Q&A: Cisco Public Sector Chief Shares How Federal Agencies Must Modernize for AI

FEDTECH: Federal agencies are under intense pressure to operationalize AI quickly. What are you hearing from agency leaders about what’s preventing them from moving faster?

DEPRETA: Everybody recognizes that AI is coming at us fast and furious. What has changed over the past several months is the realization that even if an organization is not ready for AI internally, the world is moving on without it. AI will affect every organization, whether it’s ready or not.

There are several barriers, but four stand out: infrastructure, trust, return on investment and human capital.

On infrastructure, agencies are not just dealing with data center modernization. They’re also dealing with network infrastructure, campus infrastructure and security architecture that were built years — and in some cases decades — before AI became a consideration. AI workloads place enormous demands on networks, and agencies need to rethink both capacity and architecture.

Trust and security are equally important. Agencies need platforms that can be trusted not only by humans but also by AI agents operating on their behalf.

We’re also seeing a shift in how organizations think about ROI. The value of AI isn’t simply automating an existing process. It’s about transforming the process itself. If you’re only measuring AI against the old way of doing business, you’re missing its real value.

Finally, there’s the human capital challenge. Agencies need people with the right skills, but modernization can also help by automating routine tasks and allowing employees to focus on higher-value work.

FEDTECH: How do you see zero trust evolving in the AI era? Is there a movement toward broader visibility into applications, workloads and machine-driven activity?

DEPRETA: Zero trust remains critically important, and the fundamentals still matter. Least-privilege access is still foundational.

What changes is that traditional zero trust was designed for a human-centric world. In an AI-driven environment, organizations must think differently because agents are making decisions and taking actions on their own.

In the traditional model, you’re limiting a user’s access to systems and data. In an AI world, you also have to limit what tasks an agent is allowed to perform. It’s not enough to control access; you need to control actions.

Visibility becomes extremely important. Agencies need discovery, observability and governance capabilities so they can understand what agents are doing, monitor activity and maintain compliance requirements.

We’re moving from a human-based zero-trust model to an agentic zero-trust model. That requires identity for every agent, visibility into machine-driven activity and the ability to enforce policies at scale.

FEDTECH: Given Cisco’s participation in Project Glasswing, how are you advising federal agencies? What is Cisco doing to help organizations prepare for this new era of AI capabilities?

DEPRETA: Mythos catalyzed efforts to understand how advanced AI models can identify vulnerabilities and generate attack paths at machine scale. Cybersecurity is the ultimate team sport, and while agencies are adopting agentic AI to scale detection and response at machine speed, they’re only as strong as the technology providers hardening their platforms and reducing the attack surface.

For Cisco, participation in Anthropic’s Project Glasswing and OpenAI’s Daybreak has transformed how we identify vulnerabilities and protect customers. Using frontier AI models, we were able to scan 1.8 billion lines of code in over 25 programming languages across Cisco’s portfolio in eight weeks. At human scale, that would have taken eight years.

The ability to rapidly identify vulnerabilities and develop fixes is a major advantage. But the larger lesson for federal agencies is that AI is exposing a long-standing problem: technical debt.

Many agencies continue to operate infrastructure that is no longer supported or can no longer be patched. That challenge exists everywhere, but it’s especially acute in government environments. Agencies need to identify those systems and develop plans to modernize or mitigate the risk they create. There is a newfound sense of urgency. A proactive approach to IT modernization is essential for the public sector to keep pace in an agentic AI era.

FEDTECH: What advice do you have for agencies trying to balance modernization with resilience requirements?

DEPRETA: The most important thing is to have a plan, and you can’t have a plan without first taking inventory of what needs to be updated.

Federal agencies should work closely with trusted technology partners to understand their current environment, identify high-priority assets and develop a roadmap for modernization. They also need risk mitigation strategies for systems that can’t be replaced immediately.

One thing organizations cannot afford is inaction. The pace of change is too fast.

Cybersecurity fundamentals still matter. Agencies should continue focusing on patching, multifactor authentication, email security, internet security and strong encryption, including post-quantum cryptography. At the same time, they need a proactive modernization strategy because unsupported infrastructure creates long-term risk that cannot be solved overnight.

READ MORE: Why federal agencies can’t wait on post-quantum cryptography.

FEDTECH: Cisco often talks about reducing complexity while improving security. Why has simplification become such an important issue for federal IT organizations?

DEPRETA: Federal infrastructure environments have evolved over many years and become a patchwork of different systems and technologies.

When organizations simplify their environments and adopt a platform-based approach, they gain better visibility, stronger automation and more efficient operations. Those benefits become even more important in an AI era.

Agencies need operational agility. They need to automate routine tasks, improve productivity and support AI-driven operations. Simplification also reduces potential attack surfaces, improving security while making it easier to take advantage of innovation.

FEDTECH: What separates agencies that are successfully preparing for the AI era from those still struggling to modernize?

DEPRETA: The agencies that are making progress are the ones who understand there is no AI era without a secure network. They treat their infrastructure as a strategic asset. 

Preparation starts with acknowledging that AI is here, and that organizations need a strategy. The agencies moving forward are leaning into partnerships, assessing their current environments and building modernization plans.

The agencies that struggle often struggle to move from pilot to production. They get stuck in experiments because their network cannot handle the traffic or they lack the observability to prove an ROI. So many agencies are waiting for the perfect moment to modernize their infrastructure or are assuming they can postpone decisions. The reality is that the pace of change doesn't allow for that, and the technology they need to meet the moment for AI and cybersecurity is available today.

One of my favorite sayings is that the best time to plant a tree was 20 years ago. The same idea applies to AI readiness. The next best time is today. Agencies don’t need to have every answer right now, but they do need to start.