The Top 5 Insights for Government from SOF Week 2026

Posted on by Joe Tabatabaian

Defense leaders, industry innovators and policy experts converged at SOF Week 2026 with a shared urgency: the Special Operations Forces (SOF) enterprise is transforming to meet an era defined by overlapping threats, convergence and speed. From the Office of the Assistant Secretary of Defense (OASD) for Special Operations and Low-Intensity Conflict’s (SO/LIC) five-priority framework to discussions about an increasingly transparent battlespace, panels and keynotes showed an enterprise striving to modernize at the speed of relevance.

Across sessions, discussions highlighted the structural challenges facing the SOF community and the solutions emerging to address them, from autonomous systems and open source intelligence (OSINT) to acquisition reform and deeper operator-industry collaboration.

Five critical insights define the path forward for special operations amid intensifying power competition.

A Restructured SO/LIC Enterprise Is Organized Around Five Strategic Priorities

SO/LIC leadership articulated a clear vision for the SOF enterprise creating asymmetric advantages in multi-domain effects, so the joint force wins decisively across the conflict spectrum. Organized around five priorities—people, policies, pioneering, partnerships and prudence—the framework establishes a blueprint for how the enterprise will resource, evolve and operate. Central to this vision is empowering Theater Special Operations Commands (TSOCs) with the authorities, resources and decision-making space to synchronize operations and adapt to rapidly evolving theater conditions.

Acquisition reform is a defining enabler. SOF is positioned as the department-wide pathfinder for requirements and acquisition reform, using mechanisms such as Middle Tier Acquisition (MTA), other transaction authorities and commercial solution openings to field capabilities faster than traditional processes allow. The recently launched SOF Ventures initiative connects TSOCs, science and technology partners and interagency stakeholders with venture capital and private equity, positioning private investment as a direct force multiplier for national security priorities.

Though SOF comprises just three percent of the joint force and less than two percent of the Department’s budget, it delivers outsized strategic impact. Every investment must be evaluated against clear objectives, including whether capabilities are properly resourced, effectively employed and aligned with long-term readiness and lethality requirements for active-duty forces and their families. The Center for Special Operations Analysis Capability (C-SOAC) team will bring independent, data-driven analysis of force design and investment to support those decisions.

The Battlespace Has Become Fully Transparent and Adversaries Are Exploiting It

Tom Swetman, Vice President of Janes, outlined how ubiquitous commercial data collection has rendered the battlespace transparent in ways legacy operational security frameworks were never designed to address. Satellite imagery, mobile device telemetry, social media metadata and commercially available information (CAI) now provide adversaries a persistent, low-cost intelligence capability that rivals traditional collection methods. Every environment is a collection environment, and the volume and fidelity of available data means hiding in the noise is no longer viable.

Adversaries weaponize this environment through pattern-of-life and identity resolution, digital exhaust and metadata exploitation as well as pre-targeting individuals, families and supply chains. They treat OSINT as a formal discipline with dedicated methodology and resources, increasingly outpacing how U.S. forces integrate commercially available data into planning. Brandon Hough, Co-Founder of Anomaly Six, elaborated on the CAI layer, noting that procurement transparency requirements create a parallel vulnerability, enabling adversaries to map supply chains, identify critical suppliers and target the industrial base before a capability reaches deployment.

Mitigation requires moving OSINT and CAI analysis from the margins into core mission planning. Signature management and intelligence collection plans must be developed collaboratively and red-teamed against real-world data environments from the outset of pre-deployment planning. Artificial intelligence (AI)-enabled auditing tools that continuously monitor the digital footprint of deploying forces are becoming operational necessities rather than optional enhancements.

Agentic AI and Edge-Deployable Models Are Transforming Intelligence Delivery

Across sessions, a clear consensus emerged: open source, commercially available and sensor data now exceed what human analysts can synthesize without AI. Agentic AI platforms that autonomously ingest, prioritize and deliver risk intelligence are moving from concept to operational deployment. New platforms enable real-time forecasting and interdiction analysis from mobile device and Software Development Kit (SDK) data. Leaders described the transition toward agentic risk intelligence as a fundamental shift in how the intelligence community approaches the volume and diffuse nature of modern signals.

The practical insight centers on small language models (SLMs). Lightweight, hyper-tuned models deployable at the tactical edge—on vehicles, laptops or sensor platforms—compress the intelligence-to-action timeline without requiring connectivity to enterprise compute infrastructure. Panelists cited commercial platforms such as Snowflake, already used by defense partners for high-performance edge processing and operational environment modeling, as examples of commercial innovation outpacing Government-developed solutions. They called for those capabilities to be integrated into operational architectures rather than rebuilt from scratch.

The integration challenge is equally important as the technology itself. Open source and commercially available intelligence capabilities must be embedded in the planning cycle from the outset, not layered on top of existing intelligence, surveillance and reconnaissance (ISR) collection. Delivering contextual, filtered and mission-relevant information through a unified interface is the operational standard industry partners and program offices must work toward to achieve meaningful decision advantage.

Drone Dominance and Lethal Autonomy Define the Next Generation of SOF Lethality

The Department of War’s (DoW) drone dominance initiative, backed by $1.1 billion to procure 200,000 small drones by 2027, reflects how drones are reshaping future conflict. SOF is positioned to play a pivotal role as an end-user and the pathfinder for validating autonomous systems before scaling across the joint force. The U.S. Special Operations Command’s (USSOCOM) designation as the joint force provider to the Defense Autonomy Working Group (DAWG)—a department-wide effort to integrate autonomous systems that solve combatant command problems—institutionalizes this role and places SOF at the center of autonomy doctrine development.

Directed energy represents a complementary capability set. Leaders identified low-cost, small form factor laser systems and high-power microwave technologies as near-term priorities for counter-unmanned aerial system missions. With the underlying science largely proven, the remaining challenge is engineering systems with the cost, durability and range needed for distributed deployment across the force. The need to prioritize directed energy was established even before recent operational experience with drone swarms accelerated the timeline.

AI’s role in targeting was addressed directly across panels. Aggregating intelligence at scale and speed, deconflicting with allied forces and streaming data into decision cycles enables a level of precision and lethality that was previously unattainable. Building the kill chain of the future means treating AI as an organizing principle for integrating intelligence, fires and maneuver from the outset of system design and operational planning.

Closing the Industry-Operator Feedback Loop Accelerates Capability Delivery

Dual-use technology developers showcased emerging capabilities, from piezoelectric energy harvesting systems that extend unmanned underwater vehicle endurance to AI-powered automatic target recognition platforms that reduce analysis timelines from hours to minutes. These companies share the challenge of navigating the gap between demonstrated capability and funded programs. Moving from proof of concept to fielded system remains one of the defense acquisition ecosystem’s most persistent friction points.

Theater Edge Innovation Labs (TEILs) offer one structural response, moving problem-solving closer to the warfighter so industry partners can test and iterate against specific operational scenarios in days rather than months. The SOF enterprise extends this model into the private capital ecosystem, aligning venture and growth investment with urgent operational needs. Together with other rapid acquisition mechanisms, these initiatives are designed to keep the innovation pipeline flowing and compress the timeline from operator-identified gap to fielded solution.

The critical enabler is a robust, structured feedback loop, which panelists argued that talent is as important as technology in sustaining it. Reducing friction in that pipeline, particularly around clearance timelines and accreditation processes, was identified as a high-priority structural change. Operators who engage directly with industry during testing create valuable data assets that accelerate model development and product refinement. Recognizing operational test data as a strategic asset is among the most consequential investments SOF can make.

Pioneering the Path Forward for Special Operations

SOF Week 2026 reinforced that SOF is not simply integrating new technologies onto existing formations. It is rethinking how it recruits, equips, trains and fights as a technologically advanced and strategically agile force. The five priorities articulated by SO/LIC leadership, the intelligence challenges of a transparent battlespace, the emergence of edge-deployable AI, the acceleration of lethal autonomous systems and the deepening of industry-operator partnerships represent interconnected pillars of a coherent modernization strategy. Sustained success will depend on aligned authorities, cultural transformation around data and technologies that translate strategic intent into operational and tactical advantage.

As Carahsoft, The Trusted Government IT Solutions Provider®, continues supporting defense modernization, insights from SOF Week 2026 inform how industry can partner with SOF to deliver the capabilities required for operational advantage amid intensifying strategic competition.

Explore Carahsoft’s Defense Technology portfolio of leading solutions that support SOF modernization priorities, including AI, cybersecurity, autonomous systems and advanced analytics.

Contact the Defense Team at DOW@carahsoft.com to discuss how Carahsoft’s technology partners can support your mission.

4 ways AI agents change the way we approach Identity Security

Posted on by Ido Halevi

As if gaining visibility into all human and non-human identities wasn’t a big enough task for security teams, adding AI agents into the mix takes identity complexity to a new level. Organizations of all sizes are tackling this new reality, where it feels premature to confidently say they know about all the AI agents running in their environment.

That uncertainty is not a knowledge gap. It is an attack surface.

Gartner’s new report on IAM for AI agents names the real nugget of truth: “Purpose/intent cannot be discovered after the fact by monitoring and observability capabilities.”

That is not just analyst language. It is a fundamental shift in how we need to think about governing agents. You cannot govern agents by watching them after-the-fact. You must know who they are, what they are for, and who is accountable before they run.

The numbers that should change your priorities

Gartner’s data reinforces the urgency. By 2029, over 50% of successful attacks against AI agents will exploit access control weaknesses. By the year before, 90% of organizations that share credentials between humans and agents will need to make significant investments to undo that design.

Those numbers are consequences, not causes. The root cause is structural: IAM maturity for agents is uneven. The Gartner lifecycle maturity assessment makes this visible. Authentication and monitoring capabilities are relatively mature. Identity registration and authorization are not. That gap is the story.

Weak identity registration means the agent was never properly onboarded as an identity. No defined owner. No declared purpose. No documented scope. It has credentials and it is running, but nobody can tell you who built it, what it is supposed to do, or what happens when it breaks. When registration is weak, ownership is unclear. And when ownership is unclear, accountability does not exist.

Weak authorization means the agent has more access than it needs. It can reach databases, APIs, and workflows that have nothing to do with its intended function. Nobody scoped it down because nobody defined what “down” looks like. When authorization is weak, privilege is excessive.

Now combine excessive privilege with autonomy. An agent that can reason, chain tools, and act on its own, with more access than it should have, and no one clearly accountable for what it does. That is the exploitable attack surface. That is the chain revealed in Gartner’s data.

You cannot protect what you cannot see

Before you can govern agents, you need to find them. All of them. Not just the ones your platform team sanctioned. The ones that developers spun up to solve an issue. The ones contractors built. The ones that exist because someone needed to “just get this working.”

We hear this consistently from security teams. As one InfoSec manager at a professional services firm put it: “We do not find out about it until someone goes and does an actual audit of the system.”

Gartner’s assessment confirms it: identity registration is one of the least mature IAM capabilities for AI agents. Most organizations cannot answer the basics: What is this agent supposed to do? Who owns it? What happens when it breaks?

Discovery is not a checkbox. It is the foundation. Without it, every policy you write is based on assumptions, and assumptions do not survive first contact with autonomous agents operating at machine speed.

The identity registration gap

Most organizations are trying to govern agents with the wrong tools. They are monitoring. They are logging. But monitoring tells you what happened. Identity registration tells you what should happen. Authorization enforces the boundary between them.

If your governance model depends on catching problems after they occur, you are always going to be behind.

This is where many organizations reach for familiar tools. IGA platforms can help with registration and lifecycle management. IAM solutions like Okta or Entra ID can register agent identities. These are necessary steps. But they stop there. They can tell you an agent exists and who requested it. They cannot enforce anything at the moment that agent acts.

That is the gap: governance on paper versus enforcement in production.

Agents are identities, but not like any you have managed before

The way I read Gartner’s recommendations, there is a unifying thread: treat AI agents like you would treat any identity in your organization. They authenticate. They access resources. They act on behalf of someone. That is not a tool. That is an identity.

But agents are more complex than traditional identities. They are what we call composite identities. They combine the blast radius of service accounts with the unpredictability of human decision-making at machine speed.

Four reasons that make them different:

They act autonomously, unlike service accounts that execute predefined operations.
They may inherit human delegation, creating privilege escalation risk.
They may chain multiple machine identities in a single task.
They may operate across trust boundaries your IAM system was not designed to handle.

Think about how you onboard an employee. You do not give them admin access on day one. You define their role, their manager, their scope. You review their access as responsibilities change. Agents need that same lifecycle. But right now, most organizations are skipping straight to “give them credentials and hope for the best.”

What runtime enforcement actually looks like

Gartner calls out the authorization gap. But what does closing that gap look like in practice?

Even modern IAM systems, including conditional access and continuous evaluation, were designed primarily to evaluate who is signing in and what that identity is generally allowed to do. Agents introduce a different problem. They do not just sign in. They execute. They invoke tools dynamically. They operate across multiple identity contexts within a single task.

Traditional conditional access evaluates who is signing in and under what conditions. Agent governance must also evaluate what is being executed, at the moment of execution.

Here is what that looks like: an agent is about to call a tool, read from a database, trigger an API, or execute a workflow. Before that happens, there is a decision point. Runtime enforcement evaluates the composite identity: the human owner, the agent itself, the tool credentials, and the defined purpose, all at execution time. Is this agent authenticated? Does it have permission for this specific action? Is this behavior consistent with its intended function?

That is runtime enforcement. Not configuration-time policies that assume the agent will behave as designed. Decisions at execution time, every time.

What Silverfort does differently

If the failure pattern is identity immaturity, then the control point must also be identity. Most AI agent security approaches start at the model or application layer. We start at the identity layer. Because if identity is uncontrolled, everything above is fragile.

Human accountability by design

Every AI agent is explicitly tied to a real human owner in policy. Not informally. Not in documentation. In enforcement logic.

Every action can be traced back to a real chain of accountability: which human owns this agent, what identity the agent is operating under, and what credentials it uses to access resources. That is what we mean by composite identity. And it is what makes enforcement possible before monitoring even begins.

Runtime enforcement at the identity layer

Silverfort enforces at the identity decision point at runtime. For MCP-connected agents, that means sitting in line between the agent and the MCP server. For platform-native agents, enforcement is delivered through native integration, directly within the platform.

Before a tool call executes, we evaluate identity, context, delegation, and policy in real time. If the action exceeds scope, it does not execute. This is not configuration-time IAM. This is execution-time identity enforcement. That distinction matters.

Least privilege that survives autonomy

Static least privilege assumes predictable behavior. Agents break that assumption. They reason. They chain tools. They drift from what they were originally authorized to do. Least privilege must be validated at runtime, not just set at provisioning.

That means if an agent tries to access a resource outside its declared purpose, it gets blocked. If delegated privileges start expanding beyond what was originally scoped, they are contained. This is the same enforcement model we apply to humans and service accounts, now extended to AI agents.

One Identity Security Platform

AI Agent Security is not a standalone product. Agents sit at the intersection of human identities, non-human identities, service accounts, cloud resources, SaaS applications, and protocol layers like MCP. If those domains are secured separately, agents will exploit the seams.

Silverfort unifies this. One policy framework. One observability layer. One enforcement architecture. Across humans, machines, and AI. That is the architectural difference.

Enabling AI innovation without slowing it down

Security leaders are not trying to stop AI adoption. They are trying to make sure it does not outrun their ability to govern it. The organizations moving fastest with AI agents are the ones that figured out early: the right security model is a speed advantage, not a drag.

Cars have brakes so you can drive fast. The same principle applies here.

But, the brakes only work if they’re connected to the same system. Today, most organizations secure human identities in one tool, service accounts in another, and AI agents (if at all) in a third. If those domains are secured separately, agents will exploit the seams.

That’s the reason teams need a unified Identity Security Platform.

One policy framework means a CISO can define “no agent accesses production data without human approval” once and have it applied across every agent, every platform, every protocol. No per-tool configuration. No coverage gaps.
One observability layer means when an agent acts, you see the full chain: which human triggered it, which NHI it authenticated with, which tool it called, and what data it touched. Not three dashboards stitched together after the fact, but a single view that makes incident response possible in minutes instead of days.
One enforcement point means policy is applied at runtime, at the moment of action, not retroactively through quarterly access reviews. When an agent requests access, the decision happens inline. Allow, deny, or step up. Before the action executes, not after.

This is what shifts AI agent security from a governance exercise to an operational capability. Discovery tells you what exists. Registration tells you who owns it. Runtime enforcement tells agents what they’re actually allowed to do, in the moment, every time.

AI agents represent the next frontier of identity. Identity Security must evolve accordingly, from governance alone to continuous, runtime enforcement. Discover what is running. Register who owns it. Enforce at the moment of execution. That is the path.

The Gartner report is worth reading in full. : https://www.silverfort.com/landing-page/campaign/gartner-report-iam-for-agents/.

Want to learn how Silverfort discovers and protects AI agent identities? See AI agent Security in action.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Silverfort, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

This post originally appeared on Silverfort.com, and is re-published with permission.

Building a Security Strategy for Agentic AI: A Framework for State and Local Government

Posted on by Janet Worthington

As artificial intelligence (AI) evolves from simple chatbots to autonomous agents capable of making independent decisions, State and Local Government agencies face a fundamental shift in cybersecurity requirements. Recent research shows 59% of State and Local Government respondents report already using some form of generative AI (GenAI), with 55% planning to deploy AI agents for employee support within the next two years. Yet this rapid adoption brings unprecedented security challenges. Because AI agents are designed to pursue goals autonomously, even adapting when security measures block their path, Chief Information Security Officers (CISOs) responsible for safeguarding Government networks must rethink traditional defenses and embrace a new security paradigm.

The Emergence of Agentic AI and Its Unique Security Challenges

AI agents represent a significant departure from the GenAI tools many agencies currently use. While traditional Large Language Models (LLMs) respond to prompts and return information such as a support chatbot, AI agents and agentic systems are autonomous software programs that can plan, reflect, use tools, maintain memory and collaborate with other agents to achieve specific goals. These capabilities make them powerful productivity tools, but they also introduce failure modes that conventional software simply does not have. Unlike deterministic systems that crash when something goes wrong, AI agents can fail silently through collusion, context loss or corrupted cognitive states that propagate errors throughout connected systems. Research examining the real-world performance of AI agents found that single-term tasks had a 62% failure rate, with success rates dropping even further for multi-term scenarios.

When Veracode examined 100 LLMs performing programming tasks, these systems introduced risky security vulnerabilities 45% of the time. For State and Local agencies handling sensitive citizen data, managing critical infrastructure or supporting public safety operations, these error rates demand careful attention within robust security frameworks designed specifically for autonomous systems.

The New Security Paradigm: From Human-Centric to Agent-Inclusive Workforce Protection

AI agents, the newest coworker, amplify insider threats by combining human-like autonomy with capabilities that exceed human limitations. While employees work within bounded motivation and finite skills, AI agents possess boundless motivation to achieve goals, uncapped skills that continuously improve and infinite willpower, constrained only by computational capacity. They will not simply make a single attempt to access a file, get blocked due to a lack of permissions, get frustrated and go home for the day the way an employee might; they will persistently pursue objectives, potentially finding novel ways around security controls.

This transformation fundamentally changes the attack surface agencies must protect. Data breaches continue to impose significant financial and operational strain across the public sector, with many state and local organizations reporting cumulative annual costs that reach into the millions. AI agents and agentic systems collapse traditional security models by operating as autonomous workforce members who interact with systems, access data and make decisions without direct human oversight. They can be compromised through threats specific to agentic AI, such as goal and intent hijacking, memory poisoning, resource exhaustion or excessive agency that can lead to unauthorized actions, all in pursuit of achieving programmed objectives. For Government agencies managing limited security budgets while protecting essential citizen services, this exponential increase in potential attack vectors demands proactive frameworks rather than reactive responses.

The AEGIS Framework: A Six-Domain Approach to Securing Agentic AI

Forrester’s Agentic AI Enterprise Guardrails for Information Security (AEGIS) framework provides a comprehensive approach to helping CISOs in securing autonomous AI systems across six critical domains.

Governance, Risk and Compliance (GRC) establish oversight functions and continuous monitoring capabilities. Identity and Access Management (IAM) address the unique challenge of agent identities that combine characteristics of both machine and human identities. Data Security focuses on classifying data appropriately, implementing controls for agent memory and considering data enclaves and anonymization from privacy perspectives.

Application Security evaluates risks across the entire software development lifecycle (SDLC), implements Development, Security and Operations (DevSecOps) best practices, assesses the software supply chain and uses adversarial red team testing to validate safety and security controls. This domain focuses on embedding telemetry that gives security teams visibility into agent behavior and decision making. Threat Management ensures logs are accessible to security operations center analysts, enabling detection of behavioral anomalies and supporting forensic investigations. Zero Trust Architecture (ZTA) principles apply such as implementing network access layer controls for agent workloads, continuous validation of the agent’s runtime environment and monitoring of agent to agent communication.

Underlying the framework are three core principles:

Least Agency extends least privilege to focus on decisions and actions, ensuring agents have only the minimum set of permissions, capabilities, tools and decision making necessary to complete specific tasks.
Continuous Risk Management replaces periodic audits with ongoing evaluation of data, model and agent integrity.
Securing Intent requires organizations to understand whether agent actions are malicious or benign, intentional or unintentional, enabling proper investigation when failures occur.

Practical Implementation: Agent Onboarding and Governance

Forrester’s “Agent on a Page” concept provides a practical tool for providing structure, consistency and alignment of AI agents to business goals before activation, by outlining each agent’s owner, core purpose, operational context, knowledge base, specific tasks, functional alignment, tool access and cooperation patterns. This documentation gives business stakeholders clear success criteria, while security teams use it as a threat model and input into Forrester’s AEGIS framework to identify gaps in controls, missing guardrails, vulnerabilities and establish baselines to validate agent behavior against.

Similar to employee onboarding, agents require explicit programming on compliance frameworks, data privacy restrictions, scope of work and organizational norms. They must understand cooperation boundaries, operational context, knowledge sources and collaboration patterns. Agencies already deploying agents may have some of this documentation; those starting should collaborate between business owners and security teams to develop these frameworks.

Building a Secure Foundation for Autonomous AI

State and Local Government agencies stand at a critical inflection point. AI agents promise significant productivity gains across employee support, investigation assistance and first responder capabilities. Yet deploying these autonomous systems without appropriate security frameworks creates unacceptable risks for organizations managing citizen data and essential public services. The AEGIS framework provides a comprehensive approach to securing agentic AI before widespread deployment, enabling agencies to realize benefits while maintaining security postures that citizens expect.

Organizations should begin by reviewing the Forrester’s AEGIS framework to understand how it maps to existing compliance requirements such as NIST AI RMF, the EU AI Act and OWASP Top 10 for LLMs. Forming AI governance committees using AEGIS principles help establish organizational buy-in. Discovery processes identifying which departments are exploring AI agents enable targeted control implementation. Agencies that establish strong foundations now position themselves to adopt autonomous AI confidently and securely.

To explore the complete AEGIS framework and gain deeper insights into securing agentic AI for State and Local Government, watch Carahsoft’s full webinar featuring Forrester, “Full Throttle, Firm Control: Build Your Trust Strategy for Agentic AI.”

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Forrester, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

| Carahsoft

Tag Archives: Agentic AI