Challenge
The United States faces extensive, unbounded risk to its national security and critical infrastructure (NS&CI) missions because of widespread dependence on largely inscrutable third-party and legacy software whose behavior cannot be verified. Assessing and mitigating this risk requires “software understanding,” the ability to construct and assess software-controlled systems to verify their functionality, safety, and security across all conditions. The ability to create software greatly outstrips our ability to understand it, and current methods such as dynamic testing, digital signatures, software bills of materials, and attestation provide insufficient evidence for confidence in mission critical systems. The consequences are concrete and severe, from the Therac-25 radiation deaths to the SolarWinds and Log4j compromises to the PRC’s Volt Typhoon prepositioning in U.S. critical infrastructure. Without a coordinated national capability, the nation accepts unknown and unbounded mission risk in the very systems on which deterrence, public safety, and economic prosperity depend.
AI Solution
Software understanding today is a largely manual, artisanal practice, with experts reverse-engineering systems by hand. Subject-matter experts estimate that a mature software understanding ecosystem would improve capabilities by 10x-100x but take decades to build using traditional, manual software engineering approaches. AI-enabled tools will compress that timeline into years and is already transforming the field into a science. By coupling agentic AI’s inductive reasoning with rigorous, mathematically-grounded deductive tools, AI agents will orchestrate end-to-end analysis campaigns, autonomously decomposing high-level mission questions into focused sub-analyses, selecting and synthesizing analysis tools, and composing technical evidence packages. This ecosystem will revolutionize third-party and supply chain software assurance, enhance reverse engineering capabilities to recover meaning from stripped firmware, and enable entirely new analytical capabilities and fields of inquiry in formal methods, computer science, risk sciences, and cyber-physical modeling.
Justification
Verifying the software on which NS&CI systems run is core to the Department of Homeland Security’s mission. DHS has led the national effort in software understanding, building the technical roadmap that defines the field and working directly with the analysts who confront inscrutable software daily. The Department of Energy’s high performance computing, experience in high consequence environments, and coordination of the National Laboratories will enable a shared, federated ecosystem, unlocking new mission possibilities through interoperable software analysis capabilities. DHS’ secure capabilities enable the use of unique, high-consequence datasets not otherwise accessible to commercially available models. The Department of War brings mission insight into how unclassified proxies align with its mission critical systems, as well as an initial path-finder activity exploring how agentic neuro-symbolic hybrid systems can reason about such software in energy-efficient ways.
National Impact
Accelerating software understanding will enhance cybersecurity of American critical infrastructure, speed the development and qualification of software systems for secure and high-consequence environments, and promote higher-quality software development. The economic stakes are immense, with the cost of poor software quality in the United States estimated to be at least $2.41 trillion in 2022. For national security, software understanding hardens critical infrastructure against state-sponsored activity and underpins every U.S. deterrent capability, from conventional and nuclear forces to economic tariffs and sanctions.
This was last updated .