Usman Chaudhary, Field CISO at Google Public Sector, provides a practical roadmap for CISOs protecting government agencies and critical infrastructure to build an AI-augmented security program. The urgency of machine-speed exploits demands moving beyond reactive measures, and the guide structures AI initiatives across five core CISO workload domains with immediate (90-day), tactical (0–6 month), and strategic (6–12 month) goals.

The first domain, executive alignment and business justification, focuses on translating technical data into business risk narratives. Immediate steps include using a secure enterprise workspace (e.g., Gemini for Workspace) to synthesize metrics into concise board reports, and employing an isolated AI agent (e.g., NotebookLM) to analyze vendor contracts for feature redundancy and budget optimization, grounded in third-party validation. The second domain, process optimization and toil reduction, treats AI as a muse, not an oracle. Immediate wins involve integrating a large-language model (LLM) workflow into SIEM/SOAR (like Google Security Operations) to automate context gathering and SOC triage. Within six months, automate threat intelligence ingestion into prioritized summaries (using platforms that natively extract IOCs and generate rules), and map the top five manual processes into a knowledge-base agent from historical incident notes and SOPs.

The third domain, talent upleveling, aims to turn practitioners into AI builders. Within six months, provide a secure conversational AI assistant to translate plain English into SIEM queries, and use reclaimed time to run capture-the-flag exercises with LLM-generated, environment-specific red team scenarios. The strategic horizon (months 6–12) covers posture elevation and threat hunting. Deploy an AI agent to correlate vulnerability scanner output with internal architecture and threat intelligence for contextual prioritization. Use AI during design phase to model architectural threats, generating risk backlogs before code is written. For proactive hunting, have an AI advisor generate hypotheses aligned with MITRE ATT&CK, suggest log sources, and pivot investigations; eventually aim for a fully automated hunting agent. Continuous red team agents probe defenses and feed findings back into intelligence and playbooks.

The fifth domain, advanced governance and incident response, builds structural guardrails. Use an isolated agent preloaded with policy documents to check new proposals against regulatory frameworks like FedRAMP. Train an internal agent on historical IR tickets to act as an interactive guide during live incidents, providing adaptive containment steps. Integrate LLM-powered auditors into CI/CD pipelines as a mandatory security gate to catch AI-generated vulnerabilities. For collapsed exploit windows, deploy a continuous workflow to scan, patch, and monitor code, using solutions like Google AI Threat Defense to predict attack paths and deploy fixes at machine speed.

Chaudhary emphasizes starting with one quick win—such as automating alert triage or mapping top SOPs—to build organizational muscle memory. The roadmap combines custom internal workflows (e.g., Gemini Gems), commercial AI capabilities, and integration into existing security stacks, leveraging Google’s Gemini for Government (accredited at FedRAMP High and Impact Level 5) where applicable.