Cloud CISO Perspectives: How to build an AI-ready security program for the public sector

Welcome to the second Cloud CISO Perspectives for May 2026. Today, Usman Chaudhary, Field CISO, Google Public Sector, offers a guide for CISOs protecting government agencies and critical infrastructure on how to get started - and get the most out of - defending with AI. As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog .

If you're reading this on the website and you'd like to receive the email version, you can subscribe here . aside_block How to build an AI-ready security program for the public sector By Usman Chaudhary, Field CISO, Google Public Sector Usman Chaudhary, Field CISO, Google Public Sector Deciphering actionable signals from deafening noise can be hard for CISOs, even with AI - and especially for those guiding government agencies, critical manufacturing plants, or in a foundational industry. From industrial control systems to decades-old municipal databases, you're securing complex, deeply entrenched systems, and the sudden mandate to adopt AI can feel less like an evolution and more like a breaking point.

While it's true that you face a monumental challenge, we know that from our conversations with CISOs and customers that we can offer concrete, actionable steps on how to build an adaptable, AI-augmented defense while managing the operational load on your staff. The urgency created by machine-speed exploits means you can not rely solely on reactive measures. Once the immediate administrative toil has been reduced, you should aggressively shift your focus toward posture elevation, proactive hunting, and structural integration in the next six to 12 months.

Importantly, executing this vision does not mean developing everything from scratch. This roadmap relies on a strategic combination of building custom internal workflows (like Gemini Gems), buying established commercial AI capabilities, and integrating them into your existing security stack. Google's Gemini for Government delivers agentic AI for more than three million federal civilian and military personnel on a platform accredited at FedRAMP High and DOW Impact Level 5 .

To help you prioritize resources, we have structured the necessary AI initiatives across five core CISO workload domains, highlighting your team's immediate quick wins in the first 90 days alongside tactical goals in the first six months , and strategic goals in the six-to-12-month horizon . Your tactical execution plan: Months zero to six Building an AI-ready security program is a journey. We're focusing strictly on high-value use cases you can deploy immediately and in the next six months.

Executive alignment and business justification : The goal is to stop defending your budget with technical jargon and start explaining resilience in terms of financial risk and operational efficiency. AI-driven board reporting (Immediate) : Translate complex technical data into clear business impact. Pipe your metrics into a secure enterprise workspace (like Gemini for Workspace ).

Prompt the model to synthesize the raw data into a concise, two-page risk narrative that includes highlights such as containment metrics, potential impact on citizen services, and production uptime for critical assembly lines. Vendor and spend optimization (Immediate) : Upload vendor capability matrices and contracts to an isolated AI agent (like NotebookLM ). Have it identify feature redundancies across your stack, suggesting clear paths for tool consolidation and budget optimization.