How cloud, AI and cybersecurity work hand in hand to protect government systems, data

This is the third article in our series AI at the Inflection Point — articles and podcasts from Google Cloud Next ’25 that detail how Google Public Sector partners with government to bring the best of AI and security to the mission.

Cybersecurity. Cloud. Artificial intelligence. The interdependencies of these three technologies is helping public sector agencies anticipate and defend against new and ever more lurid threats to their sensitive data and to their operations.

Agencies are addressing their increasing need for cloud and AI capabilities by adopting accredited commercial clouds. This move provides them with the latest technology essential for advanced AI, while also helping them achieve parity with high cybersecurity standards and tactics, such as zero trust.

Cybersecurity at the nexus of information and operational technology

Take New York City, for example. Chief Technology Officer Matthew Fraser said the city clocks 90 billion cyber events against the city’s systems every week. Speaking at Google Cloud Next’25, Fraser said the interconnectedness between information and operational technology (OT) makes cyber particularly challenging.

By OT, Fraser means the systems controlling and regulating NYC utilities like water, construction and the city’s various transportation modes.

“Between IT and OT, OT has been left behind. We’re spending a lot of time updating OT,” Fraser said. Using Google Cloud Dataflow pipelines, the staff now brings together information from a million endpoints and puts events in context.

“We see events across the ecosystem to understand if something is a trend or just an anomaly,” he said.

Meanwhile on the zero trust front, Fraser said the mass issuance of smartphones to police officers spurred the city to pursue zero trust. To illustrate the strength of the city’s zero trust framework, he said that if an officer drops a phone in Times Square, for instance, it poses no security risk because anyone retrieving it is unable to access any city systems or obtain any data.

The city also uses Google Threat Intelligence to better understand and assess the cyber landscape. Fraser said that when a nationwide software supply chain cyber event occurred, the platform “caught it quick enough for us to contain any damage and prevent critical outages,” Fraser said.

Preparing against future cyberthreats

On the opposite side of the country, California is leaning into AI capabilities to help it more proactively protect the state’s systems from cyberattacks. The state’s Cybersecurity Integration Center, launched after an infamous cyberattack on Sony Corporation PlayStations in 2011, has long helped thwart would be attackers. But keeping pace with the number of increasingly complex threats is challenging, said Maria Lipana, chief of the center’s Cyber Threat Intelligence Branch.

The center’s “main task is anticipating the next catastrophic threat,” she said. But even with an experienced team of 25 analysts monitoring to protect the state, the work can be overwhelming, Lipana said. To augment her team, the center uses ThreatSpace Cyber Range, a virtual test capability that Google offers through its acquisition of Mandiant.

“We train the people in our integration center,” Lipana said. “With ThreatSpace, people at all levels can work in the same exercise environment.”

Plus, there’s a Mandiant analyst who also supports the center’s team. She shared that the analyst helped pull together information necessary to brief the governor about a North Korean threat situation. “My analyst has been a major coordinator in multiagency planning,” Lipana added.

Building cyber resilience with AI for DoD operational readiness

For military organizations, continuously monitoring networks augments regularly scheduled scans and inspections. Artificial intelligence can help turn data gathered through monitoring into useful intelligence for anticipating adverse events and maintaining resiliency, said Brig. Gen. Reid Novotny, director of intelligence and cyber effects operations for the National Guard Bureau.

Novotny said that while the bureau performs its inspections under DoD’s Cyber Operational Readiness Assessment initiative, “we also want a 24-hour continuous cycle.”

He pointed to network activity sensors at the perimeter of the Defense Department, “with AI applied to detect advanced persistent threats” as one application of the continuous monitoring idea.

Using AI to manage cyber for research datasets

Protecting personally identifiable information data is critical to protect user privacy in compliance with strict laws and regulations. Several use cases at Next ’25 demonstrated how to carefully handle data both when training large language models and when managing data used by the models.

Take medical research, for instance. It will benefit from AI that can help detect trends and new insights from large volumes of patient data, but that’s the very data that requires special privacy protections, said Ai2 CEO Ali Farhadi. The nonprofit is a Google partner doing deep research into fully open models. Ai2 developers are at work on ways to make secure use of PII for medical studies.

The essential challenge, Farhadi said, is how to train models with multiple datasets, some of which have privacy or other national security strictures. The aim is to ensure that models doesn’t divulge or leak any sensitive data.

Eventually, he said, Ai2’s research will result in an open-private model that can be trained in a modular way. Farhadi compared medical data researchers to fashion designers — they both share the same passion for privacy in protecting designs still under development.

The continued coupling of cloud and AI to both help government organizations foster strong cyber and privacy protections as well as help thwart would-be attackers was a common thread across the presentations and demonstrations at Next ’25. Although the specific use cases varied as did the missions, there was a consistent desire to tap into AI to help government teams cull through data efficiently, understand potential threats and continuously adapt their protective measures to reduce threat exposure.

Discover more articles and podcasts now from Google Cloud Next ’25 that detail how government agencies partner with Google Public Sector to solve real-world challenges.