Agencies are often very confident in their ability to recover from cyberattacks. In fact, according to a recent survey, 95% of federal security officials believe their agencies can restore operations within their Recovery Time Objectives. But confidence and actual capability are different matters, and the same data transfers and AI-driven technology that improve agency operations also create greater cybersecurity risk.
AI is a primary cause of the confidence-capability disconnect, which is why agencies should extend their data governance policies to include AI tools. They also should avoid a common mistake: thinking that a good track record proves the effectiveness of an underlying capability. Only by testing recovery under conditions that resemble a bad day, not a calm one, can you gauge a recovery plan’s worthiness, especially as AI proliferates.
“The confidence-capability gap isn’t just getting wider with AI; I think it’s getting harder to even see,” said Bill Gemza, Deputy CISO and VP of Cybersecurity and Threat Management at Veeam. “You can’t recover from what you don’t know existed, and a lot of AI usage in government right now falls into exactly that blind spot. That’s the piece that I think doesn’t get said enough.”
In this video interview, Gemza discusses why agencies are often too confident in their cyber capabilities and how to align their perceptions with operational reality. Topics include:
- Best practices for strengthening cyber resilience
- Why AI makes cyber recovery more challenging
- Pitfalls to avoid when becoming more cyber-prepared