Balancing innovation and security in government technologies

Innovation and emerging technology in the private sector seem to be moving at warp speed, with new chatbots, automation and machine learning modules being introduced by big tech companies. But what about government?

It’s no secret that much of the legacy technology used by government agencies lags commercial sector in user experience. This isn’t due to an anti-innovation stance, but rather a need to meet heightened security thresholds.

This raises the question: How can government meet its users’ digital experience expectations without compromising the stringent security that safeguards the public’s information?

It’s critical for governments to balance innovation and security by collaborating with private industry on technology development, leveraging existing FedRAMP authorizations when possible, and instilling robust cybersecurity protocols.

Government should collaborate with private industry to develop technology

Innovation is necessary for government, especially amid the rapidly evolving technology landscape and digital-centric nature of today’s culture. The public wants a government service experience similar to their day-to-day interactions with commercial technology.

For instance, AI/ML has enabled commercial industries to personalize customer experiences with chatbots and virtual agents. Research shows that “71% of consumers expect companies to deliver personalized interactions.” This commercial market innovation aligns with administrative priorities to maximize efficiency without increasing administrative burden.

Government agencies could increase responsiveness and enable citizen self-service by leveraging similar technology to automate conversational responses based on frequently asked questions or interactions. What’s more, when done right — developed thoughtfully, with close coordination between agencies and their vendor partners — these solutions can be more secure than traditional alternatives.

By partnering with private industry to develop and provide input on modern capabilities like virtual agents, government can integrate secure, modern tools that align with citizen expectations.

Federal agencies should embrace what’s already secure

The government faces a unique predicament: Agencies charged with safeguarding the public’s personal information can’t sacrifice data protection in the pursuit of innovation.

In fact, citizen trust relies on that security, and that trust is in a particularly vulnerable state. According to a 2023 Pew Research Center survey, 71% of Americans are concerned about how the government uses their personal data, and 77% have “little to no understanding of what the government does with the data they collect about them.”

One way federal agencies can accelerate technology adoption while maintaining public trust is by strategically leveraging the authority to operate (ATO) process. An ATO is a formal declaration that a federal information system meets an acceptable level of risk, serving as a critical checkpoint for secure innovation.

Although the ATO process can be complex, agencies can streamline it by referencing previously issued ATOs from other departments as validation points. With the shift away from Joint Authorization Board-issued provisional ATOs under FedRAMP, each agency now bears full responsibility for its own authorization decisions. This decentralized model empowers agencies to innovate more rapidly — while still upholding rigorous security standards — by building on trusted assessments and fostering inter-agency collaboration.

For departments with multiple locations and dispersed workforces, ATOs enable a capability already being leveraged by one department or branch to be adopted across the entire organization. This has widespread benefits, such as decreasing adoption and implementation time and reducing silos and disparate processes.

While there may be exceptions for workflows dealing with sensitive information, agencies would benefit from adopting capabilities that streamline administrative functions and modernize digital services. For example, technologies that help increase awareness of benefit programs or facilitate enrollment should be uniform agencywide.

Instilling robust security protocols while modernizing

Striking the right balance between innovation and security remains a central challenge for federal agencies, but one that can ultimately enhance the citizen experience without compromising mission integrity. Many agencies are exploring ways to strengthen their cybersecurity posture while adopting modern technologies that improve service delivery.

Robust cybersecurity protocols, cross-agency threat intelligence sharing, and the thoughtful use of advanced technologies like artificial intelligence are among the approaches that have shown promise in helping agencies detect and prevent cyber threats more efficiently.

Given the scale of federal data — Data.gov alone hosts nearly 300,000 datasets from over 100 organizations — many agencies are taking proactive steps to safeguard sensitive information. Practices such as multi-factor authentication, encryption and regular security audits are commonly used to help mitigate risks and reinforce trust.

Existing frameworks and guidance, such as those provided by the Cybersecurity and Infrastructure Security Agency, continue to serve as valuable resources for agencies seeking to strengthen their security posture. When paired with ongoing workforce training, these tools can support a culture of cybersecurity awareness and resilience.

Collaboration also plays a key role. Agencies that share threat intelligence and insights into emerging vulnerabilities contribute to a more informed and agile federal cybersecurity ecosystem. This collective approach helps teams stay ahead of evolving threats.

For some, integrating advanced technologies — such as AI and machine learning — into cybersecurity operations has opened new opportunities. These tools can analyze large volumes of data to detect anomalies and patterns that may signal potential threats, offering an additional layer of defense in a rapidly changing digital landscape.

For government, a doable albeit ongoing challenge

The federal government faces the ongoing challenge of meeting citizens’ digital experience expectations without compromising the stringent security that safeguards the public’s information. The balancing act of modernizing while maintaining an elevated security posture requires a multi-faceted solution involving private-public sector collaboration, leveraging ATOs, and instilling agencywide cybersecurity measures.

Lenny Maly is chief information security officer at Granicus.