CIS Launches OpenAI Pilot to Test AI Cyber Defense for Local Governments

The Center for Internet Security has started a pilot with OpenAI to test whether AI can help public-sector cyber teams find and prioritize security problems faster. The promise is targeted at organizations facing complex threats and tight resources; the evidence the program is meant to produce is still ahead.

A trial across uneven defenses

The AI Cyber Defense Pilot brings together U.S. state, local, tribal and territorial governments and critical-infrastructure organizations, including members of the MS-ISAC community. CIS says the group will include organizations of different sizes, regions and levels of cybersecurity maturity, making this a test across very different operating conditions rather than a deployment to one uniform customer base.

Participants will use OpenAI technology to identify, validate and prioritize security findings; support remediation; and advance cyber hygiene and other security practices. Put simply, the pilot centers on identifying potential weaknesses, deciding their priority, and supporting remediation.

Turning findings into useful work

Those gaps explain the appeal of tools that can sift through potential risks. A city or county office may have a single IT or security employee handling daily tasks and projects, CIS member-programs manager Tyler Scarlotta told StateScoop. That leaves limited time to formalize security practices, even before a new AI workflow is added.

CIS frames the pilot as a way to learn where AI can improve decision-making and speed response while helping teams focus on the risks that matter most. That is an aspiration, not a reported performance result. The important practical question is whether the technology can make limited staff more effective without creating a new stream of findings that those same staff must sort through.

Guidance is part of the product

The initiative is not limited to the participating organizations. CIS says it will produce implementation guidance, lessons learned and recommendations intended to inform later adoption of AI-powered cybersecurity capabilities in public-sector and critical-infrastructure settings. That makes the pilot’s eventual output as consequential as its software use: smaller governments need a workable path for applying results, not merely evidence that a tool can perform a task.

The experiment also arrives after the Cybersecurity and Infrastructure Security Agency ended its cooperative agreement with CIS for MS-ISAC the previous year, according to StateScoop, and shifted toward grants, free tools and direct assistance. Against that backdrop, the pilot is a concrete attempt to extend defensive capacity—but it has not yet established which AI uses will prove reliable, scalable or worth the operational effort.