GAO cyber chief eyes workforce investments as watchdog does more with less

Cyber resilience in the age of artificial intelligence and increasingly sophisticated threats will require ongoing investments into agency workforces, a Government Accountability Office tech official said Tuesday.

Jennifer Franks, acting chief technology officer and director of the GAO’s Center for Enhanced Cybersecurity, made the case during a panel discussion that “upskilling” is especially important for agencies amid a proliferation of AI agents and the risks that could come with them.

At the GAO specifically, Franks said “continuously investing in our staff and our resources” will help ensure that the congressional watchdog is able to maintain its oversight mission and protect its audit evidence.

“You’re going to hear a lot about AI literacy, but just emerging tech in general is going to continue evolving and changing,” Franks said during the virtual Rubrik Public Sector Summit, produced by FedScoop. 

“And we need people to be flexible and adaptable in this space,” she continued, “so that they can help us to do the investigations and make the sound decisions and communicate clearly when the organizational boundaries are not as clear. We need those people to be knowledgeable to just help us in this space.”

The GAO has weathered a stormy second Trump administration, with the White House rebuffing the watchdog’s opinion on pocket recissions and impoundment control, and agencies stonewalling various investigative efforts. 

The nonpartisan, independent agency has also been hit hard by departures in its IT unit, a development that Franks acknowledged during a March event. 

“We’re continuing to push forward on modernizing our internal IT environment to better support our staff so that we can deliver work for Congress and meet performance goals,” Franks told FedScoop at the time. “These efforts haven’t stopped just because resources are tight—it has just required us to be more thoughtful and strategic in how we move and prioritize.”

The GAO cyber leader nodded again to that dynamic Tuesday, echoing another panelist’s comments that with regard to AI, agencies may not always “have a human in the loop.” 

“We don’t even have all of the resources that we used to have,” Franks said. “So, in some ways, we have to work with less, but do more.” 

For the cybersecurity and IT staffers that remain at the GAO, doing more means doubling down on identity so that applications can be quickly restored in the event of an attack. It also means making sure stronger access controls are “a real priority” so services and sensitive data can get “back up in a timely fashion,” she said.

“We are serving the mission of Congress, and if the service disruption happens, the ability to conduct analysis and then even communicate with Congress and the agency to review can be hampered, and that can cost some dollars,” Franks said. 

With new vulnerabilities constantly popping up and a mandate to modernize legacy systems, the GAO can’t help but move quickly while navigating its staffing constraints and an often hostile administration. For Franks and her team, the GAO remains focused on serving Congress and making its services “a little bit more dependable.” 

“We’re just here to help. That’s it,” she said. “We’re not the bad guys.”