From the State Government edition of October 4, 2026
StateScoop (Oct 2): Vermont CDAIO Raiche reports ~100 developers trained on AI vulnerability work, patches to several dozen apps, and a 3-hour AI-assisted ballot proof
StateScoop (Keely Quinlan), interview with Vermont Chief Data and AI Officer Josiah Raiche · State enterprise AI enablement / developer security tooling / employee-built AI tools · Vermont statewide
- Publisher
- StateScoop
- Original publication
- 2026-10-02
- Source retrieved
- 2026-10-05
What happened
Raiche told StateScoop that Vermont is training developers to use AI tools to find and harden vulnerabilities across roughly 1,100 applications; about 100 developers have been trained with another 50 expected, and the effort has produced patches to several dozen applications, with AI used to group similar vulnerabilities and generate fixes plus testing steps. He frames AI as a human-operated 'power tool' and contrasts that with autonomous agents. Agencies use a 'pathfinder' model giving trusted employees about a three-month head start on building tools. In one example, the Secretary of State's office used an AI 'skill' to flag ballot-proof errors against roughly 3,000 candidates as a first pass, then staff reviewed every ballot once; the task finished in three hours, avoiding expected overtime.
Why it matters
Shows a state's operating model for enterprise AI: developer security enablement, peer champions, and human review of every output. Why now: Oct 2 publication, and it is the administration's own account of the same AI cyber work that Vermont legislators questioned at the Sep 30 oversight hearing, so it should be read next to that testimony.
Evidence and measured results
Opened the StateScoop article over HTTPS (curl, datetime 2026-10-02); confirmed the 1,100 applications, ~100 trained developers plus 50 expected, several dozen patched applications, pathfinder three-month head start, half-day executive workshop, and three-hour ballot-proofing account.
Limitations and uncertainty
Interview-reported outcomes with no baseline, error rates or independent validation; 'several dozen' patches is unquantified; the ballot example is a single anecdote. The article does not mention the legislative transparency dispute.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-04; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- States carry large legacy application portfolios with known vulnerabilities and limited developer time to fix them.
- Stakeholders
- Chief data and AI officer
- State CISO
- Agency application owners
- Secretary of State elections staff
- Legislative IT oversight
- Discovery questions
- How many legacy applications lack modern CI/CD?
- Are developers trained on AI vulnerability tooling?
- How are AI-assisted fixes reviewed and tested?
- How are AI pilots disclosed to oversight bodies?
- Value hypothesis
- Training developers on human-reviewed AI remediation may shorten fix cycles on legacy apps, to be confirmed with a measured pilot.
- Potential engagement
- One-quarter developer enablement pilot on a defined set of applications with baseline and after metrics.
- Unsupported claims
- Measured reduction in vulnerabilities
- General time savings from the ballot anecdote
- That 'power tool' framing satisfies oversight duties
- Any cost savings figure
Pre-sales engineering
Role takeaway
- Fit
- AI-assisted vulnerability scanning, grouping and patch drafting on legacy state applications with human review.
- Architecture and integration
- Feed AI findings into existing ticketing and CI pipelines; AI-drafted patches go through standard tests and code review before deploy.
- Prerequisites
- Application inventory with ownership
- Test coverage or manual test steps per app
- Secure environment for AI tool access
- Developer training cohort
- Constraints
- Tools and boundaries not disclosed in source
- Interview-reported results only
- Legacy apps may lack tests
- Oversight disclosure unresolved
- Security
- Scope tool access per repository, keep secrets out of prompts, and log AI-generated changes for audit.
- Proof of value
- Baseline versus pilot time-to-remediate
- Regression rate of AI-drafted patches
- Share of flagged issues confirmed by humans
Delivery
Role takeaway
- Work
- Run a developer AI-security training cohort and an agency pathfinder program with first-pass AI, full human review.
- Dependencies
- Agency CIO sponsorship
- Vendor tool access and terms
- Test environments for legacy apps
- Ownership
- Chief data and AI officer, with agency CIOs owning their applications.
- Skills and adoption
- Pathfinder employees get a head start and then train their teams; developers learn to review and test AI-drafted fixes.
- Governance checkpoints
- Inventory entry for each AI tool
- Disclosure to IT oversight committee
- Human review before deploy
- Quarterly outcome report
- Acceptance criteria
- Baseline metrics captured before pilot
- Every AI-drafted patch reviewed and tested
- Quarterly report with remediation counts and regressions
- Risks
- Unmeasured success claims
- Oversight conflict over undisclosed tools
- Vendor lock-in across many apps
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
AI is applied to source-code scanning, attack-path modeling, generated Python checks and remediation across legacy applications, with hopes of driving CI/CD adoption. The article does not name the vendor tools or describe environment boundaries.
Governance
Who approves, reviews and stays accountable for outcomes?
The human-operator framing is a governance choice, but the article gives no detail on approval, inventory or legislative disclosure, which is the gap the Sep 30 hearing raised.
Security and privacy
What data, permissions and controls need testing?
Using AI to find and patch vulnerabilities across ~1,100 apps concentrates sensitive security information; access scope and vendor data handling are not described.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Pathfinder and paired-workshop models build skills from trusted non-early adopters; the stated aim is removing drudgery rather than cutting staff.
Procurement
What should contracts, pricing and exit terms secure?
Developer AI security tooling across a large legacy portfolio implies vendor dependence that should be reflected in contracts and exit terms.
Operating model
Which teams own the service once it runs?
A champion-led rollout with human review of every output is a transferable pattern, but should be paired with disclosure to oversight bodies.
Publication history
- 2026-10-04State Government · Issue 285 resources
Stable resource ID: vermont-raiche-power-tools-statescoop-20261002