The Department of the Air Force is increasingly dependent on software-defined capabilities that must be deployed, updated, and secured at a pace far exceeding traditional cybersecurity authorization processes. While DevSecOps practices have accelerated software development, many organizations continue to experience delays associated with cybersecurity documentation, control validation, artifact generation, and Authority to Operate (ATO) activities. The result is a growing gap between operational urgency and compliance-driven security processes.

This presentation explores how artificial intelligence can be applied to automate and augment key elements of the cyber authorization lifecycle. Drawing from the development and implementation of DryDock, an AI-enabled cyber assurance platform, attendees will examine practical approaches for transforming traditionally manual accreditation activities into automated, repeatable workflows. The discussion will demonstrate how large language models, retrieval-augmented generation, and structured cybersecurity knowledge repositories can support the generation of security documentation, mapping of controls to evidence, identification of compliance gaps, and continuous monitoring activities.

Special emphasis will be placed on enabling Continuous ATO (cATO) objectives, supporting DevSecOps pipelines, and reducing the burden on cybersecurity practitioners, system owners, and authorizing officials. Attendees will gain insights into how AI-enabled cyber assurance can improve consistency, increase visibility into system risk, and accelerate the delivery of mission-critical capabilities across both enterprise and operational environments.

The session will conclude with lessons learned from implementing AI-assisted authorization workflows and recommendations for organizations seeking to modernize cyber governance without sacrificing security rigor.

Key Takeaways

• Applying AI to automate cybersecurity documentation and evidence collection.
• Integrating cyber assurance activities directly into DevSecOps pipelines.
• Supporting cATO objectives through continuous monitoring and automated compliance validation.
• Reducing authorization timelines while maintaining accountability and risk transparency.
• Lessons learned from deploying AI-enabled cyber assurance capabilities within government environments.