Oklahoma’s Bold AI Leap: Transforming Cybersecurity with Powerful New Tool

Summary

• Oklahoma’s Move: The state’s security team is letting an AI system investigate and respond to threats on its own.
• Cyber AI Analyst: Built by Darktrace, the tool triages alerts and can take response actions in real time.
• How It Learns: It uses self-learning models that adapt to the state’s own network.
• Statewide Reach: The goal is to protect government data and systems across Oklahoma.
• For Other States: Oklahoma’s experience offers a test case for states weighing AI in their security operations.

Oklahoma hands triage to an AI analyst

Oklahoma’s state security team has put an AI system to work inside its security operations. The Office of Management and Enterprise Services (OMES) uses it to sort and investigate alerts across state government networks, which face a steady stream of attacks.

What Darktrace’s Cyber AI Analyst does

The tool is Darktrace’s Cyber AI Analyst, an agentic system. It does not just raise alerts. It investigates them, groups related events into incidents, ranks them and can take limited actions, such as putting a suspicious device on timeout. Signature-based tools look for known patterns; this one uses self-learning models that build a picture of normal activity on the state’s own network and flag what departs from it.

The numbers are the selling point. According to Darktrace and StateScoop, in January 2025 the system boiled 3,142 alerts down to 162 incidents, 18 of them critical, saving the team an estimated 2,561 hours of investigation.

Coverage across state agencies

OMES protects systems that hold the personal information of millions of Oklahomans, from agency databases to services used by schools and health programs. A small team cannot read every alert by hand. Automated triage lets analysts spend their time on the incidents that matter.

Oklahoma moved the tool from a mode where humans confirmed each action to autonomous operation, within preset limits. That step is what makes the deployment stand out.

What other states can learn

Other states are watching. Many state security teams are short-staffed and buried in alerts, which is the exact problem Oklahoma is using AI to solve.

The harder questions are about control. How much autonomy should a tool have on a government network, and who reviews its actions? Oklahoma’s answer, autonomy inside defined limits, is one model other states can study before trying it.

What to watch next

Results over a full year will tell more than one month of numbers. False positives, missed incidents and staff trust in the tool all need tracking.

If the time savings hold, expect other states to follow.

For now, Oklahoma is one of the first state governments to let an AI analyst act on its own. Its experience will shape how others write their own rules.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.