From the State Government edition of September 26, 2026
Ohio Digital States interview cites RecoveryRachel behavioral-health finder and agentic SOC across 26 agencies
Ohio Department of Administrative Services / CIO Katrina Flory; RecoveryOhio; Ohio cybersecurity operations · State enterprise IT / behavioral health access / statewide cybersecurity operations / data management · Ohio, United States
- Publisher
- Government Technology — Digital States 2026 ‘A’ State Interview: Katrina Flory, Ohio
- Original publication
- 2026-09-23
- Source retrieved
- 2026-09-27
- Event date
- 2026-09-23
What happened
Why now: 2026-09-23 Digital States A-state interview adds Ohio’s operational GenAI stack still unarchived after prior A-state pieces. CIO Katrina Flory highlights RecoveryRachel (RecoveryOhio) as a conversational voice/chat tool helping residents find licensed mental health and substance-use providers; describes an Agentic Security Operations Center powered by Google SecOps and Gemini AI enabling coordinated defense across 26 cabinet agencies and numerous boards/commissions with automated triage/correlation; and details Snowflake Cortex / Copilot uses for FinOps, synthetic-data guidelines, and data-catalog curation automation. Also mentions Safeguard Ohio tip-reporting AI—public-safety adjacent and out of primary stream scope.
Why it matters
State shared-services cyber AI at multi-agency scale plus resident behavioral-health navigation—relevant to operating-model, infrastructure, and accessibility-workforce topics; public-safety tip app noted only as boundary.
Evidence and measured results
GovTech Digital States Q&A; qualitative/architectural claims (26 agencies, agentic SOC, RecoveryRachel capabilities) without published MTTD/MTTR, deflection, or outcome KPIs in the opened page.
Limitations and uncertainty
No quantitative cyber or RecoveryRachel outcome metrics in this interview. Safeguard Ohio is public-safety/criminal-justice tip reporting—exclude from primary state-government evidence per stream scope.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-26; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- States need multi-agency cyber AI and resident navigation tools with measurable analyst and user outcomes, not only platform names.
- Stakeholders
- State CIO
- CISO / SOC leadership
- RecoveryOhio / behavioral health
- Enterprise data office
- Cabinet agency CIOs
- Discovery questions
- What MTTD/MTTR changed after agentic SOC?
- Which SOC actions remain human-mandatory?
- How is RecoveryRachel provider directory kept current?
- What governance gates apply to catalog/data agents?
- Value hypothesis
- A bounded agentic-SOC measurement or RecoveryRachel quality engagement can turn Ohio’s architecture claims into decision-grade KPIs.
- Potential engagement
- 6–8 week agentic SOC playbook/KPI design or behavioral-health navigator QA pilot.
- Unsupported claims
- Proven statewide breach reduction
- Guaranteed resident treatment outcomes
- Fully autonomous SOC response
Pre-sales engineering
Role takeaway
- Fit
- Fit for analyst-supervised agentic SOC and constrained provider-finder RAG; data-catalog agents with human classification sign-off.
- Architecture and integration
- Google SecOps + Gemini SOC agents; RecoveryRachel voice/chat over licensed provider data; Snowflake Cortex/Copilot catalog agents.
- Prerequisites
- SOC playbooks and authority matrix
- Licensed provider directory
- Data classification standards
- Identity baselines
- Constraints
- No outcome KPIs in source
- Public-safety tip app out of stream scope
- Vendor-specific Google/Snowflake stack
- Security
- Keep destructive SOC actions human-gated; protect health-seeking queries; enforce privacy suppression in catalog agents.
- Proof of value
- Analyst time-to-decision sampling
- False-positive/negative SOC review
- RecoveryRachel match accuracy audit
- Catalog metadata acceptance rate
Delivery
Role takeaway
- Work
- SOC agent playbooks, navigator content ops, catalog-agent governance, accessibility alignment support.
- Dependencies
- Cyber ops
- RecoveryOhio
- Enterprise data catalog owners
- Cabinet agencies
- Ownership
- CIO/DAS enterprise with SOC and RecoveryOhio operational owners.
- Skills and adoption
- Analysts need AI-triage literacy; navigator content owners need QA skills; data stewards approve AI-suggested metadata.
- Governance checkpoints
- Agent action authority review
- Monthly SOC efficacy review
- Provider-directory freshness check
- Catalog agent policy review
- Acceptance criteria
- Human gate on high-impact SOC actions
- Published navigator quality sample
- Documented agent governance
- Risks
- Autonomous SOC mis-response
- Health navigation hallucination
- Scope bleed into public-safety tip tooling
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Agentic SOC on Google SecOps + Gemini; RecoveryRachel conversational provider-finder; Snowflake Cortex + Copilot for data quality/metadata/catalog search agents; federated enterprise data catalog.
Governance
Who approves, reviews and stays accountable for outcomes?
Human oversight retained for security/privacy/policy decisions in data-management AI; digital accessibility policy aligned to 28 CFR Part 35 Subpart H; strategic governance of agents listed as next step.
Security and privacy
What data, permissions and controls need testing?
Agentic SOC automates triage/enrichment while analysts decide; privacy suppression/aggregation and data classification called out as priorities; RecoveryRachel handles sensitive health-seeking context—controls not detailed here.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Digital accessibility policy revision to 28 CFR Part 35 Subpart H with training/resources; RecoveryRachel voice/chat framed as meeting residents where they are. Workforce: SOC analyst leverage via automation.
Procurement
What should contracts, pricing and exit terms secure?
Google SecOps/Gemini and Snowflake/Microsoft Copilot named—confirm enterprise agreements, agentic SOC addenda, and data-processing terms across 26 agencies.
Operating model
Which teams own the service once it runs?
Enterprise SOC shared across cabinet agencies; RecoveryOhio program ownership of navigator; federated data catalog with strategic agent governance as next step.
Publication history
- 2026-09-26State Government · Issue 215 resources
Stable resource ID: ohio-digital-states-2026-flory-agentic-soc-recoveryrachel-20260923