Public sector and government agencies are under pressure to deliver always-on digital services while facing cyber threats that are growing in scale, speed and sophistication.

As AI increasingly shapes both attack methods and defence strategies, agencies need more than new tools. They need stronger visibility across their digital environments so they can detect issues earlier, investigate them faster and respond with confidence.

The challenge is no longer just the volume of threats or the complexity of modern IT. It is the widening gap between how quickly cyber risk is evolving and how effectively many government agencies can see, understand and act across fragmented systems. That gap matters even more in an era of AI-powered cybersecurity, where speed, context and trust increasingly determine whether agencies can contain disruption or fall behind.

Outages already carry a significant risk for the public sector, and Splunk’s latest Hidden Cost of Downtime Report revealed organisations lose an average of US$15,000 per minute of disruption. The research revealed the public sector alone had a total average loss of US$377.8M attributed to lost revenue, cyber insurance premiums, cost of additional infrastructure to manage downtime and even ransomware payouts. But this is just the tip of the iceberg with consequences from downtime. Outside of financial loss, the report shows the cost extends to reputational damage, frustrated citizens and reduced productivity.

That is where observability and digital resilience become critical. Organisations with more mature observability and stronger cyber practices report fewer outages and faster resolution times. For agencies looking to strengthen AI-powered cybersecurity, observability provides the operational foundation to fight AI threats and reduce the impact of downtime.

Why observability matters in AI-powered cybersecurity

Observability helps agencies move from reactive troubleshooting to proactive resilience, reducing rates of downtime and countering AI threats. By bringing together telemetry, the automated collection and transmission of date from remote sources, across applications, infrastructure, networks and security layers, it gives teams the context needed to spot anomalies sooner, understand service impact and investigate incidents without losing time across disconnected tools. In practice, that means faster detection, stronger root-cause analysis and better-informed response when cyber incidents or service degradation occur.

Observability further reduces the friction that slows security and operations teams when an incident occurs. Instead of relying on manual escalation paths, siloed dashboards and incomplete evidence, teams can work from a shared view of what is happening across systems. That improves triage, shortens investigation time and helps agencies contain incidents before disruption spreads across critical services and impacts citizens using those services.

Read also: Why public sector agencies are shifting from cloud-first to cloud-smart strategies

This becomes even more important as AI is embedded more deeply into cybersecurity operations. Generative AI assistants in observability and security can help teams accelerate detection, exploration, investigation and response by analysing metrics, traces and logs through natural language workflows. But these gains depend on having trusted, connected data across the environment. Without observability, AI can add speed without enough context. With it, agencies are better positioned to turn AI into practical security outcomes.

How the public sector can close the gap

Public sector organisations should treat observability as a strategic capability, not simply a technical function. When observability is connected to resilience outcomes, it becomes easier to justify investment, strengthen governance and ensure AI initiatives are tied to service continuity, citizen trust and operational accountability.

Further, they should improve end-to-end visibility across the full digital environment. AI systems rely on access to high-quality, connected data across networks, applications and security controls. Limited visibility, siloed teams and fragmented tools remain major barriers for the public sector, while more mature observability practices are associated with fewer outages and faster issue resolution. For agencies trying to catch up, observability is not optional. It is the data and context layer that makes AI more effective.

Finally, agencies should leverage on observability to bring cybersecurity, IT operations and engineering teams onto shared workflows and shared evidence. Convergence across observability, AIOps and related functions can reduce fragmentation and help teams act faster during incidents. For the public sector, that level of confidence is essential if AI-powered cybersecurity is to improve resilience rather than add another layer of complexity.

Public sector organisations operate in environments where trust, reliability and continuity are essential. Observability can help them catch up with AI-powered cybersecurity by giving teams the visibility and context needed to move faster, collaborate better and respond with greater precision.

Christine Low

Head of Observability APJC at Splunk |  + postsBio

Christine Low brings over two decades of strategic leadership and expertise in technology sales and business development across the APJC region. Currently serving as the Head of Observability for ANZ and Japan at Splunk, Christine is instrumental in driving the adoption of observability solutions that empower organizations and government agencies to gain actionable insights into their digital environments. Previously, Christine held key roles at Cisco, IBM, Logicalis, and Telstra, where she provided her expertise in sales leadership, partner ecosystem management, account management, sales enablement, and solution development.