Government agencies are largely misjudging their level of AI governance as the technology permeates their organization, according to Racing to Deploy: How Public Sector AI Adoption is Moving Faster Than the Foundations Needed to Support It, a new report from SolarWinds.
Behind the Governance Curve
According to the report, many agencies are overestimating their level of AI governance. While approximately 9 in 10 IT leaders say governance is on pace with or ahead of AI adoption, only 10% have the three pillars necessary to ensure safe and effective AI deployment. Those pillars include:
- A formal, enforced framework
- Consistent employee adherence
- AI-specific security policies
Employee adherence and AI-specific security policies are specific areas in which public sector IT teams are falling behind. 47% of respondents say they monitor employee use of AI tools, but the monitoring is inconsistent. Inconsistent monitoring can become a breeding ground for shadow AI use, data leakage, and unvetted third-party risk.
This risk exists while public sector IT leaders acknowledge gaps in security for AI-powered work. According to the data, 44% of respondents reported AI-related security incidents rising year-over-year, and 10% aren't tracking incident volume at all. Furthermore, while security and compliance concerns ranked as the No. 1 blocker to AI adoption, respondents said they deliberately loosen security controls so AI-powered work can move faster.
"Confidence in AI governance is running well ahead of the actual controls agencies have in place, and that gap is where risk quietly accumulates,” said Travis Galloway, Senior Advisor, Government Affairs at SolarWinds. “Closing it isn't about slowing AI adoption down — it's about giving agencies the visibility and enforcement tools to govern with the same confidence they already claim to have. That's the problem we are working to solve with them every day."
Gaps in Supporting Operational Resilience Amidst a Growing Workforce
This governance gap isn't isolated to AI. Similar blind spots persist across operational visibility and cybersecurity resilience more broadly, even as public sector agencies invest more heavily in their IT and security teams than ever before.
Operational resilience continues to hold extreme importance for public sector IT teams, as extended system outages carry with them major consequences for public infrastructure. IT leaders acknowledged a shortfall in visibility, a core tenet in building this resilience. Less than half (48%) of respondents with OT in their environments say it's fully integrated with their IT monitoring, a critical infrastructure blind spot with direct implications for ransomware and outage risk in water, power, and transit systems.
Zero Trust, a best practice for IT teams looking to build resilient systems, also represents a deficit for public sector IT leaders. About 1 in 3 (36%) of IT leaders say they have zero trust in place across most of their environment, but there are gaps. Simultaneously, lack of skilled staff and complexity of implementation each account for 40% of the biggest barriers to Zero Trust adoption.
That skills gap persists even as public sector IT teams grow. The majority of teams have increased headcount (53%) and budgets (58%), driven largely by cybersecurity priorities (64%) and rising AI adoption (47%). Yet this investment has not fully closed the gap in specialized AI and security expertise needed to operationalize practices like Zero Trust, underscoring that funding alone isn't solving the governance and skills shortfall.
As AI adoption accelerates across the public sector, closing the gap between perceived and actual governance, not simply adding headcount or budget, will determine whether agencies can innovate safely without compromising the systems the public depends on.
Methodology: SolarWinds surveyed more than 800+ public sector IT pros from the US and UK.
