AI won’t make cybersecurity automatic. It will make continuous security smarter.

NVIDIA CEO Jensen Huang recently made a point about AI safety that should resonate with anyone responsible for cybersecurity: “Safety is an engineering problem.”

His argument is straightforward. AI systems are computing systems, and keeping them safe requires engineering controls, testing, monitoring and verification. As AI becomes more capable, those safeguards have to evolve right alongside it.

NVIDIA is putting that philosophy into practice. Its newly announced Open Agent Safety Platform is designed to establish boundaries around what autonomous AI agents can do, continuously monitor their behavior and intervene when an agent attempts to move outside those boundaries. Huang describes the challenge as requiring “full-stack engineering.”

For federal agencies, there’s an important lesson in that approach that goes beyond AI safety itself. You don’t establish security once. You continuously prove that it is working. For years, agencies have invested heavily in compliance frameworks, monitoring tools and security controls. Those investments are essential. But AI is accelerating both sides of the cybersecurity equation. 

From finding anomalies to understanding what they mean

AI is often discussed as another cybersecurity tool for detecting anomalies faster. That matters, but I think it understates the opportunity. The real power of AI is its ability to help us connect information that previously existed in separate places and understand what those signals mean together.

Consider what happens when a suspicious login occurs. By itself, it might be nothing. Traditional security tools can flag it because the location, time or device looks unusual. But what if an AI-enabled security environment can simultaneously consider identity information (changes to title, role or level of access) and related network activity (application logs, configuration changes, endpoint behavior) and related threat intelligence to better detect whether a malicious actor—whether AI or human—may be at work?

Suddenly, we're not simply asking, “Is this login unusual?” We're asking, “What else is happening around this event, how are these activities connected and does the pattern indicate that someone is trying to do something they shouldn't?” That’s a much more powerful question.

AI gives agencies the ability to gather and analyze enormous volumes of information from disparate sources and look for relationships that humans—or individual security tools—might miss. That means moving beyond anomaly detection toward contextual understanding. And eventually, it means identifying early indicators of malicious behavior before they become a full-scale incident.

Attackers won’t wait for the next assessment

In old WWII movies, the sneaky guys would time the security guards walking around, find the gaps in their protection and then attack. These days, the sneaky guys are using AI to operate faster, gather intelligence more efficiently and spot opportunities at a scale that previously would have required a lot more time and resources.

In our role as the guards, we need to be using AI equally effectively to secure the gates. Huang recently described cybersecurity as being at an “inflection point,” noting that attacks are becoming automated and defense has to become automated as well. As he put it, adversaries will be “more armed than ever,” but defenders will be, too. That's exactly the challenge ahead.

For federal agencies, that raises an important question. If threats are becoming more dynamic, can cybersecurity continue to be organized primarily around periodic assessments and compliance milestones? Compliance remains essential. Frameworks such as FedRAMP and CMMC establish critical requirements and create a baseline of trust for the technology government uses. But authorization tells us that an environment met defined requirements at a particular point.

Between assessments, software changes. Configurations change. Users and privileges change. New vulnerabilities emerge. Applications connect to new systems. Threat actors change their tactics. AI accelerates that cycle even further. That makes the distinction between compliance as a milestone and security as an operating function increasingly important.

The advantage will increasingly go to agencies that can bring together their security data, apply intelligence to it and act on what they learn quickly enough to matter. That requires something very different from periodically checking whether your contractor meets a set of controls.

One of Huang's most useful observations is that greater AI capability requires greater investment in verification, testing and safety engineering. In a recent interview, he compared it to chip development, where enormous resources go not just into designing a chip, but into verifying that it works as intended. Cybersecurity should operate on the same principle.

AI can make continuous security operations better

This brings us back to something we talk about frequently at FedHIVE: compliance is essential, but compliance alone is not security. Interestingly, the emerging thinking around AI safety is moving in exactly this direction. NVIDIA's approach emphasizes continuously monitoring AI agent behavior rather than testing an agent once and assuming it will keep behaving as expected. Its broader security guidance calls for controls that can be enforced as systems operate, protected logs that show what happened and testing that is repeated as models, tools and workflows change.

AI can surface relationships, prioritize signals and provide context. Humans can apply judgment, understand mission impact and decide what action is appropriate. The result is not autonomous cybersecurity. It is better-informed cybersecurity. And it creates the possibility of moving from a largely reactive model—detect, investigate, respond—to a more proactive one: observe, understand, anticipate and intervene.

That's where I believe the real promise of AI in cybersecurity lies. It’s a force multiplier, but it won’t replace the fundamentals of security, eliminate the role of human judgment or reduce the need for ongoing compliance. It's simply giving us a much more powerful way to practice security as what it has always needed to be: a continuous operation.

Michael Cardaci is CEO of FedHive and a cybersecurity leader with 30+ years of experience securing government technology environments. An expert in federal cloud security, FedRAMP and continuous monitoring, he advocates for continuous, compliant security operations that connect security signals, evidence and risk.