modern U.S. government as agencies transform how they deliver services to the public, includes strengthening data security and application programming interface (API) security, as well as protecting the connections among agencies needed to support more integrated digital services.   

Duffy said cybersecurity must be embedded in modernization efforts rather than treated as a separate function. 

“How do we ensure we have the right level of data security and API security and interconnectedness across agencies, so we can deliver on these commitments as the federal government,” he said.  

Duffy added that the four priorities must advance together, rather than compete for attention. Success will depend on agency leadership, workforce expertise and collaboration with industry. 

He urged technology providers to continue developing secure software and to be transparent about which capabilities are ready for deployment today and which remain aspirational. 

Duffy also highlighted workforce development as a key component of implementation, pointing to post-quantum cryptography migration as an example of a complex, multiyear effort requiring standardized guidance, training and coordination across agencies.   

Ultimately, Duffy said, the council’s priorities are intended to translate federal cybersecurity strategy into measurable operational outcomes. 

“We all collectively need to act today,” he said.