{"resourceId":"vermont-raiche-power-tools-statescoop-20261002","versions":[{"version":"external-5d12b54f8a2523f71dcc76eef193709bd9ed6cc60eed1a2403ed7cabd7669c26","resource":{"id":"vermont-raiche-power-tools-statescoop-20261002","title":"StateScoop (Oct 2): Vermont CDAIO Raiche reports ~100 developers trained on AI vulnerability work, patches to several dozen apps, and a 3-hour AI-assisted ballot proof","organization":"StateScoop (Keely Quinlan), interview with Vermont Chief Data and AI Officer Josiah Raiche","sector":"State enterprise AI enablement / developer security tooling / employee-built AI tools","geography":"Vermont statewide","publishedAt":"2026-10-02","publicationDate":"2026-10-02","eventDate":null,"sourceName":"StateScoop","sourceLabel":"How Vermont is leveraging AI across government, one ‘power tool’ at a time","sourceUrl":"https://statescoop.com/how-vermont-is-leveraging-ai-across-government-one-power-tool-at-a-time/","evidenceClass":"independent-reporting","outcomeClass":"emerging","topics":["developers-agents","knowledge-work","accessibility-workforce","operating-model"],"finding":"Raiche told StateScoop that Vermont is training developers to use AI tools to find and harden vulnerabilities across roughly 1,100 applications; about 100 developers have been trained with another 50 expected, and the effort has produced patches to several dozen applications, with AI used to group similar vulnerabilities and generate fixes plus testing steps. He frames AI as a human-operated 'power tool' and contrasts that with autonomous agents. Agencies use a 'pathfinder' model giving trusted employees about a three-month head start on building tools. In one example, the Secretary of State's office used an AI 'skill' to flag ballot-proof errors against roughly 3,000 candidates as a first pass, then staff reviewed every ballot once; the task finished in three hours, avoiding expected overtime.","sledRelevance":"Shows a state's operating model for enterprise AI: developer security enablement, peer champions, and human review of every output. Why now: Oct 2 publication, and it is the administration's own account of the same AI cyber work that Vermont legislators questioned at the Sep 30 oversight hearing, so it should be read next to that testimony.","evidence":"Opened the StateScoop article over HTTPS (curl, datetime 2026-10-02); confirmed the 1,100 applications, ~100 trained developers plus 50 expected, several dozen patched applications, pathfinder three-month head start, half-day executive workshop, and three-hour ballot-proofing account.","architectureImplications":"AI is applied to source-code scanning, attack-path modeling, generated Python checks and remediation across legacy applications, with hopes of driving CI/CD adoption. The article does not name the vendor tools or describe environment boundaries.","governanceImplications":"The human-operator framing is a governance choice, but the article gives no detail on approval, inventory or legislative disclosure, which is the gap the Sep 30 hearing raised.","securityPrivacyImplications":"Using AI to find and patch vulnerabilities across ~1,100 apps concentrates sensitive security information; access scope and vendor data handling are not described.","caveats":"Interview-reported outcomes with no baseline, error rates or independent validation; 'several dozen' patches is unquantified; the ballot example is a single anecdote. The article does not mention the legislative transparency dispute.","streamIds":["state-government"],"roles":{"sales":"Lead with Vermont's operating model: trained developers patching legacy apps, peer pathfinders, and human review of every AI output. Discovery should ask how many legacy applications the prospect carries, whether developers are trained on AI security tooling, and how results are disclosed to oversight. Value is a bounded enablement pilot with measured outcomes. Unsupported: quoting 'several dozen' patches as proof of risk reduction, or the three-hour ballot story as a general productivity figure.","engineering":"Fit is AI-assisted vulnerability triage and remediation on legacy code with human review and testing steps. Integrate findings into the existing ticketing and CI pipeline so AI-generated fixes pass the same tests as human ones. Constraints: no named tools, baselines or error rates in the article, and access boundaries are undocumented. Proof of value: measure time-to-remediate and regression rate on a sample of applications before and after enablement.","delivery":"Delivery work pairs a developer training cohort with a pathfinder program in one or two agencies, using a first-pass-then-full-human-review pattern like the ballot example. Owner is the chief data and AI officer with agency CIOs. Acceptance criteria: documented baseline, remediation counts and regression checks after one quarter. Risks are unmeasured claims, missing oversight disclosure, and dependence on one vendor."},"roleDetails":{"sales":{"customerProblem":"States carry large legacy application portfolios with known vulnerabilities and limited developer time to fix them.","stakeholders":["Chief data and AI officer","State CISO","Agency application owners","Secretary of State elections staff","Legislative IT oversight"],"discoveryQuestions":["How many legacy applications lack modern CI/CD?","Are developers trained on AI vulnerability tooling?","How are AI-assisted fixes reviewed and tested?","How are AI pilots disclosed to oversight bodies?"],"valueHypothesis":"Training developers on human-reviewed AI remediation may shorten fix cycles on legacy apps, to be confirmed with a measured pilot.","potentialEngagement":"One-quarter developer enablement pilot on a defined set of applications with baseline and after metrics.","unsupportedClaims":["Measured reduction in vulnerabilities","General time savings from the ballot anecdote","That 'power tool' framing satisfies oversight duties","Any cost savings figure"]},"engineering":{"fit":"AI-assisted vulnerability scanning, grouping and patch drafting on legacy state applications with human review.","architectureIntegration":"Feed AI findings into existing ticketing and CI pipelines; AI-drafted patches go through standard tests and code review before deploy.","prerequisites":["Application inventory with ownership","Test coverage or manual test steps per app","Secure environment for AI tool access","Developer training cohort"],"constraints":["Tools and boundaries not disclosed in source","Interview-reported results only","Legacy apps may lack tests","Oversight disclosure unresolved"],"security":"Scope tool access per repository, keep secrets out of prompts, and log AI-generated changes for audit.","proofOfValue":["Baseline versus pilot time-to-remediate","Regression rate of AI-drafted patches","Share of flagged issues confirmed by humans"]},"delivery":{"work":"Run a developer AI-security training cohort and an agency pathfinder program with first-pass AI, full human review.","dependencies":["Agency CIO sponsorship","Vendor tool access and terms","Test environments for legacy apps"],"ownership":"Chief data and AI officer, with agency CIOs owning their applications.","skillsAdoption":"Pathfinder employees get a head start and then train their teams; developers learn to review and test AI-drafted fixes.","governanceCheckpoints":["Inventory entry for each AI tool","Disclosure to IT oversight committee","Human review before deploy","Quarterly outcome report"],"acceptanceCriteria":["Baseline metrics captured before pilot","Every AI-drafted patch reviewed and tested","Quarterly report with remediation counts and regressions"],"risks":["Unmeasured success claims","Oversight conflict over undisclosed tools","Vendor lock-in across many apps"]}},"retrievedAt":"2026-10-04T22:19:51-05:00","enrichedAt":"2026-10-04T22:19:51-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Pathfinder and paired-workshop models build skills from trusted non-early adopters; the stated aim is removing drudgery rather than cutting staff.","procurementImplications":"Developer AI security tooling across a large legacy portfolio implies vendor dependence that should be reflected in contracts and exit terms.","operatingModelImplications":"A champion-led rollout with human review of every output is a transferable pattern, but should be paired with disclosure to oversight bodies.","sourceVerification":{"responseId":"curl-vt-statescoop-raiche-20261004","openedUrl":"https://statescoop.com/how-vermont-is-leveraging-ai-across-government-one-power-tool-at-a-time/","referenceExcerpt":"Raiche said the effort has already resulted in patches to several dozen applications","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}