Loading story…
The U.S. Department of Energy (DOE) has identified significant gaps in its governance of artificial intelligence and cybersecurity, according to a new inspector general report. The report highlights a disconnect between the rapid deployment of emerging technologies and the department's ability to effectively oversee and manage associated risks. Auditors warn that without improved coordination and oversight, the DOE's increasing reliance on advanced digital systems could expose critical infrastructure to heightened operational and security threats, particularly from state-sponsored actors and criminal organizations targeting high-value assets.
A key concern is the DOE's highly decentralized security model, which complicates efforts to implement consistent cybersecurity and AI governance across its program offices, sites, and national laboratories. The report underscores the need for stronger, enterprisewide risk management to address these vulnerabilities and safeguard national security interests as the department continues to modernize its technology landscape.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
A new inspector general report identified gaps in AI governance, cybersecurity oversight, funding, and enterprise coordination as major management challenges for the Department of Energy in 2026. The report warned that decentralized security practices, outdated requirements at some sites and contractors, and weak centralized visibility increase risk to critical infrastructure.
The Department of Energy published an AI strategy and related AI compliance planning to guide expanding use of artificial intelligence in operations, energy systems, and national security. The inspector general report says governance development still lags behind DOE's pace of AI adoption.
Before the inspector general's 2026 risk warning, the Department of Energy had already launched an enterprise cybersecurity collaboration office as part of efforts to improve coordination across the department. The report says this step was not sufficient to resolve broader structural weaknesses.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. government is advancing multiple **critical infrastructure cybersecurity** initiatives focused on resilience, public-private coordination, and the secure adoption of **AI**. National Cyber Director Sean Cairncross said the administration wants AI to be **secure by design**, framing technical security as an enabler of innovation rather than a barrier. The approach includes closer collaboration with private industry, expanded threat-information sharing, federal support for offensive cyber operations, and new mechanisms for AI companies to coordinate on threat response while the administration revises earlier policies it views as constraining competitiveness. The Department of Energy is preparing to release its first cybersecurity strategic plan to strengthen defenses for the **power grid** and improve preparedness for cyber and physical incidents affecting the energy sector. That effort is expected to deepen coordination with private operators and evaluate AI investments that could help defend critical infrastructure against AI-enabled threats. A separate article on why attacks against critical national infrastructure are dangerous is **not about this same policy development**; it is a general explainer on infrastructure targeting and disruption rather than reporting on the U.S. government’s current AI and energy cybersecurity initiatives.
Jun 29, 2026
European IT and cybersecurity professionals are increasingly concerned about the rise of AI-driven cyber threats, with 51% expecting such threats and deepfakes to be a major worry in 2026. Many organizations admit they are not adequately prepared to manage the risks associated with generative AI, and few feel confident in their ability to secure these technologies. The majority of professionals identify AI-driven social engineering as the most significant cyber threat, with 59% highlighting it as a top concern. Insider threats, both intentional and accidental, are also seen as a growing risk in the context of AI adoption. Despite the transformative potential of AI, most organizations lack comprehensive hiring plans for digital trust roles such as audit, risk, and cybersecurity, which are essential for building resilience. Business continuity and resilience are prioritized, but there is a clear gap in staff training for both responsible AI use and response to AI-related threats. The rapid pace of AI development has outstripped the ability of many companies to update or establish effective AI governance policies. Only 36% of boards have adopted an AI governance framework, and even fewer have integrated AI oversight into their corporate strategies or board committee charters. Experts emphasize the urgent need for organizations to create or update AI governance and usage guidelines, especially if existing policies are more than a year old. The lack of robust data governance and a single source of truth is cited as a major barrier to successful AI implementation, with data security and governance being prerequisites for leveraging AI effectively. Despite significant investments in AI, only 5% of surveyed companies have achieved visible value across their organizations, and 60% have not realized substantial returns or cost savings. The thin line between using AI for defensive and offensive purposes is highlighted, as tools designed for security can be repurposed for attacks with minimal changes. Threat actors are leveraging AI to develop exploits faster than defenders can patch vulnerabilities, and AI-assisted attacks are becoming more prevalent. The need for up-to-date guidelines, staff training, and a strong governance framework is underscored as essential for mitigating the risks posed by AI-driven cyber threats. Organizations are urged to address these gaps proactively to ensure both the security and the business value of their AI initiatives.
Jul 12, 2026
Security researchers and industry experts are raising alarms about the growing use of artificial intelligence (AI) in both offensive and defensive cybersecurity operations. Attackers are leveraging AI to bypass advanced security controls, as demonstrated by a researcher who used AI to defeat an "AI-powered" web application firewall, and by the emergence of new malware that exploits AI model files and browser vulnerabilities to evade detection and exfiltrate credentials. Meanwhile, defenders are grappling with the proliferation of unsanctioned AI tools in the workplace, the challenge of auditing AI decision-making, and the surge in AI-powered bug hunting, which has led to a dramatic increase in vulnerability discoveries and bug bounty payouts. The risks are compounded by the lack of clear AI usage policies, the potential for data leaks through generative AI tools, and the difficulty in monitoring or controlling how sensitive information is processed and stored by these systems. Industry reports highlight that a significant portion of employees use unauthorized AI applications, often exposing sensitive data without IT oversight, and that prompt injection and model manipulation are now common vulnerability types. The security community is also debating the extent to which ransomware and other attacks are truly "AI-driven," with some reports criticized for overstating the role of AI in current threat activity. As organizations rush to adopt AI for efficiency and innovation, experts urge the implementation of robust governance, continuous monitoring, and red-teaming to anticipate and mitigate the evolving risks posed by both sanctioned and shadow AI systems. The rapid evolution of AI in cybersecurity is forcing a reevaluation of traditional defense models, emphasizing the need for transparency, operational oversight, and adaptive security strategies.
Jun 29, 2026