# AI Deployment and Cyber Governance Failures in Public-Sector Organizations: A Typological Analysis

arXiv: https://arxiv.org/abs/2607.25368 · HTML: https://mlsanity.com/paper/2607.25368/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 4 of its 33 references that are in the map.
- First posted on arXiv 28 Jul 2026.

## Builds on (most cited first, 4 of 4)

- [Spear Phishing With Large Language Models](https://mlsanity.com/paper/2305.06972/) (2023)
- [Oversight Structures for Agentic AI in Public-Sector Organizations](https://mlsanity.com/paper/2506.04836/) (2025)
- [SAIF: A Comprehensive Framework for Evaluating the Risks of Generative AI in the Public Sector](https://mlsanity.com/paper/2501.08814/) (2025)
- [Governing frontier general-purpose AI in the public sector: adaptive risk management and policy capacity under uncertainty through 2030](https://mlsanity.com/paper/2604.06215/) (2026)

## Abstract (arXiv)

The intersection of artificial intelligence adoption, cybersecurity governance, and public sector institutional constraints has not been examined as a unified analytical problem in the existing literature. Studies address AI cybersecurity risks generically, public sector governance independently, and framework adequacy separately. Existing studies have not integrated these three streams to explain specifically how AI adoption causes cybersecurity governance failure in government organizations, nor test existing governance instruments against AI-specific public sector failure causes. This paper ad-dresses that gap. It proposes a seven-domain typology identifying ten specific AI-driven cyber governance failure causes grounded in public sector institutional analysis. It presents a three-pathway failure model showing how accountability failure, opera-tional resilience failure, and compliance failure interact and reinforce each other. It de-livers a structured coverage matrix testing five major governance frameworks (NIST CSF 2.0, ISO/IEC 27001, COBIT, NIST AI RMF, and ISO/IEC 42001) against the typology, finding that no instrument addresses Shadow AI, speed asymmetry, or gov-ernance vacuum at the operational specificity required for public sector application. The paper introduces speed asymmetry as a named structural construct with a specified mechanism. The framework provides the design specification for an AI-enabled cyber-security maturity model for government organizations.