AI Is Moving Faster Than the Security Architecture Designed to Protect It

The challenge of integrating artificial intelligence into military readiness, NIPR, SIPR, and the information environments that tell us how our formations fight

Artificial intelligence has the potential to fundamentally change how the Department of

Defense processes information.

That opportunity is real.

So is the risk.

Recently, I listened to two separate companies discuss AI capabilities designed to compile and analyze readiness reporting from organizations such as the Joint Readiness

Training Center, National Training Center, and Observer Coach/Trainer organizations.

On the surface, the use case makes sense.

Combat Training Centers generate enormous amounts of information. Observations, trends, after-action reporting, lessons learned, readiness assessments, and operational data create an enormous analytical workload.

AI could help process that information faster.

It could identify recurring deficiencies.

It could connect observations across rotations.

It could help commanders understand trends that would otherwise take teams of

analysts significant time to identify.

But listening to these capabilities being discussed raised a much more important question:

Are we evaluating what AI can do faster than we are evaluating what connecting AI to this information could expose?

Because military information does not exist inside one clean security environment.

Information can begin at one sensitivity level, move through different systems and processes, become aggregated with other information, and ultimately contribute to products requiring significantly greater protection.

When artificial intelligence is introduced into that lifecycle, we need to reconsider what we are actually protecting.

Before We Discuss the Risk, We Need to Understand What AI Is Actually Doing

Artificial intelligence, machine learning, large language models, and quantum computing are increasingly discussed together. They are related areas of technological development, but they are not the same technology.

That distinction matters when evaluating security risk.

The large language models and generative AI systems being deployed today do not require quantum computing. They operate primarily on classical computing infrastructure, using GPUs and other specialized processors to perform enormous numbers of mathematical operations.

Machine learning refers to methods through which computational systems develop models from data. Deep learning uses artificial neural networks with many layers to identify increasingly complex relationships within that data. Large language models are one application of these methods.

But another distinction is even more important for military information security:

An AI system does not necessarily have to permanently learn information in order to analyze it.

Training Is Not the Same as Retrieval

During training, data is used to adjust the internal parameters, or weights, of a model.

During inference, a trained model processes information and generates an output.

Modern AI systems can also use Retrieval-Augmented Generation, commonly called RAG, to retrieve information from external repositories and provide it to a model as context.

This means an AI system could potentially analyze thousands of OC/T observations, after-action reports, readiness assessments, maintenance records, or other documents without incorporating those documents into the model's permanent training data.

The distinction is technically important.

From a security perspective, however, the risk does not disappear.

The model may still be capable of retrieving, comparing, correlating, summarizing, and drawing inferences across the information available to it.

That is precisely where AI changes the information-security problem.

The Risk Is Not Only What the AI Knows

Consider a hypothetical AI-enabled readiness system with authorized access to thousands of observations collected across multiple Combat Training Center rotations.

No individual document needs to state:

"These are the recurring vulnerabilities of U.S. Army formations."

The analytical system may potentially derive that understanding by correlating information involving:

• communications failures;

• electronic warfare;

• command and control;

• logistics;

• maintenance;

• sustainment;

• equipment performance;

• tactical decisions;

• and recurring training deficiencies.

The security question therefore cannot stop at:

What information did we provide to the AI?

We must also ask:

What new information can the AI derive from the relationships among everything we provided to it?

That distinction becomes especially important when evaluating information that originates at lower sensitivity levels but becomes increasingly revealing through aggregation and analysis.

And it leads directly to an existing national-security principle: classification by compilation.

AI Changes the Value of Aggregated Information

Consider a simplified Combat Training Center example.

One observation identifies a communications problem.

Another identifies a maintenance deficiency.

Another discusses an electronic warfare challenge.

Another documents a sustainment issue.

Another identifies a command-and-control problem.

Another describes how a unit responded to contact.

Another records how long a particular process took.

Individually, each piece of information has its own context and handling requirements.

Now give a sufficiently capable analytical system thousands of those observations across multiple units, rotations, years, equipment configurations, and operational environments.

The question changes.

It is no longer:

What does this report say?

It becomes:

What relationships exist across all of these reports?

That distinction is important because federal classification policy already recognizes the security implications of aggregation.

Executive Order 13526 establishes that compilations of individually unclassified information may themselves be classified when the compilation reveals an additional association or relationship that meets classification requirements and is not otherwise revealed by the individual pieces of information.

Artificial intelligence is exceptionally relevant to that concept because identifying relationships across large datasets is precisely what these systems are being built to do.

The information going into an AI system and the intelligence coming out of it may therefore present different security considerations.

AI Does Not Just Retrieve Information

This is where thinking of AI as an advanced search engine becomes dangerous.

Modern AI architectures can do considerably more than retrieve a document.

They can categorize information.

Compare observations.

Summarize thousands of records.

Identify correlations.

Recognize recurring patterns.

Generate new analytical conclusions.

And increasingly, AI systems can be connected to databases, document repositories,

APIs, enterprise applications, identity systems, and other digital infrastructure.

The model is only one component.

The complete AI environment may include:

Users → Identity → Application → Model → APIs → Data Repositories → External Services → Outputs → Logs

Every connection matters.

Every credential matters.

Every repository matters.

Every vendor dependency matters.

Every API matters.

And every additional interface potentially becomes part of the attack surface.

This Is Not a Hypothetical Cybersecurity Category

The Department of Defense is already acknowledging these risks.

The DoD CIO's July 2025 Artificial Intelligence Cybersecurity Risk Management Tailoring

Guide applies cybersecurity risk management across the acquisition, development, use, sustainment, monitoring, and disposal of DoD AI systems.

It specifically states that AI systems must still be assessed and authorized and that security must be appropriate for the classification level at which the AI system is intended to operate.

More importantly, DoD recognizes that AI introduces security considerations beyond traditional software.

AI systems can be targeted through their data.

Their models.

Their software supply chains.

Their infrastructure.

Their interfaces.

And their underlying commercial components.

The security problem is no longer simply protecting the server.

It is protecting the entire AI lifecycle.

The AI System Itself Can Be Attacked

This is one of the least understood parts of the AI conversation.

Machine learning introduces attack techniques that do not look exactly like traditional cyber intrusions.

NIST categorizes these threats under Adversarial Machine Learning.

Its current framework addresses attacks including poisoning, evasion, privacy attacks, and misuse attacks against AI systems.

Data poisoning is particularly important.

An adversary who can manipulate information used during training or other parts of the

AI lifecycle may be able to influence how the system behaves.

Attackers can also target models and components used to build AI systems.

NIST specifically recognizes Trojan functionality and attacks against pretrained models as part of the threat environment.

This means the concern is not simply:

Can someone break into the AI system?

We must also ask:

Can someone manipulate what the AI learns, sees, trusts, retrieves, or produces?

Those are fundamentally different security problems.

AI Can Also Become Part of the Path to the Data

There is another risk.

If an AI system is connected to operational information, it must be given some mechanism to retrieve that information.

That may involve service accounts.

Credentials.

APIs.

Databases.

Document repositories.

Cloud services.

Retrieval systems.

Or other infrastructure.

Compromising the AI environment could therefore potentially expose more than the model itself.

The concern is not that installing AI automatically creates a secret tunnel into NIPR or SIPR.

That would be an inaccurate characterization.

The concern is that an improperly architected AI integration can introduce additional pathways into an information ecosystem.

And the Department's own AI cybersecurity guidance recognizes threats involving inference interfaces, access controls, model extraction, injection, data manipulation, supply-chain compromise, and information exfiltration.

That distinction matters.

AI does not inherently create a backdoor.

But AI can expand the attack surface around extraordinarily valuable information.

Now Apply That Problem to Military Readiness

This is where the risk becomes strategic.

Think about what an AI system analyzing Combat Training Center information could eventually understand.

Not simply whether one brigade performed well during one rotation.

Across enough information, it could potentially identify recurring trends involving:

• command and control;

• tactical decision-making;

• communications;

• electronic warfare;

• logistics;

• maintenance;

• sustainment;

• medical operations;

• equipment performance;

• interoperability;

• training deficiencies;

• and readiness.

Those insights would be extremely valuable to American commanders.

That is the purpose of building the capability.

Now reverse the perspective.

What would that same analytical environment be worth to a near-peer adversary?

An adversary would not necessarily need to steal thousands of individual readiness reports and manually understand them.

Compromise of an environment specifically designed to organize, correlate, and analyze those reports could potentially provide something much more useful:

an analytical map of recurring weaknesses across American formations.

That should change how we think about the value of the system being protected.

The Dataset May Become More Sensitive Than Any Individual Record

Traditional information-security discussions frequently begin with the classification of the source information.

AI forces us to ask another question:

What can be inferred from the collection?

That is especially important when information moves through different stages of the readiness-reporting process.

An observation may begin relatively low in the information lifecycle.

It may later be combined with other observations.

Those observations may become trends.

Trends may contribute to assessments.

Assessments may inform readiness conclusions.

And some resulting information may ultimately require processing or protection within a classified environment.

AI accelerates that transformation because correlation is exactly what machine learning is good at.

The security architecture therefore cannot only evaluate what enters the system.

It must evaluate what the system is capable of producing.

NIPR and SIPR Make This an Architecture Problem

This becomes considerably more complicated when information crosses security environments.

NIPR and SIPR exist for fundamentally different security purposes.

The solution cannot be allowing an AI system to freely reach between them because doing so makes analysis easier.

Security boundaries exist for a reason.

Cross-domain information movement requires deliberate controls.

That means an AI system designed to support a workflow spanning multiple security domains needs an architecture capable of preserving those boundaries.

We need to know:

Where does the model operate?

Where does the data reside?

Where does processing occur?

What information can the model retrieve?

What identity is used to retrieve it?

What gets retained?

What gets logged?

Who can administer the system?

Can the vendor access any component?

What external dependencies exist?

How are model updates introduced?

How are outputs reviewed?

What happens when aggregation changes the sensitivity of an output?

And how does information move between security domains?

These questions should be answered before operational data is introduced.

Not after.

We Need to Reverse the AI Acquisition Conversation

Too many technology conversations begin with:

What can the product do?

For military AI, that should not be the first question.

A better sequence is:

1. MISSION

What military problem are we attempting to solve?

2. DATA

What information is required to solve it?

Where does that information originate?

Who owns it?

3. CLASSIFICATION AND AGGREGATION

What is the current sensitivity of the information?

What could become apparent when the information is aggregated?

Could the resulting analysis require greater protection?

4. ARCHITECTURE

Where will the model, data, applications, and supporting infrastructure operate?

5. ACCESS

Who can access each component?

What privileges does the AI system itself possess?

6. SUPPLY CHAIN

What vendors, models, libraries, APIs, cloud services, hardware, and software dependencies are involved?

7. ADVERSARIAL AI SECURITY

Can the data be poisoned?

Can the model be manipulated?

Can prompts or retrieved information alter system behavior?

Can information be inferred or extracted?

8. CROSS-DOMAIN SECURITY

If the mission requires information from different security environments, how is authorized information movement controlled?

9. CONTINUOUS MONITORING

How do we detect changes in the model, data, infrastructure, access patterns, and threat environment after deployment?

10. CAPABILITY

Only after answering those questions should we determine which AI capability belongs inside the architecture.

The sequence matters.

Security architecture should define the environment in which AI operates. AI capability should not define the security architecture after the fact.

We Also Need to Think Beyond Today's Computing Environment

Quantum computing should not be confused with current large language models.

But it belongs in the broader strategic conversation.

Military information can retain intelligence value for years.

Computational capabilities will continue improving.

Machine learning will improve.

Data correlation will improve.

And future quantum capabilities create separate concerns, particularly around cryptography and the long-term protection of sensitive information.

This means security decisions made today should not be based solely on what an adversary can extract from information today.

We also need to consider what increasingly capable computational systems may be able to derive from information collected now.

The information lifecycle may be longer than the technology lifecycle protecting it.

DoD Is Addressing the Problem, but Implementation Matters

The encouraging part is that the Department is not ignoring AI cybersecurity.

DoD has begun integrating AI-specific considerations into its existing Risk Management Framework.

NIST has established an increasingly mature taxonomy for adversarial machine learning.

Existing classification rules already recognize compilation risk.

Cross-domain systems remain subject to controlled security architectures.

AI systems still require authorization appropriate to their operating environment.

Those are important foundations.

But guidance alone does not secure an operational system.

Implementation does.

And AI is moving extraordinarily quickly.

Commercial companies are developing capabilities faster.

Commands are looking for ways to reduce analytical workloads.

Leaders want better information.

Warfighters want capabilities now.

That pressure is understandable.

But speed creates its own risk when architecture, classification, acquisition, cybersecurity, and operational requirements are solved independently.

The Question We Should Be Asking

The question is not whether the Department of Defense should use artificial intelligence to analyze military readiness.

It should.

The potential operational value is significant.

The question is whether we are building the security architecture necessary to use that capability without simultaneously creating an intelligence opportunity for our adversaries.

Because the same system capable of telling an American commander:

"Here are the recurring vulnerabilities across our formations."

could contain exactly the information a sophisticated adversary wants to understand.

That does not make AI the enemy.

It makes preparation essential.

Before connecting AI to the information that tells us how our formations train, operate, adapt, and fail, we need to understand the entire ecosystem we are creating.

The model.

The data.

The classification lifecycle.

The aggregation.

The identity architecture.

The APIs.

The vendor supply chain.

The network.

The outputs.

And the adversary trying to reach all of them.

The next challenge in military AI is not simply building models capable of understanding how we fight.

It is ensuring our adversaries never gain access to the systems capable of explaining it to them.