Federal agencies in the United States have established a more advanced cybersecurity posture compared to many private-sector companies, particularly in defending against threats posed by rogue artificial intelligence (AI) agents, according to a cybersecurity expert with extensive experience working alongside the government.

In recent years, the federal government has aggressively implemented a security framework known as zero-trust network access. This approach requires every device and user to verify their authorization continuously, preventing unauthorized lateral movement within a network. Such lateral movement—a common tactic for malware and malicious AI agents—allows attackers to escalate access and compromise sensitive data or systems. By segmenting networks and enforcing strict access controls on every connection, federal agencies aim to contain threats at the earliest stage, minimizing potential damage.

The Department of Defense, for example, is mandated to achieve full zero-trust integration by the end of fiscal year 2027. Agencies across the executive branch adhere to strict protocols regarding cybersecurity patching, software inventory management, and compliance reporting. Progress is closely monitored by the White House’s Office of Management and Budget, with budgets at risk if agencies fail to meet established targets. Additionally, future federal software procurement will require compatibility with segmented networks, effectively precluding adoption of software that could compromise zero-trust principles.

While private companies have begun adopting zero-trust models over the last several years, observers say many have halted progress due to concerns over operational disruptions and implementation costs. This pause comes even as the deployment of AI agents in corporate networks accelerates, potentially exposing businesses to increased risk of data breaches and system outages stemming from unchecked lateral movement within networks.

Despite the absence of mandatory federal regulations applying to the private sector, experts stress that companies have access to publicly available guidance from federal cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), and are encouraged to fortify their defenses proactively. They warn that failure to do so may lead to severe consequences if rogue AI agents cause widespread disruptions, with the private sector bearing significant responsibility alongside broader concerns about the technology itself.

Last month, President Donald Trump and leading artificial intelligence executives signed a voluntary agreement aimed at promoting industry self-regulation without imposing penalties for AI-related incidents. Critics argue that this approach leaves the industry to police itself inadequately, highlighting the crucial need for companies to invest in robust cybersecurity measures independent of government mandates.

The cybersecurity landscape surrounding AI presents novel challenges, but federal agencies’ zero-trust efforts demonstrate a pathway forward that private companies might well emulate to mitigate emerging risks.