IC Technology & Surveillance — 2026-05-06

CISA Deploys AI Automation to Accelerate Threat Analysis and Mission Support

CISA officials said Tuesday at the UiPath FUSION Public Sector event that AI automation has produced "by far" the largest gains in the agency's security operations unit, enabling faster threat triage. Tammy Barbour, acting chief of application management, told CyberScoop analysts can now conduct "real-time, quick looks before events happen" and focus on "what matters versus the noise." Lauren Wind, acting deputy chief technology officer, said the agency is also applying automation to HR, contracting, and finance to accelerate mission-support functions. Both officials cited adoption barriers including legacy workflows, systems requiring modernization, and staff reliance on spreadsheets, with Wind telling CyberScoop CISA is still "catching up to industry" on agentic AI governance.

Analysis
CISA's adoption of AI-automated threat triage reflects a broader IC pattern of pursuing machine-speed processing to manage alert volumes, but the agency is unlikely to publicly report measurable efficiency gains within 12 months given the IC's institutional aversion to publishing internal performance metrics on operational tools. The described use cases, pre-event situational awareness and noise reduction, suggest incremental workflow automation rather than a capability transformation, and the acknowledged barriers (legacy systems, spreadsheet dependence, governance gaps on agentic AI) indicate CISA remains in early-phase adoption where gains are real but difficult to quantify externally.

2 sources

CISA boasts AI automation improvements to threat analysis mission support - CyberScoop
CISA Reports AI Automation Boosts Threat Analysis - Let's Data Science