Robust and resilient cybersecurity is a top priority for both government agencies and AI, and new technologies like quantum computing are driving a rapid evolution in the volume and sophistication of threats as well as increasing the attack surface. However, cyber risks in the public sector directly affect national security, mission fulfilment, and constituent services. The gravity of this cyber environment was clear among the speakers, panelists and attendees of the Federal Cybersecurity Executive Summit hosted by Optiv + ClearShark.
Government Technology Insider spoke with Kelvin Brewer, Director of Public Sector Sales Engineering at Ping Identity, to gain more insights into how agencies can overcome these obstacles. With extensive expertise in identity infrastructure, cloud modernization strategy, and cybersecurity strategy, Brewer offered valuable insights on how agencies can safely operationalize AI, reduce complexity across IT environments, and defend against emerging threats without disrupting current operations.
Government Technology Insider (GTI): Many agencies are struggling with “data overload” while trying to operationalize AI securely. From your perspective, what differentiates agencies that are successful in turning data into actionable decision advantages versus those that get stuck in the experimental phase?
Kelvin Brewer (KB): In this respect, I think AI and all the changes that are happening in AI cause us to always be stuck in the experimental phase. I don’t think there are agencies that are pulling themselves into that stable phase right now. Somebody recently said, “If you feel like on Thursday that you’ve got things figured out with AI, by Monday it’s changed,” so you have to re-figure things out. And that’s the stage we’re in today. Everything’s changing so fast that we have to build our cybersecurity strategy on proven concepts that allow us to be reactive to the changes, because it’s constantly changing.
GTI: A big theme at the Federal Cybersecurity Executive Summit was reducing complexity across cyber and IT environments. How does modern infrastructure help agencies improve security posture without adding operational drag?
KB: There are a lot of things happening, but one shift that I’ve seen happening in the identity space is that we’ve gone through many different phases in identity management. One of those has been to move back and forth between point solutions and platforms. Right now, we’ve been in a phase for the last seven or eight years where to have a solid identity solution implemented at an agency, you have to have five or six, seven different solutions, one for identity governance, authorization, authentication, identity verification, and card management. You have to have all these different systems. And more and more, we’re getting back to having the ability to have a standardized platform that reduces the number of solutions while still providing you with a simplified identity experience. That’s what we’re doing, as well as other vendors. The way that we’re going to reduce operational drag is the integration of different solutions. Let’s reduce the number of solutions and integration points so that we can reduce operational drag and the number of unique administrators you need to have because you have many different types of software and make it so agencies can truly protect themselves.
GTI: A lot of speakers at the summit emphasized real-time visibility and machine-speed operations. Where do you see AI coming into play to deliver the most immediate value?
KB: There’s a lot of innovation that’s happening. About two weeks ago, we released the idea of headless administration with AI. With that, what we did was we released all of our documentation in markdown language, and it allows AI solutions like Claude Code to read in all of our documentation and then allow somebody to put plain language into Claude, or any other AI-based programming platform, and instruct it to do things in the Ping Identity solution.
For example, I can ask it to build an authentication journey for me that does these specific things and it does it. Add an OAuth application with these certificates, and it just does it for you. You don’t have to go in and click the buttons, fill in the fields, do all the different things that are manual, even though it’s UI based. You don’t have to do that anymore. All you have to do is work in Claude, and test and verify that it did things correctly.
It’s going to save agencies a lot of time because they’re going to see that AI can do a lot of the complex work for them more quickly and allow them to be more proactive.
GTI: Many agencies are under a lot of pressure to modernize while still supporting legacy systems. How can agencies adopt AI-enabled infrastructure and security capabilities without disrupting current operations or increasing risk?
KB: There are a couple things happening and changing right now that are really important. We’ve got the increased adoption of AI, especially with agentic AI, and we also have the challenge of post quantum computing (PQC) coming. One of the first things that you need to do is realize that an agency is likely not going to hit the federal deadlines for being ready for PQC. It takes a unique group that’s able to be nimble enough to adjust as quickly as the agentic AI space and AI space are changing. The question that has to be asked is, how do you protect yourself in the meantime, while you’re waiting for policy, or legislation? While we wait for government, what I’m recommending to agencies is that they put a reverse proxy in place that protects those applications that aren’t quantum, protects their environment from agentic threats, and allows them to let through known operations, known activities, but then block those things that are new, that are unexpected, that are risky.
For example, security assertion markup language (SAML) is not going to go quantum; it’s not going to go PQC. That means that we have to reverse proxy all our SAML apps, which in the government, [is] probably 80 percent of the applications in the identity space. Agencies are using huge amounts of SAML, and it won’t be ready for 2029. So, that’s where reverse proxy comes in. The first thing to simplify to facilitate nimble movement as an agency is to reverse proxy the legacy applications, the legacy solutions, as well as agents, so that you’re protecting your environment.
GTI: After the summit, what do you think stood out to you most and what do the conversations signal about where government cybersecurity is heading in the next few years?
KB: What governments must realize is that AI is changing things really quickly. Despite the speed of change, we still need policy. We just received an executive order from the White House on AI and how agencies are supposed to handle that.
We need laws, policy, and infrastructure that allow the agencies to know how to move forward with AI, and how to move forward with PQC. We do have some guidelines now around that, but so far, it’s just guidelines. We don’t have a lot of legislative movement yet, and that’s what we need next. That’s the next thing that needs to happen, so the agencies are ready for all the changes to come.