Securing the AI flank to provide trusted decision-making capabilities

U.S. Air Force Airman Ethan Pollock, left, and Airman Ayrton Ben, 18th Communications Squadron cyber security technicians, add strategies to handle a compromised AI model at Kadena Air Base, Japan, Oct. 24, 2025. (U.S. Air Force photo by Senior Airman Jamal J. Berry II)

As artificial intelligence (AI) tools provide troops and commanders with more and better decision-making capabilities in the field, they must be kept secure to ensure they are providing the best possible information.

Breaking Defense spoke with Mandy Satterwhite, Managing Director and Cyber Lead at Accenture Federal Services, to explore how operational cyber resilience and trustworthy AI are protecting warfighters and the national security enterprise under adversarial pressure.

Breaking Defense: AI promises to accelerate decision-making across the battlespace, but in high-consequence military operations, speed is useless without trust. What does “trustworthy AI” look like when every second counts on the frontline?

Mandy Satterwhite, Managing Director and Cyber Lead at Accenture Federal Services

Satterwhite: Trust isn’t an abstract ethical debate — it’s a non-negotiable operational requirement. In the heat of battle, if an AI system relies on poisoned data, yields an unexplainable result, or silently fails behind the scenes, it doesn’t give you an advantage; it creates unacceptable operational risk.

To work for the warfighter, an AI system must be predictable, verifiable, explainable, and resilient under adversarial attack. When command-and-control systems synthesize options for a decision-maker, that leader must know with absolute certainty that those recommendations are built on authoritative, untampered data under our control. If you can’t trace data provenance or explain how the conclusion was derived, you can’t act on it in combat because lives are at stake.

You mentioned data provenance. How much of AI security is a supply chain problem, especially when defense leaders look to use commercial foundation models?

There are very real supply chain challenges to consider. When you take a commercial frontier model off the shelf and fine-tune it, you inherit the data and potential vulnerabilities with it. If the foundational model was compromised or trained on poisoned data, you’re importing that risk straight into your secure environment.

Another consideration that we’re talking with clients about: the larger (and expensive) frontier models often aren’t necessary for specialized military capabilities. Right-sizing the model for specific mission use cases and auditing the building blocks — from data sources to model weights — is essential. We’ve seen adversaries attempt to manipulate model weight files directly to skew outputs. If you don’t control and verify the digital supply chain from end to end, you are building on shaky ground.

Traditionally, cybersecurity compliance meant running a periodic penetration test or going through a pre-deployment checklist. Does that approach still work when applied to AI systems?

Frontier models like Mythos have completely collapsed the cyber-attack timeline. That means periodic testing is dead. Adversaries are constantly probing for vulnerabilities, from prompt jailbreaks designed to exfiltrate sensitive data to sophisticated weight manipulation. We can no longer secure our systems with just a quarterly pen test.

Cyber defense has to move to continuous, automated validation, similar to the concept of “fight fire with fire.” We need to embed AI-enabled red-teaming and vulnerability scanning directly into our continuous integration and continuous delivery (CI/CD) software pipelines. As we develop code, models, and agentic workflows, automated security tools continuously simulate real‑world attack scenarios, enabling us to validate the system harness, operational scaffolding, and model behavior simultaneously.

For the national security ecosystem, we build these pipelines with NIST’s Open Security Controls Assessment Language (OSCAL) embedded directly into the build process. We check against strict security controls in real-time, ensuring systems are truly “secure by design” before they ever touch an operational boundary.

There’s a common perception in defense acquisition that adding layers of cybersecurity inherently slows down operations. How do you balance rigorous security with the need for speed?

The idea that security and speed are mutually exclusive is the biggest misconception in the industry. When security is treated as an afterthought or a final inspection at the end of a multi-year development cycle, yes, it halts progress and causes massive delays.

But when you bake security directly into the architecture from day one, security becomes an accelerator. By continuously validating posture while you build, you eliminate costly late-stage redesigns and accredit systems faster. Designing securely on the front end is what allows you to deploy and pivot at operational speed without fighting blind.

As these automated systems become more capable, how do you preserve human authority without throttling the speed advantage that AI provides?

Our philosophy is anchored in design for augmentation, rather than total automation. AI is built to expand human ingenuity, not replace warfighter judgment.

In sensitive warfighting environments, keeping a human decision-maker in the lead is paramount. That means engineering explicit architectural guardrails, OODA-loop feedback checkpoints, and hard kill switches directly into the system architecture. An AI model can rapidly process unstructured sensor data and surface three actionable courses of action, but a human operator must evaluate those verified choices at a deliberate checkpoint before execution. That structure buys down risk, protects mission integrity, and ensures command authority remains exactly where it belongs.

2025年10月24日，在日本嘉手纳空军基地，美国空军第18通信中队网络安全技术人员伊桑·波洛克（左）和艾尔顿·本正在制定应对受损人工智能模型的策略。（美国空军高级飞行员贾马尔·J·贝里二世摄）

随着人工智能 (AI) 工具为部队和指挥官提供更多更好的战场决策能力，必须确保其安全，以保证其提供最佳信息。

Breaking Defense 采访了埃森哲联邦服务公司董事总经理兼网络安全主管 Mandy Satterwhite，探讨了作战网络弹性和可信赖的人工智能如何在敌对压力下保护作战人员和国家安全机构。

突破性国防：人工智能有望加速战场决策，但在高风险的军事行动中，没有信任，速度毫无意义。在分秒必争的前线，“可信赖的人工智能”究竟是什么样子？

曼迪·萨特怀特，埃森哲联邦服务公司董事总经理兼网络安全主管

萨特怀特：信任并非抽象的伦理辩论，而是不容商榷的实战要求。在激烈的战斗中，如果人工智能系统依赖于被污染的数据、产生无法解释的结果，或者在后台悄无声息地出现故障，它不仅不会给你带来优势，反而会造成不可接受的实战风险。

为了更好地服务于作战人员，人工智能系统必须具备可预测性、可验证性、可解释性，并且能够在对抗性攻击下保持韧性。当指挥控制系统为决策者综合分析各种方案时，决策者必须绝对确信这些建议是基于权威、未经篡改且在我们掌控之下的数据。如果无法追溯数据来源或解释结论的推导过程，就无法在战斗中据此采取行动，因为这关乎生命。

您提到了数据溯源。人工智能安全在多大程度上属于供应链问题？尤其是在国防领导者寻求使用商业基础模型的情况下？

供应链中确实存在一些不容忽视的挑战。当你直接采用现成的商业前沿模型并进行微调时，你同时也继承了其中的数据和潜在漏洞。如果基础模型已被攻破或使用恶意数据训练，那么你实际上是将这种风险直接引入到你的安全环境中。

我们正在与客户探讨的另一个问题是：对于某些特定的军事能力而言，大型（且昂贵）的前沿模型往往并非必要。根据具体任务用例调整模型规模，并对构建模块（从数据源到模型权重）进行审核至关重要。我们已经看到敌方试图直接篡改模型权重文件以扭曲输出结果。如果您不能对端到端的数字供应链进行控制和验证，那么您的体系就如同建立在不稳固的基础之上。

传统上，网络安全合规意味着定期进行渗透测试或执行部署前检查清单。这种方法应用于人工智能系统时是否仍然有效？

像 Mythos 这样的前沿模型已经彻底颠覆了网络攻击的时间线。这意味着定期测试已经过时了。攻击者会不断地探测漏洞，从旨在窃取敏感数据的快速越狱到复杂的权重操纵，无所不用其极。我们再也不能仅仅依靠季度渗透测试来保护系统安全了。

网络防御必须转向持续的自动化验证，类似于“以毒攻毒”的理念。我们需要将人工智能驱动的红队演练和漏洞扫描直接嵌入到持续集成和持续交付 (CI/CD) 软件流水线中。在开发代码、模型和智能体工作流的过程中，自动化安全工具会持续模拟真实世界的攻击场景，使我们能够同时验证系统框架、运行架构和模型行为。

对于国家安全生态系统，我们采用美国国家标准与技术研究院 (NIST) 的开放安全控制评估语言 (OSCAL) 构建这些管道，并将 OSCAL 直接嵌入到构建过程中。我们会实时检查严格的安全控制措施，确保系统在投入运行之前真正做到“从设计之初就安全”。

在国防采购领域，人们普遍认为增加网络安全层级必然会减慢作战速度。如何在严格的安全保障和速度需求之间取得平衡？

认为安全性和速度不可兼得是业内最大的误解。如果将安全性视为事后考虑或多年开发周期结束时的最终检查，那么确实会阻碍进度并造成严重延误。

但是，如果从一开始就将安全性直接融入架构，安全性就能成为加速器。通过在构建过程中持续验证安全态势，可以避免后期代价高昂的重新设计，并更快地获得系统认证。在前端进行安全设计，才能让您以运营速度进行部署和调整，而无需盲目摸索。

随着这些自动化系统变得越来越强大，如何在不削弱人工智能带来的速度优势的情况下维护人类的权威？

我们的理念根植于增强型设计，而非完全自动化。人工智能旨在拓展人类的创造力，而非取代作战人员的判断力。

在敏感的作战环境中，确保由人主导决策至关重要。这意味着需要在系统架构中直接设计明确的架构护栏、OODA循环反馈检查点和强制终止开关。人工智能模型可以快速处理非结构化传感器数据并提出三种可行的行动方案，但必须由操作员在预先设定的检查点对这些已验证的选择进行评估后才能执行。这种机制能够降低风险，保障任务完整性，并确保指挥权始终掌握在真正需要的人手中。