Charles Lyons-Burt 
As AI becomes more deeply embedded in government operations, agencies are working to capture its mission and efficiency benefits without compromising oversight, security or accountability. Alex Whitworth, director of sales at Carahsoft, sees cybersecurity as an especially important proving ground for that balance.
Whitworth spoke with ExecutiveBiz about changes in government risk tolerance around AI-enabled decision-making, the future of CMMC and why quantum sensing is an emerging technology worth watching.
ExecutiveBiz: What has changed in the last six months in terms of government risk tolerance around AI-enabled decision-making?
Alex Whitworth: From a government perspective, we are seeing a couple of things happen simultaneously: recognition that AI can deliver significant improvements in mission effectiveness and operational efficiency, along with increasing urgency around how to govern autonomous systems.
We’re seeing a lot of traction around that last point within our technology partner ecosystem. There’s been a big push toward more sophisticated AI security and governance capabilities to help organizations monitor AI behavior, control what agents are authorized to do and identify unexpected actions.
Dynamo AI is a company that I think is doing this particularly well. The U.S. Army selected Dynamo AI through a Small Business Innovation Research award to develop scalable AI risk management capabilities for mission-critical defense applications. Dynamo is developing capabilities that allow the Army to continuously evaluate AI model performance, monitor behavior, and implement real-time safeguards against risks like data leakage, hallucinations, and adversarial manipulation.
I think this reflects an important shift in government thinking: rather than limiting AI adoption because of the risks, agencies are investing in the tools and governance frameworks that allow them to manage those risks while accelerating innovation.
ExecutiveBiz: How do you think about trust, explainability and accountability when AI starts influencing operational outcomes?
Whitworth: We’re already seeing technologies that can help cybersecurity analysts correlate alerts, investigate suspicious activity, identify vulnerabilities and recommend remediation steps with very little human intervention. As these systems mature, they could potentially execute portions of incident response autonomously.
Organizations will need sophisticated models of human oversight to ensure the systems are working as expected. AI may be allowed to act autonomously on low-risk activities through established policies, but higher-risk actions will require human approval or be handed off to human operators.
There’s enormous potential here, though. For years, security operations centers have faced an overwhelming volume of alerts, increasingly sophisticated threats and a shortage of experienced cyber professionals. AI can help change that equation by allowing teams to focus their expertise where it matters most.
But organizations will only realize that value if they can understand how the technology reached a recommendation. They also need to define the boundaries of what AI is authorized to do and maintain clear accountability for its outputs.
ExecutiveBiz: Let’s talk about CMMC. What are you hearing? What’s your perspective on the initiative?
Whitworth: One of CMMC’s challenges has been the incredible diversity of the defense industrial base. It includes some of the largest technology and defense companies in the world, but also thousands of specialized manufacturers, small innovative startups and subcontractors.
The way CMMC was built works well for some of the very large defense prime contractors, but it has created significant costs and operational challenges for smaller players. It has a lot of requirements and requires a significant amount of effort, which can make it difficult for smaller organizations to achieve compliance.
The current CMMC rollout pause is an opportunity to streamline requirements, reduce unnecessary duplication, provide better clarity around expectations and make it easier for companies to demonstrate that they are secure. Hopefully, it also creates greater emphasis on automation and continuous security monitoring rather than turning CMMC into a paperwork compliance exercise.
Ultimately, Carahsoft remains supportive of CMMC’s fundamental objective, and we are optimistic that whatever program follows this pause will focus on meaningfully improving the security and resilience of the defense industrial base.
ExecutiveBiz: What’s one emerging technology that excites you that isn’t AI-related?
Whitworth: It’s hard to say, since AI is so deeply integrated into almost every emerging technology category that we work with. But if I had to choose one, I would say quantum sensing.
When most people hear the word “quantum,” they think about quantum computing and the prospect of computers capable of solving problems that are much harder to solve with traditional computing architectures. Quantum sensing is different, and its near-term impact may be greater.
Quantum sensors can measure physical properties such as magnetic fields, gravity, acceleration and even time with very high levels of precision. There are practical government applications, including navigation in environments where GPS is unavailable or disrupted. The military relies on GPS for positioning, navigation and timing, but those signals can be jammed or spoofed. Quantum sensing can provide an alternative navigation system that does not depend on satellite signals.
Quantum sensing is not fully separate from AI. In fact, it becomes even more powerful when paired with AI to interpret the incredibly complex data these sensors generate. But it is a great example of an exciting and emerging technology that is advancing very quickly on its own.
More information on the quantum and CMMC vendors in the Carahsoft ecosystem can be found here and here, respectively.
