Organizations Assess AI Agents for Faster Cybersecurity Exercises

Cybersecurity practitioners are evaluating how artificial intelligence could speed up both sides of purple-team exercises: red-team activities that test defenses and blue-team work to detect and respond to threats. The discussion includes a possible proof of concept involving Wiz’s red, blue, and green agent offerings, as well as the development of custom internal tools. It describes exploratory activity rather than a formal government acquisition, and does not identify a sponsoring agency, procurement timeline, contract value, or award.

The central operational question is how AI can support different phases of an exercise. One community commenter described using smaller models running locally for immediate tasks, such as identifying unusual patterns in real time, while reserving larger cloud models for planning between exercises: “What actually worked for me was using smaller local models for the quick stuff (like flagging weird patterns in real time) and saving the beefy cloud models for planning phases between exercises.” This is an individual practitioner’s account, not a documented government implementation or validated performance claim.

For federal cybersecurity and acquisition teams, the discussion offers a starting point for structuring a controlled proof of concept. Evaluators could define measurable objectives around exercise speed, real-time analysis, and planning workflows, then compare commercial agent products with internally developed capabilities. Any assessment would need to distinguish demonstrated results from vendor claims and account for the operating environment, data handling, integration needs, and how human operators supervise AI-generated findings and recommendations.

The proposed local-and-cloud model also highlights practical constraints that matter to procurement planning. Smaller local models may be considered for rapid analysis, while larger cloud models may be used for less time-sensitive planning; however, the discussion does not establish that this architecture has been selected or that it is suitable for a particular agency. API rate limits and costs are explicitly identified as considerations for cloud-model use. Vendors seeking to engage this market can make their offerings easier to assess by explaining deployment tradeoffs, usage costs, and how their agents support both offensive and defensive exercise workflows.

• The reported activity is an early-stage technology evaluation, not a confirmed solicitation, contract, or award.
• Practitioners are considering AI to accelerate both red-team and blue-team exercises.
• A possible proof of concept could examine Wiz’s red, blue, and green agent offerings; no selection is reported.
• Custom, internally developed tools are also part of the options being explored.
• One practitioner described smaller local models for quick, real-time tasks such as flagging unusual patterns.
• The same commenter said larger cloud models were used for planning between exercises; this is an individual account, not a government-wide finding.
• API rate limits and cloud-model costs are practical evaluation factors identified in the discussion.
• Acquisition teams can compare commercial and internal approaches against defined measures for exercise speed, analysis, and planning.
• The source identifies no government agency, contract value, formal solicitation, or award.