Strategy for artificial intelligence-accelerated vulnerability discovery and remediation

(a) Strategy required Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall develop a strategy to address risks and opportunities arising from the use of advanced artificial intelligence systems to discover, validate, exploit, remediate, or reverse engineer vulnerabilities in software, firmware, weapon systems, operational technology, and information systems used by the Department of Defense. (b) Elements The strategy required under subsection (a) shall include the following: (1) An assessment of how advanced artificial intelligence systems are likely to affect the volume, speed, severity, and exploitability of vulnerabilities affecting Department systems, including an updated definition of vulnerability that accounts for artificial intelligence-specific behavioral flaws (such as prompt injection and data poisoning) and the remediation requirements for model retraining. (2) A risk-based framework for machine-speed vulnerability discoveries, and for prioritizing vulnerability remediation and mitigation, including consideration of mission impact, exploitability, exposure, system criticality, availability of compensating controls, and risks associated with insufficiently tested patches. (3) A plan to improve the speed, reliability, and safety of patch testing, approval, and deployment, including through automated testing, representative test environments, staged deployment, reciprocity of cybersecurity testing, and emergency mitigation procedures, as appropriate. This includes an assessment of the impacts of machine-speed vulnerability discovery on the Vulnerability Equities Process (VEP) and other interagency coordination processes, with recommendations for adapting these processes to a near-zero decision timeframe. (4) Guidance for the use of compensating controls when immediate patching is not feasible. (5) Policies for the responsible use of artificial intelligence systems by the Department to support vulnerability discovery, exploitability analysis, patch development, patch validation, and prioritization of remediation, (6) Recommendations for acquisition, contracting, vendor notification, and information-sharing requirements needed to improve timely remediation of vulnerabilities affecting Department systems. (7) A plan to address vulnerabilities in legacy systems, mission-critical systems, weapon systems, and operational technology for which patching may be operationally difficult. (8) Metrics to assess implementation of the strategy, including the timeliness of vulnerability validation, mitigation, testing, and remediation. (c) Briefing Not later than 180 days after the date of the enactment of this Act, and annually thereafter for three years, the Chief Information Officer of the Department of Defense and the Assistant Secretary of Defense for Cyber Policy shall jointly provide the congressional defense committees a briefing on the strategy required under subsection (a), including implementation progress, barriers to implementation, and any additional authorities or resources required to implement the strategy. (d) Definition or advanced artificial intelligence system In this section, the term advanced artificial intelligence system means an artificial intelligence system, including a frontier model, cyber-specialized model, agentic system, or automated cyber reasoning system, that is capable of materially assisting in vulnerability discovery, exploit generation, reverse engineering, patch development, or patch validation.