State health agencies are under increasing pressure to adopt AI quickly. The real risk is not moving too slowly; it is building AI on foundations that were never designed for trust, scale, or accountability. Across states, promising pilots stall because data is fragmented, governance exists outside the system, and interoperability is treated as a one-off integration exercise rather than an architectural discipline. AI does not hide these gaps; it exposes them.

The agencies that succeed with AI will do so not by chasing tools, but by modernizing the data and interoperability layers that make AI viable in the first place.

FHIR® and TEFCA Signal a Structural Shift

FHIR® and TEFCA are often framed as regulatory milestones. In practice, they represent a structural change in how health data is expected to move across ecosystems.

FHIR® establishes shared semantics for structured, versioned, and meaningful data across clinical, administrative, and population health contexts. TEFCA adds the trust framework, defining how organizations exchange data at scale, under consistent rules, with accountability built in.

ASSYST’s work supporting national interoperability initiatives, including ONC’s Interoperability Standards Advisory and conformance testing for electronic prescribing and Real-Time Prescription Benefit, demonstrates how these standards operate in real environments. These platforms enable providers, payers, pharmacies, and Health IT vendors to exchange data reliably and in real time, strengthening the foundation for nationwide interoperability.

For AI, this matters. Models cannot reason across systems if meaning, provenance, and access rules change at every boundary. AI does not replace interoperability; it depends on it.

Architecture Is the Real AI Strategy

AI forces a new architecture conversation. Modernization is no longer about replacing systems one by one; it is about designing platforms where data, policy, analytics, and operations are aligned from the start.

• Next-generation health architectures share common traits
• FHIR®-native data layers instead of downstream normalization
• Embedded governance, lineage, and consent enforcement
• Reusable data products shared across programs
• Analytics and AI operate on the same governed foundation.

ASSYST’s Hephaestus platform reflects this architectural approach. Informed by interoperability and regulatory programs, Hephaestus treats interoperability, governance, and analytics as first-class capabilities. Rather than adding AI on top of brittle integrations, it enables AI to operate on trusted, standardized data that already meets policy and compliance expectations.

AI Is Changing Interoperability and Data Dissemination

AI is reshaping how health data is consumed. Leaders increasingly expect natural-language access to governed data, contextual insights delivered inside workflows, predictive and prescriptive signals rather than static reports, and transparency into how conclusions are reached.

This raises the bar for data dissemination. Governance cannot live solely in documentation or review boards; it must be enforced at runtime. Data quality, access controls, lineage, and auditability become operational requirements as AI begins to influence decisions across care delivery, public health surveillance, and program integrity.

ASSYST’s experience integrating AI into interoperability, cybersecurity, and data platforms across CMS, FDA, CDC, and HRSA demonstrates how this can be done responsibly, with AI augmenting human judgment while remaining explainable and defensible.

Why ASSYST’s Federal Experience Matters to States

Federal health programs operate at a national scale, under continuous oversight, and in accordance with evolving standards. Systems supporting Medicare, Medicaid, public health surveillance, regulatory submissions, and prescription services must function across organizations, withstand audits, and adapt as policy changes.

ASSYST’s decades of experience in these environments provide state health agencies with something increasingly valuable: proven architectural patterns under real scrutiny. From FHIR®-based interoperability and TEFCA aligned exchange to electronic prescribing, Real-Time Prescription Benefit enablement, and AI-driven data operations, this experience helps states move faster with confidence and less risk.

It also helps Health IT leaders ask the right questions early, before AI investments become costly to unwind.

Build the Rails First

AI will transform state health programs, but only if it is built on data that is interoperable, governed, and trusted by design. The winning strategy is not faster experimentation; it is intentional architecture.

Build the rails, align to standards, embed governance. Then let AI move fast, responsibly, transparently, and in service of better outcomes.

ASSYST Healthcare IT

ASSYST is a trusted Health IT Systems Integrator with over 30 years of experience advancing public health and regulatory missions. We deliver secure cloud modernization, AI-infused automation, and interoperable data platforms that enhance care delivery and operational resilience. Our solutions apply AI and analytics to prevent fraud, waste, and abuse, ensuring integrity, efficiency, and trust across the nation’s healthcare ecosystem. 

ASSYST Hephaestus is a FHIR-native Application Platform as a Service (aPaaS) evolved from the Green Accelerator Program, enabling healthcare organizations to modernize legacy data into the latest HL7® FHIR® standards. It delivers an end-to-end, microservices-based interoperability stack—FHIRSpy, FHIRBricks, FHIRProof, FHIRWire, FHIRBI, and FHIRBreak—to automate data ingestion, mapping, validation, exchange, and analytics across the healthcare ecosystem.

How Developer Experience Has Changed and Why Phoenix Redefines It

Over the course of my career, I’ve built platforms across very different eras of enterprise software, from early data collection systems, to large-scale financial analytics platforms, to modern mission applications operating under strict security and compliance constraints.

• Each generation solved critical problems of its time.

• Every generation revealed a persistent truth that never truly changed.

• Developer experience was never designed as a system.

• Today, AI-enabled software engineering finally gives us the opportunity to change that.

When Platforms Worked, but Engineering Paid the Price

Early enterprise systems prioritized correctness, throughput, and reliability. Architecture was designed manually. Requirements were interpreted by hand. Code patterns were reused informally. Security and compliance were validated later in the lifecycle.

• Those systems worked, but they were fragile.

• Productivity depended on individual expertise. Knowledge was tribal. Technical debt accumulated quietly and later surfaced as operational risk.

• Planning tools like Jira existed, but they were largely administrative. Requirements lived in Jira. Architecture lived in documents. Code lived in repositories. Compliance lived somewhere else entirely.

• This separation was manageable on a small scale. At enterprise scale, it became a primary source of delivery friction.

 Automation Improved Speed but Not Engineering Flow

DevOps, CI/CD, and infrastructure automation dramatically improved deployment speed and operational reliability. AIOps later helped organizations manage runtime complexity through telemetry and prediction.

• Yet engineering flow remained fragmented.

• Developers still manually translate Jira stories into architecture. Security findings still appeared late. Compliance evidence still had to be reconstructed. Teams spent more time coordinating than building.

• The issue wasn’t tooling.

• The issue was that intent was never directly connected to execution.

AI Changes the Unit of Engineering Work

AI-enabled software engineering changes the unit of work from isolated tasks to end-to-end intent realization.

• AI should not operate as a standalone code generator. It must participate in planning, design, implementation, security, and governance.

• Requirements become structured inputs.

• Architecture becomes a generated artifact.

• Code, tests, documentation, and compliance evidence are produced together.

• But this shift only matters if AI is embedded where work actually begins.

• That’s why Jira integration is not optional, it’s foundational.

 Jira Is the Inflection Point

Jira is where enterprise work starts. Epics, features, user stories, acceptance criteria, and priorities live there.

Historically, Jira tracked work. It didn’t drive engineering outcomes.

Phoenix changes that.

• By integrating directly with Jira, Phoenix transforms requirements into executable engineering intent. User stories generate architecture, code scaffolding, tests, and documentation. Traceability is automatically preserved from the backlog through deployment.

• This closes a decades old gap between planning and delivery.

• Jira becomes a living system of record for engineering intent, not just a reporting tool.

Enterprise “Vibe Coding” Requires Structure

The idea of developers working fluidly with AI, often called vibe coding, resonates because flow matters. Context switching is expensive.

But in enterprise and mission systems, unstructured flow creates risk.

Phoenix enables structured flow.

• Developers remain productive while the platform automates and enforces architecture, security, policy enforcement, and compliance. Speed increases not because rigor is removed but because rigor is encoded.

• This is enterprise grade AI assisted development done correctly.

 Phoenix, Powered by the ASSYST Green Accelerator

Phoenix is powered by the ASSYST Green Accelerator, which captures reusable patterns, automation frameworks, and AI-enabled workflows proven across real programs.

• What worked in time boxed innovation settings is made repeatable, governable, and scalable for enterprise delivery.

• Architecture generation, code production, security enforcement, compliance evidence, and telemetry are no longer ad hoc activities; they are system capabilities.

 How Phoenix Redefines Developer Experience

From a developer’s perspective, Phoenix removes friction across the lifecycle.

• Architecture no longer starts from a blank page.

• Security and compliance are continuous, not interruptions.

• Tests and documentation are generated during development, not after.

• Traceability is automatic. Explainability is preserved. Human oversight remains intact.

• Developer experience becomes predictable, supportive, and scalable.

From Projects to a Software Factory Model

AI-enabled software engineering only matters if outcomes improve.

With Phoenix, organizations see faster delivery with greater predictability, fewer upstream vulnerabilities introduced, reduced technical debt over time, and greater audit confidence without relying on heroics or tribal knowledge.

• AIOps helped organizations manage complexity after deployment.

• Phoenix enables them to engineer complexity out of systems before they exist.

• If your teams are already using AI to operate systems more effectively, the next step is to use AI to build systems more effectively.

Phoenix integrates AI directly into planning, engineering, and governance, starting where work begins and delivering outcomes that scale with mission demands.

If you would like to learn more about how Phoenix can reimagine developer experience (DevX), please reach out to us.

Every long-running modernization program eventually reaches a point where its tools no longer keep pace with the complexity of its mission. For ASSYST, that realization emerged through years of testing support across major HHS digital programs, where functional validation was reliable, yet the most impactful defects remained invisible to traditional toolchains. Slight misalignments, subtle layout instabilities, broken icons, awkward phrasing, inconsistent labels, and accessibility barriers, issues that undermine user experience, escaped even the most structured regression cycles. These were not failures of discipline or process; they were failures of perception, the kind that arise when human nuance intersects with rapid delivery pipelines. As applications grew in scale and sophistication, the surface experience became equally critical as the underlying business logic, revealing that quality required a new vocabulary rooted in context, cognition, and intelligent interpretation.

When Digital Complexity Requires Human Like Perception

The challenge was not that testers lacked capability; it was that the digital systems they supported had expanded beyond the scope of traditional testing methodologies to efficiently validate. With releases now shaped by microservices, evolving UI frameworks, responsive design, and multi-device usage patterns, the number of variables has exploded. Developers were spending more time chasing visual and textual inconsistencies than building new value. It became clear that the future of quality engineering would depend on systems that could interpret interfaces the way humans do: recognizing meaning, structure, and intent—not just verifying steps in a script. This insight catalyzed a shift in our engineering approach, pushing us to explore machine learning models for visual detection, OCR, and NLP pipelines for content accuracy, and image processing to quantify layout integrity. What emerged was a new mode of perception, blending human sensitivity with machine precision.

AI-Enabled Assurance as a Turning Point

Embedding AI into the testing lifecycle transformed everything. By training object-detection models to recognize defects and inconsistencies, leveraging OCR to extract text from dynamic interfaces, and applying NLP to analyze grammar and clarity, we began to identify quality gaps that manual testers and legacy tools routinely missed. Suddenly, visual defects became quantifiable, textual clarity became measurable, and accessibility gaps became traceable in real time. The solution delivered dramatic improvements, significant reductions in manual effort, major decreases in production defects, and a newfound ability for developers to focus on engineering rather than defect hunting. More importantly, it introduced a new paradigm: quality assurance could now be anticipatory rather than reactive. Testing could adapt to changing interfaces, learn continuously, and evolve with the product itself.

Accessibility Deadlines and Public Trust

This evolution could not be more relevant to the present moment. State and Local governments across the country now face imminent ADA Title II deadlines: April 2026 for large public entities and April 2027 for smaller jurisdictions, mandating WCAG 2.1 AA compliance for all public-facing websites and mobile applications. For many agencies, the scope is daunting: thousands of pages, years of accumulated content, diverse authors, and frequent design updates. Manual accessibility audits simply do not scale to the size and complexity of modern digital government. The smallest inconsistency in contrast, labeling, semantics, keyboard operability, or screen-reader navigation can put an agency out of compliance—and erode citizen trust. Our work at the federal level showed that the only workable path forward is continuous, AI-driven accessibility assurance integrated directly into the software delivery lifecycle. These deadlines are not far away, and the agencies that succeed will be those that modernize their testing philosophy, not just their tools.

From Lessons Learned to a New Assurance Ecosystem

As we refined our AI-driven testing approach at HHS, we discovered that the same challenges appeared across nearly every mission-driven program, regardless of size or domain. This realization helped shape a broader assurance strategy within ASSYST, one grounded in the belief that quality, accessibility, and experience cannot be separated. Over time, these capabilities were consolidated into Argus, our AI-powered assurance platform that unifies visual validation, content intelligence, accessibility monitoring, and DevSecOps integration into a single system. Yet Argus is not a product of the ADA rulemaking cycle or a response to compliance pressure; it is the natural evolution of everything we learned while supporting large-scale, high-stakes digital systems. It reflects a future where assurance is woven into the development process itself, continuously improving as systems evolve.

A Future Where Quality and Accessibility Converge

Looking ahead, the next generation of public digital services will not be defined merely by modernization initiatives or cloud migrations, but by the confidence they inspire and the inclusivity they guarantee. AI-assisted assurance will become a foundational capability for State, Local, and Federal agencies striving to deliver resilient, accessible, and equitable digital experiences. As deadlines approach, the real differentiator will not be who meets WCAG 2.1 AA on time, but who builds systems that remain compliant long after the mandates take effect. The agencies that embrace intelligence-driven quality engineering will deliver services that are not only functional and fast but also respectful, intuitive, and accessible to all. In that future, quality and accessibility are inseparable, and AI is the key to ensuring both.

https://www.youtube.com/watch?v=wN6iWyLCxtA

ASSYST, a trusted innovator in Cybersecurity, Cloud, and AI solutions for government, today announced the launch of Athena Agentic AI - https://www.assyst.net/athena-ai. 

This next generation platform empowers agencies to think, decide, and act faster through intelligent collaborative agents.

Athena is not a chatbot; it’s a context-aware ecosystem of interoperable AI agents that plan, reason, and collaborate across enterprise systems. Built on ASSYST’s Green Accelerator Framework, Athena enables teams to automate knowledge driven processes, strengthen compliance, and enhance decision intelligence, all within a secure and auditable environment.

“Athena reimagines how mission teams work with AI,” said Vinay Shirke, CIO at ASSYST. “It acts as an intelligent teammate, one that understands mission context, anticipates user needs, and works alongside people to accelerate outcomes responsibly.”

Unlike traditional AI models that operate in isolation, Athena uses the Model Context Protocol (MCP) to connect reasoning agents across structured and unstructured data sources. These agents, such as Planner, Validator, and Reporter, collaborate to interpret policies, summarize complex findings, and recommend next steps, bridging the gap between data and mission execution.

Designed for Trust and Transparency

Athena integrates seamlessly with enterprise systems and AI models, ensuring alignment with federal security, privacy, and interoperability standards. Its built-in explainability and role-based access controls uphold Human-Centered Design (HCD) and ethical AI principles, keeping human judgment at the center of every decision.

“The future belongs to mission ready AI systems that learn, adapt, and collaborate,” added Mr. Shirke. “Athena reflects our belief that AI should amplify human expertise, not replace it.”

About ASSYST

ASSYST is the one-point source for excellence in Cybersecurity, Cloud, DevSecOps, and AI, with over three decades of experience supporting 40+ Federal, State, and Local agencies. As the GSA Federal AI Hackathon First Place winner, ASSYST helps organizations innovate with AI, modernize securely, and intelligently. From continuous ATO automation to AI-driven data interoperability, ASSYST delivers technology that moves missions forward. Discover how to Win with ASSYST -  www.assyst.net/win-with-assyst 

“Leadership isn’t defined by technology alone; it’s defined by the courage to imagine something better and build toward it every day. Vinay embodies that courage.”- Shyama Mandal, CEO, ASSYST 
 

🟢 ASSYST is delighted to celebrate Vinay Shirke, CIO, as one of this year’s GOVTECH CONNECTS ACCELERATE 125 Honorees; a distinction honoring leaders who are reshaping the future of federal IT and driving measurable mission impact.

🔴 GovTech Connects is bringing together Federal, Military, and Industry Health IT leaders for a high-energy look at the next era of digital transformation. Expect bold ideas, Generative AI and hashtag#AgenticAI insights, and forward-thinking modernization priorities shaping 2026. The ACCELERATE 125 Health IT Awards will spotlight innovators driving real impact across hashtag#AI, hashtag#data, hashtag#cyber, hashtag#quantum, and hashtag#UX. It’s an afternoon to celebrate, connect, and accelerate what’s possible in government technology.

Date: Tuesday, December 9, 2025
Time: 2 – 5 pm EDT
Where: Carahsoft Innovation and Conference Center, 11493 Sunset Hills Road, Reston, VA 20190

Join us for an Unforgettable Celebration!

https://lnkd.in/gWxUvd63

The conversation in state and local IT has changed. Artificial Intelligence is no longer experimental; it’s operational. According to the National Association of State Chief Information Officers (NASCIO) 2025 State CIO Survey (https://www.nascio.org/resource-center/the-2025-state-cio-survey/), 90 percent of states are piloting AI projects, and 82 percent report employees already using generative AI tools. That momentum is redefining not only what governments do with data, but who they need to do it.

From Data Clerks to AI Catalysts

Over the past decade, job titles have mirrored technology’s evolution. Early digital programs relied on Data Entry Clerks, Database Administrators, and System Operators. As data volumes grew, we saw the rise of Data Analysts, Business Intelligence Specialists, and Visualization Developers who transformed spreadsheets into insights.

Today, the landscape looks very different: Data Engineers, Machine Learning Specialists, AI Model Developers, Data Governance Leads, and AI Solution Architects. Each new title signals a shift from task-based execution to mission-driven problem-solving. The professionals succeeding in this environment blend policy understanding, ethical awareness, and the curiosity to make AI serve people, not just processes.

From Tools to Transformation

When I first started building data teams, we hired for SQL, Python, and Power BI skills. Today, those are table stakes. The differentiator is mindset, professionals who connect how data serves citizens, not just systems.  NASCIO reports that only 4 percent of states rate their data governance as “very mature,” indicating the next frontier isn’t technology; it’s culture.  Agencies need people who can turn compliance checklists into integrated, insight driven programs.

Spotting Mindsets, Not Just Skillsets

The best candidates talk about outcomes, not outputs. They describe how a predictive model helped reduce emergency response time, how data integration improved equity in public housing programs, or how autonomous actions for permitting systems. That language reveals empathy, systems thinking, and purpose —qualities that set strong technicians apart from future AI leaders. Adaptability, curiosity, and mission focus consistently outlast any single tool or platform.

The Human–AI Partnership

Automation can accelerate analysis, but judgment remains uniquely human. Data professionals who understand both machine learning and accountability are now essential to every modernization effort. ASSYST teams pair deep technical expertise with Human-Centered Design to ensure every model and workflow supports transparency, explainability, and citizen trust. AI isn’t replacing humans, it’s amplifying their ability to make informed, ethical decisions at scale. Our AI solutions, such as Athena Agentic AI, Collab AI, and ComplySyncATO, take a human-centered approach and function as role-based productivity accelerators.

Building an AI-Ready Workforce

Technology investments succeed only when people can adapt them. That’s why our Green Accelerator Program develops data engineers, analysts, and architects into AI-ready professionals fluent in governance, compliance, and mission outcomes. When I connect candidates to these opportunities, I’m not just filling positions; I’m aligning purpose, innovation, and public impact. 

The Bottom Line

The NASCIO 2025 Survey confirms it: states are accelerating their AI adoption, but the real differentiator will be people.
The most valuable data professionals combine technical fluency with public-service intent. They understand models and meaning — turning data into trust, and algorithms into action.

This level of transition is natural and easily implemented in the commercial sector, yet it remains a sensitive subject within state and local government. That’s why we recommend implementing Green Accelerator solutions in states and localities facing workforce shortages while still carrying the mandate to serve their citizens.

The second opportunity lies in supporting programs that lack citizen engagement or are understaffed. By introducing AI-augmented data solutions in these areas, agencies can relieve capacity constraints, enhance responsiveness, and ensure service continuity — without compromising trust, accountability, or human oversight.

At ASSYST, that’s where our mission begins: enabling state and local agencies to harness AI responsibly, bridge workforce gaps, and deliver on their promise of better government for every citizen.

As Account Manager, Matthew Lee (LinkedIn) supports ASSYST’s Master Contracts with the State of Texas (ITSAC) and the State of Florida IT Staff Augmentation Programs. He partners with state technology and program leaders to deliver high-impact IT talent and solutions. He supports resourcing needs for key departments such as Texas DIR, HHSC, DFPS, TxDOT, TEA, and Florida DOH, DMS, DCF, AHCA, and DFS, aligning staffing and delivery with modernization priorities in Cybersecurity, AI, Data, and Interoperability.

Sterling, VA — ASSYST Inc. has been recognized among OrangeSlices AI’s 2026 Elev8 GovCon Honorees, celebrating companies that exemplify innovation, partnership, and excellence across the federal contracting community.

The Federal GovCon sector continues to be one of the most complex and competitive marketplaces in the world, and the consistent, long-term winners are those that deliver not only efficient and effective solutions but also cultivate a corporate culture that demonstrates their own excellence, becoming a beacon for talent, partners, and clients alike.

ASSYST’s recognition reflects its leadership across the eight Elev8 dimensions: Good Partner, Growing Talent, Exemplifying Innovation, Philanthropy, Industry Engagement, Efficiency, Sustainability, and Continuous Improvement.

“This recognition is a reflection of our people and partners who drive innovation with purpose,” said Ram Prasad, Executive Vice President – Business Solutions, ASSYST. “ We are committed to helping our government customers strengthen missions through collaboration, accountability, and forward-thinking solutions that meet today’s needs and anticipate tomorrow’s challenges.”

ASSYST delivers mission-driven outcomes across Healthcare, Defense, National Security, Regulatory, and State and Local agencies, empowering modernization, compliance, and transformation. Its work strengthens cybersecurity for systems serving millions of healthcare beneficiaries at CMS; modernizes shared financial systems at PSC for greater efficiency; advances FDA regulatory systems that protect public health; supports ONC’s efforts to enhance health-data interoperability and quality of care; and enables DHRA’s initiatives to strengthen language and culture preparedness vital to national security. Beyond these engagements, ASSYST continues to drive innovation across emerging domains, including AI governance, data modernization, and secure multi-cloud infrastructure, helping agencies build sustainable, intelligent operations for the future.

Through investments such as the Green Accelerator Framework and commercial solution offerings including Collab AI, ComplySyncATO, Hephaestus, and Athena Agentic AI, ASSYST is advancing sustainable, intelligent modernization across government enterprises, aligning people, platforms, and policy to deliver measurable mission outcomes.

Welcome to ASSYST OnPoint xChange, exploring next-generation DevSecOps in GovTech. Eugene Goldlust, speaking with Vinay Shirke, CIO of ASSYST. They are discussing how AI, automation, and innovative platforms such as ASSYST’s Argus are shaping secure software delivery.

Eugene: Vinay, thank you for taking the time to chat. Federal agencies are under pressure to deliver software faster and more securely. To start, what do you see as the future of DevSecOps and secure software delivery in the federal landscape?

Vinay: It’s an exciting time. We’re seeing DevSecOps really take hold across federal organizations. In fact, the Department of War now has several software factories using DevSecOps to push code into production—and they’re already seeing faster deployment cycles, enhanced security, higher software quality, and better outcomes for users. That kind of success is encouraging civilian agencies to follow suit. The future of federal DevSecOps will involve scaling these “software factory” models across departments, breaking down silos, and ingraining security into every step of the software lifecycle. Security isn’t a box to check at the end anymore; it’s becoming a built-in foundation for speed and innovation. As one industry expert put it, modern missions require security that powers velocity rather than slows it down. Agencies can’t afford to trade off speed for security; they need both for mission success.

Eugene: Right, the stakes are incredibly high. A system failure in government isn’t just a business issue; it impacts mission assurance, national security, citizen safety, and public trust. So DevSecOps is about balancing that responsibility with the need to innovate quickly. How are agencies ensuring that balance holds, especially as they adopt new technologies like AI?

Vinay: They’re evolving their mindset. The agencies that succeed treat security and compliance not as roadblocks but as strategic enablers of faster delivery. We see leadership support for DevSecOps by investing in automation and cultural change. For example, some agencies now embed security experts from day one of a project, even starting the ATO (Authority to Operate) at kickoff, so security requirements run in parallel with development. This “compliance-as-code” approach means things like vulnerability scans, configuration checks, and governance policies are automated in the pipeline. It’s continuous monitoring and continuous authorization, rather than big-bang audits at the end. With DevSecOps, compliance and risk management become ongoing activities that strengthen mission assurance while development continues. And importantly, agencies are keeping a human-centered focus. Barbara Morton from the VA said it well: “You can’t automate empathy, so even as we automate processes, we ensure the end-user’s needs and experience stay front and center. That mindset is crucial for public trust.” Quote from Meritalk.com                (https://www.meritalk.com/articles/va-official-ai-can-boost-efficiency-but-you-cant-automate-empathy/ )

AI’s Role in Software Testing and QA

Eugene: Let’s dive into AI. There’s a lot of buzz around AI transforming software testing and quality assurance. How do you see AI changing the game for federal software QA?

Vinay: AI is a game-changer for testing, no doubt. Traditional testing can be a bottleneck, but AI helps us test smarter and faster. For instance, generative AI can now automatically generate test cases and datasets, even simulating complex user interactions – greatly reducing the manual effort for QA teams. We’re essentially letting AI handle repetitive or highly complex test design work. That means broader test coverage in less time. AI can also detect anomalies and predict high-risk code areas to focus testing where it matters most. And when it comes to security, AI-driven tools in a DevSecOps pipeline can continuously perform real-time code analysis, dependency scanning, and compliance monitoring. The result is higher-quality software delivered more quickly, with fewer security gaps – exactly what NIST has been advocating. In fact, NIST’s DevSecOps guidance notes that using AI in development “improves work efficiency” and yields “higher quality software in a more timely manner”. So, the future of QA will heavily feature AI assistants working alongside human testers.

Eugene: It sounds like AI can supercharge continuous testing. But what about the human element? How do we ensure AI-driven testing still aligns with human-centered design and doesn’t become a black box?

Vinay: Great point. We always pair AI with human oversight and HCD principles. AI can crunch data and suggest tests, but humans still set the testing goals and validate critical scenarios. We ensure that the user experience – including accessibility and usability – is part of the test criteria. Interestingly, AI tools can even assist here: some automation platforms use AI to simulate screen readers or check color contrast, helping catch accessibility issues early. But ultimately, testers and designers review those results to ensure applications are truly user-friendly and equitable. In short, AI handles the heavy lifting and repetitive tasks, while humans focus on empathy, strategy, and creative problem solving. That combination lets us meet HCD goals and mission needs without slowing down.

Strategic Value of an AI-Enabled Test Automation Platform, Argus?

Eugene: Vinay, ASSYST has been progressively building an AI-enabled test automation platform. For our audience of CIOs and tech leaders, what is the strategic value of this platform? How does Argus help agencies deliver secure software faster or better?

Vinay: Argus is all about accelerating quality at scale. Strategically, it provides an enterprise-wide test automation platform that enables agencies to standardize and expedite testing across multiple teams and projects. Under the hood, it’s cloud-based and highly extensible. That means it can integrate with your existing dev tools, continuous integration (CI/CD) pipelines, and even with enterprise test data or requirements systems. By centralizing automated test scripts in a common repository, Argus promotes reusability; you write a test once and reuse it across many applications. This not only improves efficiency and consistency in testing but also lowers the total cost of ownership for quality assurance.

Eugene: And it’s AI supported, correct? How is AI built into Argus?

Vinay: Yes, that’s a key differentiator. We’ve embedded AI capabilities to make the platform smarter and more proactive. For example, Argus can use AI to analyze user stories or requirements and automatically generate test cases aligned with them. It’s like having a co-pilot for your QA team. The platform’s AI can also prioritize tests based on risk or past defect patterns, and it learns over time. Another aspect is AI-driven visual verification: Argus can visually execute test scripts and verify UI elements, helping catch visual or layout issues that traditional scripts might miss. All this means QA teams can cover more ground in less time, with greater confidence in software quality. Strategically, an AI-enabled Argus shortens release cycles (since testing is no longer a bottleneck) and embeds security and compliance checks into tests by default. In other words, it helps deliver high-quality, federal-compliant software from day one. 

Eugene: I like that it aligns with compliance needs automatically – that’s huge for federal programs. So Argus promotes team collaboration, boosts quality and speed, and ensures things like security scanning and even accessibility are baked in. It essentially acts as a quality guardian across the DevSecOps pipeline.

Vinay: Exactly. We sometimes call it a “QA Platform-as-a-Service” for the enterprise. And because it’s cloud-based and modular, it’s easy to adopt for new projects. Teams can onboard quickly, configure it to their tech stack (it’s technology-agnostic for web, API, etc.), and start getting immediate feedback on each build. In the long run, the strategic value is continuous improvement – the more you use Argus, the smarter it gets, and the more your overall software delivery gains a reputation for reliability and trust.

AI Generated Code Testing 

Eugene: Vinay, how is the rise of AI-generated code, including prompt-based development methods like “vibe coding”, impacting testing and quality assurance in federal software delivery? 

Vinay: Great question, Eugene. AI-generated code, even “vibe coded” applications, is dramatically accelerating development cycles. But we’ve also heard horror stories of folks deploying vibe-coded apps only to watch them collapse under load or get compromised due to overlooked quality attributes. So, while I’m excited about the productivity gains, I remain cautious. We must apply the same – if not greater – rigor in testing and QA for AI-produced code as we do for human-written code.

Eugene: Vinay, what risks do you see, such as hallucinated logic in AI outputs, and how should we adapt our validation and continuous testing processes? 

Vinay: One major risk is hallucinated logic. Generative AI can produce code that looks plausible but is subtly wrong or nonsensical. We’ve seen cases where an AI coding assistant generates functions that don’t compile, uses convoluted algorithms that contradict themselves, or even invents calls to non-existent APIs. If such issues slip through, they can introduce hidden bugs or security vulnerabilities. In a federal context, that’s especially dangerous – flawed AI-generated code might create compliance gaps or security holes that undermine our mission. Validation is key! Every AI-generated snippet needs thorough review and testing. In practice, that means we treat AI-written code like any other code in our DevSecOps pipeline. Teams should continue to submit pull requests and conduct peer code reviews, even if an AI generates the code. We leverage all our QA controls – robust linting and static analysis (SAST) tools in CI, unit, and integration test suites – as a safety net to catch AI’s mistakes. It’s tempting to trust the AI’s confident output, but we must enforce quality gates. A mature DevSecOps pipeline remains essential: every commit (whether AI- or human-driven) triggers automated tests, and code is promoted only after passing all checks. This way, hallucinations or errors are caught early, long before any release.

Eugene: How can AI enabled platforms like Argus help us maintain software quality and compliance in a DevSecOps and HCD-focused environment?

Vinay: We need continuous test adaptation to keep up with AI’s rapid, iterative development style. AI can refactor or generate new code in seconds, so our testing approach has to be just as agile. This is where AI-enabled QA platforms like Argus come into play. A platform uses AI to generate test scripts automatically from plain English requirements or user stories. It eliminates much manual test scripting by allowing even non-programmers to create tests in natural language. More importantly, Argus features self-healing tests that adapt when the application’s UI or logic changes. For example, if an AI-generated update alters an element ID or workflow, the automation can intelligently adjust the test script on the fly. This kind of continuous adaptation means our tests won’t break every time the AI introduces a change – the test suite evolves with the codebase. By ensuring automation is resilient, we drastically reduce maintenance overhead and can keep pace with the high velocity of AI-driven releases. And because Argus integrates seamlessly with our CI/CD pipelines, we’re executing a broad battery of tests on each build (across functionality, API, UI, etc.), enabling continuous testing and early bug detection even as the code rapidly evolves. The result is we catch critical issues sooner and support faster, safer releases.

Critically for software, these AI-driven testing practices help us always maintain quality and compliance standards. Modern QA isn’t just about finding bugs – it’s about ensuring the software and its components (SBOM) meet all security and regulatory requirements from the start. We can embed compliance checks into our automated test suites. For instance, a cloud-based test automation solution can include computerized checks for security controls, privacy rules, and compliance with coding standards, so any AI-generated code is immediately vetted against federal requirements. If AI inadvertently introduces insecure code, our integrated security tests (such as vulnerability scanners and policy-as-code checks) will flag it early. The same goes for accessibility and other regulations: we have tools to automatically validate against Section 508 and WCAG accessibility guidelines, ensuring new features remain inclusive and legally compliant. In fact, by incorporating usability and accessibility testing into the CI/CD workflow (as part of our HCD approach), we uphold human-centered design principles throughout development. That means every iteration of the software is not only secure and functional, but also user-friendly and accessible – all continuously verified. This blend of DevSecOps and HCD ensures that security, usability, and compliance get equal priority early on, rather than being afterthoughts. It builds user trust and makes achieving things like Authority to Operate much smoother, since we’re generating real-time evidence of compliance with each release.

Eugene: Vinay, any guidance for the workforce on the future of AI in QA?

Vinay: Looking forward, I see AI changing the role of our engineers rather than replacing them. Generative coding tools handle grunt work, but the human experts stay in the driver’s seat. Our developers and testers are becoming more like quality governors and product stewards, guiding the AI, setting the right prompts, and then rigorously verifying the outputs against mission needs. As one industry expert noted, coding is “slowly becoming a QA and product definition heavy job,” where the developer’s goal is to understand patterns, master testing methods, and clearly articulate the business objectives for the code. That mindset is exactly what federal CIOs and engineering leaders are adopting. By pairing AI-powered development with AI augmented testing and DevSecOps discipline, we get the best of both worlds: high-velocity delivery and high-assurance software. In sum, prompt-based AI coding can be a game-changer for productivity, but only when we anchor it with strong QA practices, continuous test adaptation, and platforms like Argus to automatically uphold our quality and compliance standards at every step. This approach lets us innovate faster while still “shifting left” on security, quality, and user-centric design, which is ultimately what drives successful federal IT outcomes.

Continuous Innovation with Compliance and HCD in Mind

Eugene: Vinay, to wrap up, paint us a vision. How do you see product engineering and testing evolving so that agencies can continuously innovate while still meeting compliance mandates, mission assurance, and human-centered design goals?

Vinay: I see a future where these goals are not in conflict but in harmony. We’re moving toward a model where compliance is continuous and largely automated. Imagine real-time dashboarding of security and compliance posture for every app release, with AI flagging issues instantly. DevSecOps will make “compliance as code” the norm, so meeting regulations is just a natural outcome of the pipeline. That frees up teams to focus on mission functionality. For mission assurance, the key will be building robust feedback loops. In the future, every deployment will include telemetry and user feedback that feed directly into planning. This means products quickly adapt to any issues, ensuring reliability and performance for mission-critical systems. AI will help here too, predicting potential failure points or performance bottlenecks before they impact the mission.

On the innovation side, I envision fusion teams of developers, security, ops, and UX designers working together from the start (a true DevSecOps/DevSecDesignOps culture). They’ll use platforms like our Argus and Green Accelerator, so they’re not bogged down by manual tasks or siloed tools. With those mundane parts automated, the teams can spend more time on creative solutions and user-centered improvements. And HCD remains front and center: we’ll continue testing with real users, incorporate accessibility, and design for the human experience. DevSecOps complements this by encouraging iterative development and frequent user feedback – as we saw in agencies that emphasize a human-centered approach in their DevSecOps practices.

Ultimately, I think the vision is of software factories that continuously innovate engines – producing updates that are secure, compliant, and user-friendly by default. When security and compliance become built-in quality attributes rather than afterthoughts, you get faster innovation with greater trust. Federal programs can then deliver on their missions with agility and earn the public’s confidence. The technology (AI, automation, platforms) is enabling this, but it’s the cultural shift, embracing DevSecOps and human-centered thinking, that will truly make continuous innovation possible.

Eugene: Well said. It’s a future where speed, security, and empathy go hand in hand. This has been a thoughtful discussion – thank you, Vinay, for sharing your insights. I’m sure our readers gained a valuable perspective on leveraging AI and DevSecOps to meet the public sector’s unique needs.

The GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act), signed in July 2025, marks a turning point in digital asset regulation. It requires stablecoins to be fully backed, audited, and transparent—while setting expectations for consumer protections and financial surveillance.

For government cybersecurity programs, this law underscores a new dual mandate. Agencies may have to oversee crypto asset ecosystems—validating reserves, ensuring compliance, and protecting privacy. They may also have to strengthen their internal cryptographic infrastructure—maintaining lifecycle governance, enabling crypto-agility, and preparing for post-quantum security.

To unpack what this means in practice, Eugene Goldlust, Senior Account Executive, speaks with Vijay Narasimhan, CTO of ASSYST.

Eugene:

Vijay, thank you for meeting with me today to discuss an important topic as we head into the 2025 cybersecurity awareness month. As you know, the GENIUS Act sets tough expectations for stablecoin issuers. What do you foresee agencies will now have to do in terms of stablecoin oversight?

Vijay:

Agencies may have to acquire technical capabilities to verify reserve disclosures using cryptographic proofs—checking signatures, hashes, and timestamps for authenticity. They may also need to monitor blockchain transaction ecosystems for AML/KYC compliance, utilizing analytics tools linked to cryptographic audit trails.

Critically, agencies will have to enforce privacy controls. Financial surveillance is mandated, but privacy-preserving cryptography—like zero-knowledge proofs or selective disclosure credentials—will be key to protecting individuals. We are thinking of delivering these capabilities utilizing ASSYST’s ComplySyncATO and Athena Agentic AI to support potential future use cases across crypto oversight, blockchain applications, and quantum-aware infrastructure. ComplySyncATO is standards-ready, meaning you can feed it tomorrow’s security controls to evaluate today’s compliance.

Eugene:

That covers the external side. Internally, what may agencies have to do with their own cryptographic infrastructure?

Vijay:

Internally, agencies may have to:

• Maintain a cryptographic inventory across all systems. Many agencies began by implementing hardened, tamper-resistant devices such as Hardware Security Modules or HSMs, then shifted to cloud vaults—but these often fall short for blockchain and post quantum cryptography (PQC) needs. The next step is clear: extend crypto-agile architecture inventory and crypto governance to cover traditional IT, blockchain, and quantum-safe algorithms without gaps.

   

• Enforce lifecycle governance, ensuring invalidated, expired, or superannuated information assets or deprecated algorithms don’t undermine mission continuity.

   

• Enable crypto-agility so that systems can pivot from RSA/ECC to post-quantum algorithms like CRYSTALS-Kyber, CRYSTALS-Dilithium, or SPHINCS+ without major rework.

   

• Integrate cryptographic telemetry into SIEMs, turning crypto events—like cipher downgrades, expired certs, or points where asymmetric public keys are used—into actionable security signals.
   

Without these steps, internal systems won’t be resilient enough to meet the same level of rigor the GENIUS Act demands externally.

Eugene:

Quantum often gets treated as “tomorrow’s” issue. In this context, how should agencies prepare and what can they do right now to ensure future resiliency?

Vijay:

Agencies may have to act as if quantum is already here. Specifically:

• Identify quantum-vulnerable assets, especially those protecting long-lived financial records, citizen data, or audit logs. 
   
• Run hybrid deployments, combining classical and PQC algorithms to prepare for a staged transition.
   
• Upgrade PKIs in two phases: first, enable issuance of PQC-compatible certificates using the current NIST selections—CRYSTALS-Kyber or CRYSTALS-Dilithium—at least for mission-critical systems. Later, extend support to Falcon once NIST finalizes its standard, balancing performance on verification and key size.
   
• Test PQC workflows, evaluating performance impacts in real-world systems—like constrained IoT devices or high-volume transaction platforms.

The threat isn’t just future decryption—it’s the “harvest now, decrypt later” risk. Agencies may have to treat every encrypted record today as if an adversary is already saving it for tomorrow’s quantum computers.

Eugene Goldlust:

Vijay, post-quantum security isn’t only about technology. What should the folks who run cybersecurity programs do to prepare for these changes?

Vijay:
Crypto algorithms are evolving—and so must the workforce. Cybersecurity programs may have to adapt to these changes and prepare their people accordingly. That means:

• Redefining ISSO roles into crypto assurance officers, with responsibility for monitoring cryptographic telemetry, ensuring blockchain-based infrastructure compliance, and driving PQC readiness.
   
• Upskilling engineers to design crypto-agile systems, integrate PQC libraries, and validate blockchain applications that protect the resilience of agency services and the citizens they support.
   
• Equipping program managers to treat cryptographic milestones as formal deliverables tied to funding and reporting, rather than back-end technical chores. This elevates crypto governance to a programmatic requirement.
   
• Introducing new roles such as Quantum Readiness Officer, Cryptographic Risk Manager, and Privacy Engineering Specialist—positions that bridge technical expertise with compliance and mission assurance.

And let me emphasize—we welcome these new technologies and are standing ready to support agencies as they adapt to them.

Eugene:

So for Cybersecurity Awareness Month 2025, what’s the bottom line?

Vijay:

Cybersecurity Awareness Month is the right moment to acknowledge this shift and act. The path forward is clear: oversee external crypto responsibly, govern internal cryptography rigorously, and prepare for quantum today.

The message here is that crypto governance is mission governance. By adopting standards-ready tools like ComplySyncATO, maintaining crypto inventories, integrating telemetry, planning for PQC, and evolving the workforce, agencies will be prepared to meet the dual challenge of regulation and resilience.

The GENIUS Act is more than financial regulation—it’s a signal that governments must lead in cryptographic assurance. Agencies may have to act on both fronts: enforcing trust in external markets and protecting the cryptography inside their own systems.

Embedding security, automation, and compliance into the heart of federal application delivery

Background

The National Institute of Standards and Technology (NIST) Office of Information Systems Management (OISM) Application Systems Division (ASD) develops and maintains a wide portfolio of mission-critical information systems. The ASD plays a crucial role in ensuring NIST’s internal and external systems are kept operational, secure, and compliant—a responsibility that NIST team members and external stakeholders depend on to securely and consistently access essential tools and data. To strengthen ASD’s Application Lifecycle Management (ALM) and Software Configuration Management (SCM) capabilities, NIST launched an ambitious modernization initiative focused on DevSecOps transformation.

ASSYST partnered with NIST’s Infrastructure Services Division (ISD), IT Security & Networking (ITSND), and Platform Services (PSD) to deliver this transformation, leveraging decades of experience in federal secure cloud modernization. The initiative advanced software delivery capabilities while aligning directly with FISMA, FedRAMP, Executive Order 14028 on Zero Trust, and OMB M-21-31 logging and observability mandates, ensuring compliance with national cybersecurity priorities. By embedding security and automation into the development lifecycle, the effort created a standards-aligned model for federal DevSecOps modernization.

Challenge

NIST’s goal was to transition from legacy, manual processes to a modern DevSecOps framework—with continuous integration, continuous deployment, automated validation checks and vulnerability scans, and containerization—while operating within strict security protocols.

The challenge was not just modernization, but proving how security could be embedded across the entire software delivery lifecycle, in alignment with NIST’s own standards and evolving federal cybersecurity directives.

Solution

Based on our understanding of the challenges, it was clear that streamlining and automating the development and operations processes for faster software release cycles in a secure cloud environment were the key requirements. ASSYST’s proposed solution was flexible, reliable, scalable, and offered great computing power; it was easy to use and cost-effective. ASSYST’s approach included a solution stack comprising a combination of cloud services and open-source technologies that addressed all the above challenges. ASSYST designed, developed, and deployed a secure, automated DevSecOps pipeline in the NIST AWS environment:

• Infrastructure as Code (IaC): Provisioned AWS infrastructure with Terraform, ensuring consistency, reproducibility, and auditability.
• CI/CD Pipeline Automation: Configured GitLab pipelines for containerized and non-containerized applications, reducing deployment friction and error rates.
• Integrated Security & Compliance: Embedded Clair vulnerability scans into ECR repositories for continuous monitoring, ensuring compliance with Zero Trust principles.
• Third-Party Integration: Integrated GitLab and SonarQube into AWS EKS Fargate, establishing automated quality checks and feedback loops consistent with NIST secure coding guidance.

Features

• IaC for automated, version-controlled environments
• CI/CD pipelines for standardized, repeatable deployments
• Continuous vulnerability scanning on every image push and nightly cycle
• Built-in compliance alignment with EO 14028, OMB M-21-31, and NIST DevSecOps guidance

Outcomes

This modernization delivered lasting improvements to NIST’s application delivery and security environment:

• Accelerated Deployment Cycles: Application releases moved from weeks to hours, with greater reliability and repeatability through automation.
• Flexible and Easy to use/configure/implement: ASSYST’s approach provided secure, resizable compute capacity in the cloud. The proven cloud computing containerized environments provide complete flexibility and freedom in managing computing resources and costs, ensuring and extracting maximum computing power. It was very easy and less time-consuming (minutes) to obtain and boot new pods and cloud services, compared to an on-premises or server instance model.
• Repeatable: Having optimized the CI/CD process, the entire codebase, scripts, and instructions were tested at each environment before being promoted, and faults and errors were quickly spotted and remediated.
• Scalable (Auto-Scaling): The ability to quickly scale capacity, both up and down, depending on the load and volume, was seamless.
• Security: Encryption set in transit and at rest. In addition to TLS encryption, in-transit encryption was successfully completed using the Java Cryptography Extension (JCE) for each part before storing the sensitive files in the cloud storage. Access to the data was easily controlled and managed.
• Parallel Processing: The processing time of large data submissions was drastically reduced due to parallel processing.
• Storage: In a cloud environment, storage is offered in different classes, depending on how frequently the data is accessed (for example, EBS, S3, Glacier, etc.). The cost benefits compared to an on-premises model for storing huge data were relatively low by using this model. The cloud Storage service also meets regulatory compliance standards, including PCI-DSS, HIPAA/HITECH, FedRAMP, and FISMA.
• Strengthened Security Posture: Vulnerabilities were detected earlier in the development lifecycle, effectively shifting security left and reducing production risk.
• Continuous Compliance: Automated controls ensured ongoing alignment with Zero Trust principles, FedRAMP, EO 14028, OMB M-21-31, FISMA guidelines, and NIST DevSecOps guidance.
• Operational Efficiency: Manual, time-intensive processes were eliminated, enabling teams to focus on mission-driven innovation.
• Replicable Model for Agencies: The initiative established a standards-aligned DevSecOps framework that other federal organizations can adopt—demonstrating ASSYST’s ability to deliver secure, automated, and compliant modernization at scale.