According to a survey conducted by research firm UserEvidence on behalf of observability and IT management vendor SolarWinds, public-sector enthusiasm for artificial intelligence is significantly outrunning the administrative guardrails meant to keep it secure. Released in late September 2026 under the title Racing to Deploy: How Public Sector AI Adoption is Moving Faster Than the Foundations Needed to Support It, the report surveyed more than 800 public-sector IT practitioners and leaders across the United States and the United Kingdom. The central takeaway for enterprise administrators and cybersecurity teams is a stark disconnect between executive optimism and operational reality: government agencies are deploying tools like Microsoft Copilot, ChatGPT, and Google Gemini faster than they can enforce zero-trust architectures, observability, or basic compliance policies.
The Confidence-Control Chasm
The most striking finding in the UserEvidence and SolarWinds research is the gap between perceived readiness and documented governance. In reporting by Smart Cities Dive, nearly 80% of surveyed public-sector IT leaders claimed their organization's AI adoption aligns with their oversight planning—a figure SolarWinds characterizes in its own press materials as approximately nine in 10 IT leaders believing their governance is on pace with or ahead of deployment.
When you look under the hood at the concrete controls respondents reported, that optimism quickly evaporates:
- Formal, Enforced Frameworks (All Respondents): Only 37% of the total U.S. and U.K. sample reported having a formal, actively enforced AI governance framework in place.
- The Three Pillars of Governance: SolarWinds evaluated respondents against three baseline requirements: a formal and enforced framework, consistent employee adherence, and AI-specific security policies. Only 10% of surveyed organizations actually had all three pillars in place.
- U.S. Public Sector Breakdown: Across U.S. public-sector respondents specifically, SolarWinds' report data shows 40% claim a formal AI governance framework.
- State and Local Lag: The governance deficit is sharpest at the municipal and state levels. Smart Cities Dive notes that just 19% of state and local government IT professionals reported having an active AI oversight framework, and only 20% said any such framework exists at all.
Travis Galloway, Senior Advisor for Government Affairs at SolarWinds, summarized the operational hazard in the company's announcement, noting that confidence in AI governance is running well ahead of actual agency controls, creating a gap where risk quietly accumulates.
To be fair, industry watchers should read these numbers with an eye on the source. SolarWinds is in the business of selling observability and IT management software, and its campaign materials directly pitch self-hosted observability tools to solve these exact visibility deficits. Commissioned surveys naturally spotlight the pain points a vendor's portfolio addresses. Even so, the SolarWinds findings echo broader industry research. Earlier in 2026, Smart Cities Dive reported on a Gallup poll showing that while 43% of public-sector employees used AI at least a few times a year, fewer than 40% said their organization had a clear AI strategy. Similarly, a February 2026 Euna Solutions survey reported by Smart Cities Dive found that 57% of public-sector respondents cited privacy and security concerns as their top roadblock to AI adoption, closely followed by a lack of clear state and federal guidance at 48%.
Section Summary: While 80% to 90% of surveyed public-sector IT leaders feel their AI oversight is keeping pace with adoption, only 37% enforce a formal governance framework, and a mere 10% combine that framework with AI-specific security policies and consistent employee compliance.
What Agencies Are Deploying: Copilot, ChatGPT, and Agentic AI
Despite the lack of formal rulebooks, public-sector IT shops are not sitting on their hands. Fewer than 40% of respondents in the UserEvidence survey described AI use as "widespread" inside their organizations today, yet exploration is nearly universal—only 5% said no AI tools are currently in use or in the planning stages.
When agencies do roll out AI, familiar enterprise productivity and IT management tools lead the pack:
| AI Tool Category | Reported Use or Piloting Share | Notable Context from Survey |
|---|---|---|
| Generative AI Assistants | 77% | Includes tools such as Microsoft Copilot, OpenAI ChatGPT, and Google Gemini |
| AI-Assisted Cybersecurity | Over 50% | Deployed to assist security operations and threat detection |
| AI-Assisted IT Monitoring / Alerting | 49% | Used for network and infrastructure alerting workflows |
| AI-Assisted ITSM / Help Desk | 46% | Applied to internal ticketing and IT service management |
| Agentic AI Tools | 35% | Systems capable of taking autonomous actions without human input |
For Windows and Microsoft 365 administrators, that 77% generative AI figure—coupled with the 35% piloting or using autonomous agentic AI—is where the rubber meets the road. Deploying Microsoft Copilot or third-party generative assistants inside a government tenant isn't just a matter of assigning licenses. If data loss prevention (DLP) policies, sensitivity labels, and role-based access controls aren't configured beforehand, an AI assistant will dutifully summarize whatever over-permissioned SharePoint folders or network shares a user already has technical access to view. Throw autonomous agents into the mix without strict identity and API governance, and an agency risks automated workflows modifying records or exfiltrating sensitive resident data before a human operator notices.
Adoption posture also splits sharply by government tier. According to the survey figures reported by Smart Cities Dive, 32% of federal government IT leaders say they are "aggressively pursuing" AI adoption, compared to just 12% of state and local IT professionals. State and local teams largely prefer a slower lane: 68% described their approach as "methodical," 17% called it "hesitant," and 4% remained "skeptical."
Section Summary: Generative AI platforms like Microsoft Copilot, ChatGPT, and Google Gemini dominate public-sector trials at 77%, while more than a third of respondents are already experimenting with autonomous agentic AI.
Lowering the Shields: Security Incidents and loosened Controls
Here is the question that should keep public-sector CISOs awake at night: if security and compliance are the number-one stated barrier to AI adoption, why are agencies actively weakening their defenses to let AI in?
According to the survey data reported by Smart Cities Dive, 35% of all respondents admitted they are loosening security or compliance restrictions specifically to enable AI access. Looking at SolarWinds' U.S.-specific report metrics, 37% of U.S. public-sector respondents reported loosening previously strict security restrictions to allow AI use. That relaxation of standards is happening right as threat volume climbs:
- Rising AI Security Incidents: SolarWinds reports that 44% of respondents (described as nearly 45% in Smart Cities Dive's coverage) saw an increase in AI-related security incidents over the past year.
- Blind Spots in Incident Tracking: Another 10% of respondents admitted they are not tracking AI-related incident volume at all.
- Inconsistent Employee Monitoring: While 47% of respondents said they monitor employee use of AI tools, SolarWinds notes that this monitoring is inconsistent, leaving agencies vulnerable to "shadow AI," accidental data leakage, and unvetted third-party risks.
- Observability Deficits: On its U.S. readiness report page, SolarWinds highlights that only 42% of respondents monitor AI behavior, even though teams express high confidence in their broader network observability. Across the full survey, Smart Cities Dive notes that fewer than 40% have fully integrated AI tools into their standard monitoring operations.
The infrastructure foundations meant to contain a breach are similarly unfinished. Among U.S. respondents, only 24% have fully implemented a Zero Trust architecture. Across the broader sample of IT leaders, 36% say Zero Trust is "mostly" implemented across their environment, though gaps remain. Respondents pointed to a lack of skilled staff (40%) and implementation complexity (40%) as the top barriers holding back Zero Trust—even though 53% of teams reported increased headcount and 58% reported bigger budgets, driven largely by cybersecurity priorities (64%) and AI adoption (47%).
For agencies managing physical infrastructure, the visibility gap extends beyond office networks. SolarWinds reports that fewer than half (48%) of respondents with operational technology (OT) environments have fully integrated their OT with their IT monitoring—a blind spot the vendor warns could expose water, power, and transit systems to ransomware or extended outages.
Section Summary: Over a third of surveyed public-sector IT teams are loosening security restrictions to speed up AI rollouts, even as 44% report year-over-year increases in AI-related security incidents and fewer than a quarter of U.S. agencies have fully implemented Zero Trust.
How Enterprise and Government Admins Can Close the Gap
Whether you manage a municipal Windows domain, a federal agency tenant, or a private-sector enterprise facing the exact same executive pressure to "just turn AI on," optimism is not a security control. Translating high-level governance confidence into verifiable technical enforcement comes down to a few practical administrative steps:
- Audit the "Three Pillars" Before Expanding Licenses: Take a cue from the 90% of surveyed agencies falling short of SolarWinds' three-pillar benchmark. Before moving a generative AI pilot into production, verify that you have a written and executive-backed acceptable use policy, technical guardrails enforcing employee adherence, and AI-specific security policies governing what data can be fed into prompts.
- Stop Issuing Blank-Check Security Waivers: If roughly a third of agencies are loosening compliance rules to get AI working, they are accumulating massive technical and security debt. Instead of bypassing conditional access or firewall rules to accommodate an AI tool, require vendors and internal deployments to operate within existing Zero Trust boundaries and least-privilege access models.
- Bring Shadow AI and Agentic Workflows Into Standard Monitoring: With fewer than 40% of surveyed organizations integrating AI into standard monitoring operations, IT teams cannot secure what they cannot see. Route AI API calls, Copilot audit logs, and SaaS traffic through your existing SIEM and observability pipelines so anomalous queries and unauthorized browser extensions trigger standard security alerts.
- Wall Off Operational Technology (OT): For municipalities and utilities where OT/IT integration sits below 50%, ensure that experimental generative or agentic AI tools have zero unmonitored pathways into critical infrastructure control networks.
Section Summary: IT administrators can counter premature AI rollouts by refusing broad security exemptions, integrating AI audit logs into standard SIEM monitoring, and enforcing least-privilege data access before enabling generative or agentic tools.