Evaluating The Impact of AI-Powered Anomaly Detection On Reducing Cybersecurity Breaches in Government Systems

Abstract

Government systems have endured complex cyber attacks that have led to significant breaches with lasting consequences for national security (e.g., SolarWinds, MOVEit). Anomaly detection powered by AI promises novel threat detection and quicker response times, but in governmental contexts, the practical results hinge on the quality of telemetry, integration with current workflows of detection and incident response, model governance, and trust in the system by the operators. This paper analyzes and reviews the literature, develops a questionnaire to evaluate readiness and impact, consolidates three data tables that summarize the outcomes and reported barriers (n=120) documented by practitioners, and provides recommendations for the institutions aiming to implement AI anomaly detection on a massive scale. The major outcomes include the following: AI anomaly systems, if properly governed and instrumented, can significantly improve detection rates and the average time to detect and respond, but the greatest barriers to overcome are inadequate telemetry, insufficient governance on model lifecycle, and a lack of security for machine learning systems.