Government agencies are under mounting pressure to embrace AI, modernize technology systems and deliver more efficient digital services. However, aging infrastructure, limited budgets and persistent cybersecurity workforce shortages are challenging public sector tech professionals who are striving to comply with innovation mandates while preventing the introduction of new security risks to the environments they’re responsible for protecting.
This dilemma was the core theme at the 2026 Red Hat Government Symposium in Washington, D.C. in October, where public sector IT and cybersecurity leaders explored possible solutions to a growing gap between modernization expectations and operational realities. Moving too slowly risks leaving agencies dependent on vulnerable technology, while moving too quickly can introduce security weaknesses, expose sensitive information and create new attack surfaces adversaries can exploit.
David MacDonald, senior vice president at Red Hat, outlined the problem. “You’re being asked to deploy artificial intelligence really rapidly,” he told attendees. “At the very same time, the cyber threat landscape is dramatically expanding because of that same artificial intelligence, which is an interesting conundrum.”
MacDonald went on to explain the unique headwinds faced by technology leaders in government: “You’re probably also being asked to modernize legacy systems without impacting downtime, as well as delivering seamless digital experiences to millions of citizens simultaneously. And I suspect most of you are being asked to do these things with ever-tightening budgets.”
Modernization mandates meet legacy infrastructure
Legacy technology remains one of the most significant obstacles to government modernization. Agencies frequently depend on systems designed decades ago, often using programming languages and hardware and architectures that are increasingly difficult to integrate with current models. Replacing these systems is expensive, complicated and potentially disruptive to essential services.
A July 2025 Government Accountability Office report, Agencies Need to Plan for Modernizing Critical Decades-Old Legacy Systems, illustrates the scale of the problem. The report identified 11 critical legacy systems across 10 federal agencies. Eight used outdated programming languages, four had unsupported hardware or software, and seven had known cybersecurity vulnerabilities. Both of the Treasury Department’s identified systems, for example, relied on COBOL and low-level proprietary assembler routines.
The financial constraints are equally daunting. The federal government spends more than $100 billion annually on IT, with approximately 80% historically going toward operating and maintaining existing systems.
That leaves agencies with a difficult choice: either continue investing in infrastructure that may already pose security risks or divert resources to modernization projects that require substantial upfront investment. Neither option is particularly attractive when the systems involved support critical functions, such as tax processing, healthcare and national security.
AI adoption slowed by governance friction and talent shortages
While government agencies recognize the immense potential of generative AI and automation, rapid adoption is hamstrung by regulatory complexity and data privacy demands.
Navigating third-party model security, strict compliance mandates, and an intricate oversight structure — highlighted by a September 2025 GAO report that identified 94 distinct federal AI requirements and 10 executive oversight groups — creates severe operational friction for public sector teams attempting to deploy emerging tech at speed.
Compounding this technical burden is a chronic cybersecurity workforce gap. Government agencies struggle to match private-sector salaries and remote flexibility, leaving IT teams understaffed.
A GAO audit across five key federal departments in 2025 revealed widespread deficiencies in workforce planning, with every agency reporting persistent recruitment, retention or funding hurdles.
Balancing speed and safety
At the Red Hat Government Symposium, speakers emphasized that bridging this gap requires aligning rapid innovation with disciplined risk management. While frameworks like zero trust architecture, Executive Order 14028 and CISA performance goals offer baseline guidance, speakers noted that practical implementation still hinges on foundational infrastructure.
“In the public sector, when we talk about velocity, it’s really a combination of delivering capabilities — to the warfighter, to the citizen, to the public workforce — with a combination of speed and safety,” MacDonald said. “So, it’s driving innovation, but doing it in a safe and secure manner… and these expectations have never been higher.”
Rather than viewing modernization as a standalone project with a fixed finish line, symposium experts stressed that agency leaders must treat security as an ongoing process that requires continuous investment, risk assessment and adaptation.
“All of us probably would love to reach the point where we can have autonomous AI agents executing complex agency workloads,” MacDonald said. “That’s certainly the dream right now. But the reality is, before you can hand the wheel over to AI, you have to govern the systems that sit under those workloads.”
Richard Livingston is an editor for TechTarget Cybersecurity, covering news, trends and analysis. Livingston’s professional background includes editorial positions in the national defense industry covering the U.S. Army Medical Department, as well as offensive and defensive cyber strategy for military and government audiences.
