Federal Tech Podcast: for innovators, entrepreneurs, and CEOs who want to increase reach and improve brand awareness
The federal government spends $90 billion on technology every year. If you are a tech innovator and want to expand your share of the market, this is the podcast for you to find new opportunities for growth. Every week, Federal Tech Podcast sits down with successful innovators who have solved complex computer system problems for federal agencies. They cover topics like Artificial Intelligence, Zero Trust, and the Hybrid Cloud. You can listen to the technical issues that concern federal agencies to see if you company’s capabilities can fit. The moderator, John Gilroy, is an award-winning lecturer at Georgetown University and has recorded over 1,000 interviews. His interviews are humorous and entertaining despite handing a serious topic. The podcast answers questions like . . . How can software companies work with the federal government? What are federal business opportunities? Who are the cloud providers who work with the federal government? Should I partner with a federal technology contractor? What is a federal reseller? Connect to John Gilroy on LinkedIn https://www.linkedin.com/in/john-gilroy/ Want to listen to other episodes? www.Federaltechpodcast.com
info_outline
Fed up with FedRAMP? How Knox Delivers Authorization in 90 Days
02/24/2026
Fed up with FedRAMP? How Knox Delivers Authorization in 90 Days
Connect to John Gilroy on LinkedIn Want to listen to other episodes? When people look back on 2025 they will see many changes in the FedRAMP process. It looks like a new administration examined the process, got feedback from companies, and launched new initiatives to speed up the process. During today’s interview, Irina Denisenko (Knox CEO) details FedRAMP’s challenges and something called “FedRAMP 20x.” Knox runs the largest FedRAMP-managed cloud, enabling 90-day authorizations by hosting customers’ production environments. Denisenko explains the story of the origin of Knox Systems: she was running a training company and the Air Force wanted to use her product. It would have taken so long to complete the FedRAMP requirements that she just bought a company that was FedRAMP compliant. It is hard to believe that the process is so frustrating that fewer than 500 apps are authorized at moderate/high FedRAMP The initiative from the GSA is called FedRAMP 20x It shifts to continuous monitoring and continuous authorization, moving from annual audits (sampled every 3 years) and monthly CVE spreadsheets to real-time, machine-readable data. What Knox offers is a tried-and-true platform that has reduced time for compliance in order to better serve federal needs.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40127380
info_outline
Fixing FedRAMP: How Automation Cuts ATO Time by 36 Weeks
02/17/2026
Fixing FedRAMP: How Automation Cuts ATO Time by 36 Weeks
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Way back in 2011, one of the goals of FedRAMP was to eliminate software redundancy. The federal government had evolved to the point where one agency would spend millions of dollars on the same application program that the agency in the same zip code had just invested heavily in. The theory proposed by luminaries like Vivek Kundra was to move to the cloud to share services. Reducing cost and improving resilience. FedRAMP was the initiative that established a safe environment for federal cloud use. Companies can comply with regulations outlined in an Authorization to Operate (ATO). Well, fifteen years later, and we are seeing the same duplication not in the application programs, but in the process to get the ATO itself. For example, FedRAMP, RMF, and agency internal policies may require specific artifacts to satisfy one or the other. During the interview, Travis Howerton paints the legacy model—static documentation, annual/3-year audits, spreadsheets. His solution is to have AI assist with documentation, which will drastically reduce compliance time; he cites an example of reducing a process from 52 weeks to 356 weeks. RegScale uses OSCAL (XML/YAML/JSON) to auto-generate RMF artifacts and integrate with SIEMs (Splunk, Elastic), Axonius, ServiceNow, and APIs. Howerton understands the limitations of many automated systems and suggests that a human is a key component after the machine language has assembled the data to make the decision.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40127480
info_outline
Ep 302 API attacks, discovery, and resilience for federal agencies
02/16/2026
Ep 302 API attacks, discovery, and resilience for federal agencies
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Cybersecurity is a rapidly evolving field, where every effective defense technique is quickly noticed and adapted to by malicious actors. The real question is how fast each side of this ongoing cat-and-mouse game can respond. Let us take an example of web applications. In the decade-long slog of the cloud, federal users migrated to web-based applications protected by Web Application Firewalls (WAFs). firewalls. As that method matured, malicious observers noted that the Application Programming Interface (API) allowed these software programs to communicate and exchange data. Voila, another attack vector was born. During today’s interview, Joe Henry from Akamai Technologies notes that 80% of their customers report API attacks. Henry details a curious term called “Broken-Object Level Authorization.” In this attack, an application fails to check if a user is authorized to access specific data objects. The ID is manipulated, and the malicious actor gets access. Akamai’s API Security performs behavioral analysis beyond WAFs, flags PII exposure, and supports a zero-trust posture. Software developers talk about a “shift left”; we apply that to the Akamai approach. They have a worldwide network of Points of Presence (POPs) and data centers where they can observe attacks as they develop. It is so strong that it provides fail-open resilience with a 100% SLA. Akamai provides (quarterly). If you would like to stay connected with the next manifestation of attack, consider subscribing or visiting their website to stay informed about the latest trend
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40124110
info_outline
Ep. 301 Edge Computing for Government: Rancher’s Role in Secure Hybrid Federal Environments
02/10/2026
Ep. 301 Edge Computing for Government: Rancher’s Role in Secure Hybrid Federal Environments
Twenty years ago, the concept of Bring Your Own Device (BYOD) entered the federal IT landscape with the advent of network-connected devices like Blackberries—sometimes even within secure federal networks. This slow start has exploded into a federal information technology system with sensors on satellites, submarines, and everywhere in between. That “in between” can include on-prem networks, multiple clouds, and hybrid clouds. Today, we sit down with Ryan Leiws, the CEO of Rancher Government Solutions, to look at some of the challenges in managing this dispersed environment and how to manage it. Lewis describes how Rancher connects hybrid environments using containers and Kubernetes for secure orchestration. Lewis emphasizes continuous compliance and DevSecOps via Rancher’s Carbide stack, SBOM-level visibility, and rapid recovery in contested, denied/disconnected/intermittent/limited (DDIL) environments. Lewis notes that Rancher’s declarative stack reduces maintenance and allows simple app redeployment. They also emphasize portability, cost efficiency, and alignment with zero-trust principles, with upcoming hardened features. = Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39893995
info_outline
Ep. 300 From Reactive to Initiative-taking: How Maximus Improves Federal Citizen Services with AI
02/05/2026
Ep. 300 From Reactive to Initiative-taking: How Maximus Improves Federal Citizen Services with AI
We began the interview with a startling fact. Maximus' federal systems interface with one in three Americans each year—about 110 million people. Building on Maximus’s broad reach, Pledger says the company’s core is designing world‑class digital experiences by starting with the end goal (e.g., veterans’ benefits) and using automation, AI, analytics, and omni‑channel outreach. We have all heard about improvements in systems; today, Pledger offers specifics on how health care can improve. He cites his own 2008 Iraq injury and notes veteran case durations historically ran three hundred to four hundred days; Maximus has reduced that to two hundred to 270 days, but still deems it too long. Maximus' success is due to its unique ability to leverage AI to drive this transformation. One approach is to partner with companies with vertical-market expertise. For instance, Maximus partners with Salesforce (CRM) and Genesis (telephony) to respond to complex medical cases. Example: outbound campaigns (text, email, AI‑generated calls) cut lapses; proactive engagement improves experience and reduces call‑center burden. Maximus is a story about a complex environment being tamed through understanding processes, applying technology, and making the right partnerships. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39894655
info_outline
Ep. 299 Wipers, Rogue AI, and Resilience: How Federal Agencies Can Respond and Recover from Attacks in 2026
02/03/2026
Ep. 299 Wipers, Rogue AI, and Resilience: How Federal Agencies Can Respond and Recover from Attacks in 2026
Everyone reading this has had minor delays at the airport. It is remarkable that more problems have not developed. Look at Chicago O’Hare International Airport—it has 857,392 takeoffs and landings in a year. Each one has passengers, and most have luggage. The opportunities for problems are overwhelming. Now add an increasing number of sensors and interlaced networks, and you have an attack surface of biblical proportions. All an adversary needs is one single point of vulnerability to attack a system. Think what could happen if an airport network were disabled by a ransomware attack. During today’s interview, Lou Karu makes suggestions for defense that include a multi-layered strategy emphasizing zero trust and network segmentation. However, Karu reminds us that a cybersecurity strategy is not complete without a robust recovery plan. For example, if a basic recovery plan was deployed, it is possible that a system can have compromised code locked into a backup. An airport suffers an attack, pays the ransom, and the recovered data has more attacks built in. Best practice here is to have a backup system that is rapid and accurate, and that restores the code without it being hot-infected with additional malicious code. Systems like this from Rubrik call these backups “immutable.” The next time you go to the airport, try to imagine the numerous attack points that an airport must contend with. Even the most robust cyber defense must include plans for safe, secure recovery. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39893980
info_outline
Ep. 298 Resilience by Design: Federal Cyber Predictions, AI-Driven Threats, and Immutable Backups with Rubrik
01/29/2026
Ep. 298 Resilience by Design: Federal Cyber Predictions, AI-Driven Threats, and Immutable Backups with Rubrik
Technology is changing so fast that it is impossible to predict the next twelve days. Despite that, we have asked Travis Rosiek, Public Sector CTO at Rubrik, to gaze into his crystal ball and make some predictions for the next twelve months. The good news is that Rosiek sees a shift from intellectual property theft to disruptive attacks on critical infrastructure. The bad news is that Rosiek thinks attacks are increasing to the point that an event will light a fire under the current cybersecurity plans. During the interview, the concept of Zero Trust was unpacked. The idea is that federal systems have already been breached. As a result, the focus must be on microsegmentation, with permission as the limiting factor. Roseik’s opinion is that malicious actors have planted code into systems that are acting as “sleepers.” At one time in the indeterminate future, this code can be invoked, and severe damage can take place. If this nightmare situation occurs, the best defense is to have recovery built in. Today, leaders must have a system in place to restore data from backups. Unfortunately, malicious actors know this plan as well and have been known to insert code into backups that renders them useless. In a complex game of attack and counterattack, Roseik believes that a recovery strategy that includes immutable backups and an audit mechanism is the best approach in the 21st-century world of threats and countermeasures. He also stressed the necessity of reducing complexity to enhance cybersecurity and the need for initiative-taking measures, including regular stress testing and resilience training. = = Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39848380
info_outline
Ep. 297 Seeing the Invisible: Using AI to Detect Threats in Encrypted Federal Networks
01/27/2026
Ep. 297 Seeing the Invisible: Using AI to Detect Threats in Encrypted Federal Networks
It is always tricky to compare commercial networking challenges with those faced by federal leaders. For example, the military and intelligence agencies require traffic encryption. How can an organization detect threats while observing this traffic? Today, we discuss Vectra AI's network threat detection capabilities with Wes Nagel, DoD sales manager, and Gage Cowger, a security engineer. With technology from Vectra AI, network traffic can be analyzed for timing, size, direction, and protocol use. These can give behavioral patterns for network visibility without worrying about encryption. Cowger will argue that behavioral patterns are more effective than signatures, especially in mitigating alert fatigue. Signatures can overwhelm monitors with false positives; Vectra's AI and ML capabilities provide trustworthy alerts. This ability positions Vectra AI to adapt to new networking initiatives, such as software-defined and OT/IoT networks, which will be prevalent in the future. The discussion also touches on the future of network detection, emphasizing the need for real-time, behavior-based detection to counteract advanced threats and adapt to evolving networks. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39848365
info_outline
Ep. 296 Securing the Federal Software Supply Chain: Why SBOMs aren’t enough
01/22/2026
Ep. 296 Securing the Federal Software Supply Chain: Why SBOMs aren’t enough
One of the biggest trends in software development over the past 10 years is the shift from writing code to “assembling” code from off-the-shelf components. During today’s interview with Javed Hasan from Lineaje, we learned that 70% of that pre-assembled code is open source. In other words, an anonymous person in some countries modified software instructions. This casual approach may be fine for small businesses, but an organization like the federal government must be highly cautious. Hasan describes how his company was one of the first to work with the federal government to set standards for this existing code. These initial efforts began ten years ago and resulted in Executive Order #14028, which requires a Software Bill of Materials for any organization selling to the federal government. This initiative expanded in 2021-2022 when NIST published related guidelines. These efforts are a good start. However, federal leaders must evaluate SBOM technology from many perspectives. For example, how to incorporate this mandate into air-gapped networks, legacy COTS, or even in a classified environment. System administrators also need to know if they are exposed. Further, every organization has a varying definition of what “deep software transparency” is. Hassan also discusses Lineage's innovative approach to creating "Gold open source" software, ensuring it is free of malware and vulnerabilities. If you are interested in seeing a demonstration of how Lineaje can help with software forensics, there is an event at the Carahsoft office in Reston, Virginia, on January 30 = = Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39841505
info_outline
Ep. 295 AWS leadership
01/20/2026
Ep. 295 AWS leadership
In the past 10 years, Amazon Web Services has gone from a niche player in the federal government to being responsible for billions in sales. One key aspect of this is how Amazon integrates leadership with innovation to address complex federal requirements. Today, we sit down with Andrew Christian to get an overview of concepts like customer obsession, working backwards, and the sixteen leadership principles that AWS implements to accomplish that drastic growth. ONE Customer-focus In the commercial marketplace, the concept of being “customer-focused” is certainly not breaking news. However, as Christian explains, AWS tries to understand (almost obsessively) what the requirements are for federal systems. No, technically, they are not “customers,” but they are the end users for any technology project. This focus has given AWS remarkable success in the commercial world, and when they apply it to federal technology, they can succeed where others have failed. TWO Working Backwards Christian explains that “working backwards” is a concept where a team is forced to write a mock press release and FAQ for a future project. This is before they build anything. This helps to clarify the customers’ needs by identifying gaps early. THREE encouraging innovations Many describe innovation as failing fast, then recovering. That may hold up in a commercial application where lives are not at stake. During the interview, Andrew Christian differentiates between the importance of making quick, reversible decisions (two-way doors) versus long-term, impactful ones (one-way doors). He encourages federal agencies to adopt these principles to enhance their innovation and adapt to a world co constantly changing technology. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39767165
info_outline
Ep. 294 From Defense to Offense: Proactive Strategies to Protect Federal Data
01/15/2026
Ep. 294 From Defense to Offense: Proactive Strategies to Protect Federal Data
One famous cartoon featured two vultures sitting on a fence; one turned to the other and said, “I am sick of waiting, let’s kill something.” When it comes to preventing cyberattacks, the federal government is well known for a defensive approach. They have security systems, air gap systems, and even a zero-trust approach. This defensive approach is essential but may not give the federal government a complete view of how to protect data. Today, we sat down with Chris Jones, Nightwing's Chief Technical Officer. He outlines some of the characteristics of a concept called “offense informs defense.” This is a method that Nightwing has developed through over 40 years of working with federal technology leaders. For example, they developed their Counter Trace service, which uses offensive cyber strategies to defend critical infrastructure. The service involves proactively hunting for vulnerabilities, identifying access points, and analyzing digital evidence to expose cyberattacks. During the interview, Jones mentions that the GSA has received this approach well. In fact, Nightwing recently won all six GSA Highly Adaptive Security Services categories. These handle security aspects like Penetration Testing, Incident Response, Risk Assessments, Cyber Hunt, and High Value Asses Assessments. Jones emphasizes the importance of initiative-taking, cybersecurity, AI integration, and collaboration across agencies to adapt to protect federal data.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39526100
info_outline
Ep. 293 Predictions for 2026 from Gitlab
01/13/2026
Ep. 293 Predictions for 2026 from Gitlab
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Today, we have an experienced tech veteran, Bob Stevens from GitLab, offering insights on how he sees the federal government overcoming three main technology challenges in 2026. Challenge ONE: Software improvement on scale. Stevens observed that everyone has seen AI's ability to review code. It has passed the basic phase, and now, in 2026, it cannot only review code but also identify security vulnerabilities, ensure compliance, and even generate documentation. This means that older, expensive-to-maintain systems can be transitioned to more flexible, economical cloud models. Challenge TWO: Going away from reacting. The word “continuous” has been the goal for cyber defenders for the past several years. Fortunately, AI is allowing that noble goal to be put into practice. When applied appropriately, newer technology can achieve lower breach rates and faster threat response times. Challenge THREE: emergence of a “universal” developer. Traditionally, requirements would be gathered by an intermediary and then translated into instructions for software developers. Stevens shows how newer AI-based approaches can eliminate that intermediary step. In other words, a pilot can precisely describe what they want in an avionics system, and the developers can work from that description. That means solving domain-specific problems with traditional development skills. Ideally, subject matter experts directly translate their knowledge into functional software systems. Some call this the “universal” developer approach. Stevens emphasized the importance of AI, security, and flexibility for future developers. GitLab's DevSecOps platform integrates AI across the entire software development process.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39713775
info_outline
Ep. 292 From Detection to Prevention: Using Technology to Reduce Fraud in Federal Programs
01/08/2026
Ep. 292 From Detection to Prevention: Using Technology to Reduce Fraud in Federal Programs
(We recorded this interview at Monk’s BBQ in lovely downtown Purcellville, VA) Connect to John Gilroy on LinkedIn Want to listen to other episodes? Defrauding the federal government is like the weather; everyone wants to complain, but nobody can do anything about it. For example, a joint DOL-SBA report from December 2024 revealed $2.3 billion in potentially fraudulent payments. Today, we sat down with Jeff Gallimore from Excella, where he will diagnose the problem of federal waste, fraud, and abuse. From there, he presents a solution that has already saved millions of dollars. The problem: too many silos From a data management perspective, most enterprise computational capabilities evolved through a federated approach. From a historical perspective, it makes sense that each agency would have its own computers and storage. It makes sense that individual data stores in this environment would be separated, or perhaps the word “siloed”, into distinct areas. Now, if you have one silo, you can protect it; if you have a thousand, then there is a problem. During the interview, Gallimore mentioned an agency that manages 9,000 grants. That is a lot of data to coordinate when it is stored in its “silos.” The solution: gap analysis Silos can be secure, but the architecture can allow for gaps in security coverage. These gaps, or seams, can allow fraudsters to exploit this structure. For example, an agency may have a division that has identified a person as a fraudster. If that information is not shared, this person can use the same exploit on another area of the agency. Further, interlinks between federated systems can allow adversaries to gain access. Excella has a profile of how they have managed to fill in the gaps in siloed data architecture.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39526060
info_outline
Ep. 291 Compliance Without the Bottleneck: Zero Trust in Federal Clouds
01/06/2026
Ep. 291 Compliance Without the Bottleneck: Zero Trust in Federal Clouds
Connect to John Gilroy on LinkedIn Want to listen to other episodes? When cloud computing was introduced, it was quite a simple concept: leverage other people’s hardware to scale easily. Not too much to manage. However, today’s cloud world has metastasized. Today, federal leaders live in a world of on-prem, multiple clouds, private clouds, hybrid clouds, and even sovereign clouds. Complications arise when they are burdened with compliance requirements and staff reductions. Today, we sat down with Ryan McArthur from Zscaler to discuss how to effectively manage a cloud environment when challenged with deploying Zero Trust. He begins by sharing his experience helping federal leaders understand the inherent risks of the VPN system. Few realize that VPN technology was first introduced by Microsoft back in 1996, and then popularized with Windows 4.0, which included built-in support. Thirty-year-old technology can present severe limitations. Unfortunately, the popularity of VPN technology increased with the demands of remote computing during COVID. We are now in a situation where many enterprises have built their architecture on this dated technology. Ryan mentions that one key to juggling clouds is to focus on the applications themselves. He emphasized Zscaler's ability to securely connect users. If you want more information about Zscaler, you should attend the Zscaler Public Sector Summit in March, where you can discuss and collaborate further.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39391770
info_outline
Ep. 290 AI + Zero Trust: The New Line of Defense for Federal Data
12/16/2025
Ep. 290 AI + Zero Trust: The New Line of Defense for Federal Data
Connect to John Gilroy on LinkedIn Want to listen to other episodes? We are at the point where AI is almost expected in any technology offering. Today, we sat down with John Kindervag from Illumio to learn how AI can be applied to the world of federal Zero Trust. Some have characterized today’s current cybersecurity situation as an arms race; some call it a whack-a-mole game. An innovative technology, such as AI, becomes popularized, and adversaries use it to improve attacks. As a result, the defenders of data must bolster their response, and they, in turn, use AI to defend. He highlights the importance of visibility, using AI to quickly parse logs, and the concept of dwell time, in which attackers can remain undetected for extended periods. To protect valuable data, Kindervag distinguishes between the attack surface and the defense surface. Although a malicious actor can instigate AI-driven attacks across any surface, sensitive information can be protected by thorough segmentation of the protected surface. During the interview, Kindervag provides tactics to manage legacy technology, fragmented data, and the critical topic of risk-averse culture.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39266770
info_outline
Ep. 289 How Microsegmentation and Zero Trust Protect Federal Data from Modern Threats
12/11/2025
Ep. 289 How Microsegmentation and Zero Trust Protect Federal Data from Modern Threats
Connect to John Gilroy on LinkedIn Want to listen to other episodes? It is rare to see AI applied to federal cybersecurity mandates. However, today, we will sit down with Louis Echenbaum from Color Tokens. He will unpack the concept of using AI to help federal leaders improve their ability to implement microsegmentation. We all know about Executive Order 14028 and the OMNB Memo M-22-09, which are forcing federal agencies to deploy a robust Zero Trust framework. The key components include identity and access management, asset management, continuous monitoring, and micro segmentation. During the interview, Louis Echenbaum expands on current challenges like legacy systems and visibility. For example, what happens once a malicious actor breaches a federal system? Some call this east-west traffic. The general response is to prioritize and segment data so the intruder is denied access. This concept looks good on paper, but in the real world, leaders encounter some issues. First, how can they know exactly what is on their network? This is perplexing in environments where endpoints are in areas that cannot be upgraded. Further, the move to a hybrid cloud offers varying levels of data segmentation. One system administrator may be competent with a specific cloud service provider but does not know all the details of another company. This skills gap can lead to coverage gaps and opportunities for attack. The solution Echenbaum suggests is to leverage AI to improve visibility and give leaders ways to prioritize datasets into appropriate microsegments.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39266735
info_outline
Ep. 288 Is Federal Data Ready for the Post-Quantum Era?
12/10/2025
Ep. 288 Is Federal Data Ready for the Post-Quantum Era?
Connect to John Gilroy on LinkedIn Want to listen to other episodes? In the world of federal technology we are being deluged with so much information about Artificial Intelligence that we may not see what some of other technologies that may have as great an impact as AI. The White House, the OMB (M-23-02), the Office of the National Cyber Director have made it clear that the time to prepare for post-quantum cryptography is now. Agencies are required to inventory cryptographic systems, prioritize high-value assets, and build migration plans in line with NIST standards. Today, we sit down with Eric Hay from Quantum Xchange to look at making this transition. During the interview, Hay handles issues like technology, operations and appropriate strategy. He highlights the role of NIST in developing and approving new algorithms like NIST PQC Post Quantum Encryption, ML, and CHEM. Eric explains the five-step process for transitioning to these new standards: discovery, prioritization, deployment, monitoring, and management. Rather than spending time evaluating algorithms, Eric Hay stresses the importance of a network-centric approach, suggesting that agencies focus on securing data transport first. Eric predicts Q day, when current encryption methods could be compromised, within 3-5 years, with some European partners aiming for 2029.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39266640
info_outline
Ep. 287 Protecting Federal Data with Zero Trust Architecture and the Enterprise Browser
12/09/2025
Ep. 287 Protecting Federal Data with Zero Trust Architecture and the Enterprise Browser
Connect to John Gilroy on LinkedIn Want to listen to other episodes? John Kindervag began the concept of Zero Trust; he probably did not realize the impact it would have on the technological community. Today, we look at the federal government and Zero Trust implementation from 40,000 feet. Kindervag will opine on topics such as browser security, the importance of data, and operational technology. Instead of using his technical knowledge as a cudgel, Kindervag reinforces the importance of a balanced approach in which federal leaders consider both technological and behavioral aspects of implementing Zero Trust. People with a basic understanding of Zero Trust can disregard the importance of data; he calls it the 'protect surface'. This involves identifying and securing the smallest space within the network, as well as the entire network itself. One missing link in the move to Zero Trust is Operational Technology. When looking at the Department of War, it has assets deployed all over the world. They have thousands of sensors that may or may not be part of a network. Kindervag suggests that when you have a protected surface that is a critical asset, which means it can be included in data sets. The interview ended with comments regarding the challenges of implementing zero trust, particularly the need for strong leadership and the potential of AI to enhance cybersecurity measures, while acknowledging the complexities of data classification and the evolving threat landscape. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39266630
info_outline
Ep. 286 Securing Federal Systems: The Power of Continuous Monitoring
12/04/2025
Ep. 286 Securing Federal Systems: The Power of Continuous Monitoring
Connect to John Gilroy on LinkedIn Want to listen to other episodes? A quick review of malicious activity shows large-scale cyberattacks being run without any human intervention. That means traditional penetration testing, which occurs once a year, can be easily defeated by massive, systematic attacks. During the interview with Snehal Antani, CEO of Horizon Three, he highlights the importance of continuous autonomous penetration. He suggests that it may be the only response to a non-human automated attack. Horizon3 has recently collaborated with the NSA’s Cybersecurity Collaboration Center to develop the Continuous Autonomous Penetration program. He details identifying critical vulnerabilities not only in federal systems, but also in the Defense Industrial Base.] Today’s cyber threat landscape is rapidly evolving, with artificial intelligence fueling a new wave of increasingly sophisticated attacks. Malicious actors now leverage AI to automate and scale their operations, resulting in large-scale, highly coordinated cyberattacks requiring little to no human oversight. This surge in automation on the offensive side has exposed a significant gap in the traditional cybersecurity strategies of federal agencies, which still largely rely on manual or scheduled defense mechanisms such as annual penetration testing. These legacy approaches are woefully inadequate against relentless, continuously evolving threats executed by automated tools that probe for weaknesses around the clock. Federal leaders, traditionally cautious about deploying automated systems for cybersecurity, now face a crucial crossroads. The old paradigm—where automation in cyber defense was seen as risky—must be reconsidered in light of real-world evidence that manual processes cannot keep pace with automated adversaries. In a recent interview, Snehal Antani, CEO of Horizon3, emphasized the critical need for continuous, autonomous penetration testing. He argued that just as attackers use automation to identify and exploit vulnerabilities at scale, defenders must employ similar automation to uncover and remediate those weaknesses swiftly and continuously. To advance this approach, Horizon3 has partnered with the NSA’s Cybersecurity Collaboration Center, launching the Continuous Autonomous Penetration program. This initiative aims to proactively identify critical vulnerabilities not just in federal government networks, but also across the Defense Industrial Base. By integrating automated, persistent penetration testing into daily operations, federal agencies can better defend against the nonstop, AI-driven threats now targeting every aspect of their infrastructure.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39265900
info_outline
Ep. 285 Securing the Federal Workplace: Why Enterprise Browsers are the Next Cybersecurity Frontier for Government Software Teams
12/02/2025
Ep. 285 Securing the Federal Workplace: Why Enterprise Browsers are the Next Cybersecurity Frontier for Government Software Teams
Connect to John Gilroy on LinkedIn Want to listen to other episodes? The good news is that federal security measures are preventing successful attacks; the bad news is that adversaries are examining every nook and cranny of a federal system and increasingly targeting the browser itself as an attack vector. During the interview, Scott “Monty” Montgomery gives a quick overview of Enterprise Browsers and Secure Enterprise Browsers. After all, browsers have been around since 1994. It may be the only application ubiquitous on home-based machines and in enterprise systems. They were not designed for security; they were intended to open the internet to the World Wide Web, full of images, links, and audio. Malicious actors did not have to focus on an app with limited use; by targeting a browser, they have almost unlimited targets to attack. Montgomery mentions the increase in browser-based attacks. In fact, they increased by 198% in the second half of 2023. Scott explains that phishing persists because people are curious or fearful, leading them to click on malicious links. A Secure Enterprise Browser can help prevent many common phishing exploits. Additionally, an SEB can support policies and controls. This means that an SEB fits completely with any current Zero Trust initiatives across all agencies. Beyond that, SEBs can be configured to manage legacy systems and even operate in low-bandwidth environments.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39200790
info_outline
Ep. 284 Automation That Keeps Agencies Running: Continuity Strategies for the Next Federal Shutdown
11/25/2025
Ep. 284 Automation That Keeps Agencies Running: Continuity Strategies for the Next Federal Shutdown
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Every federal agency prepares a backup strategy to protect data. This is a rigorous endeavor in which teams practice what to do in the event of a breach or system failure. However, nobody really has a plan for a temporary federal shutdown. Any political pundit worth his salt knows there will be another federal shutdown sometime in the future. It is reasonable to consider automation to see how it can be used to bridge services during a temporary shutdown. David Grundy is the Public Sector CTO for Tines. He has decades of experience in and outside the federal government. He highlights the challenges of human-centered workflows. For example, just because the staff is reduced does not mean attackers will take the day off. Adversaries work 365 days a year and are immune to political infighting. Based on David Grundy’s experience, an agency should start with visibility to know which workflows exist. From there, document processing can be detailed, enabling scaling. During the interview, Grundy shares his experience in a federal agency that had to make digital transitions while complying with federal regulations. He is optimistic that operational resilience can be achieved through initiative-taking by all federal agencies.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39165410
info_outline
Ep. 282 the Hidden Cyber Gaps Threatening America’s Digital Infrastructure
11/21/2025
Ep. 282 the Hidden Cyber Gaps Threatening America’s Digital Infrastructure
Connect to John Gilroy on LinkedIn Want to listen to other episodes? In a recent report from Microsoft, they share that foreign adversaries are increasing attacks on American infrastructure. One variation is that they will not penetrate systems and attack, but they will steal credentials and install code to act in stealth mode. This code can hide for years and be deployed when the antagonist wants. Today, we sat down with Travis Roseik from Rubrik to try to find some options for defending against this hidden attack. Let us say an agency has improved its resistance to foreign attacks. This is satisfactory progress, but what happens in a situation where the malicious code was planted prior to the increased defense. Further, during the interview, Roseik states that companies may be able to leverage AI to improve defense, nation states will be using that same AI to improve attack methods. If malicious code is within the walls of an organization, whether by AI or user error, Roseik makes the point that a defensive posture may not be enough in today’s sophisticated world of attack. He recommends moving from a defensive approach to an initiative-taking threat hunting strategy. Even if Zero Trust and threat hunting fail, the best response is to have immutable backups. For example, if a breach occurs and the system recovers quickly, then the attackers will go after more vulnerable targets. The conversation underscores the urgency for organizations to adapt and innovate to counteract these threats.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39121695
info_outline
Ep. 283 Smarter, Scalable Threat Hunting to Protect Federal Data
11/19/2025
Ep. 283 Smarter, Scalable Threat Hunting to Protect Federal Data
Connect to John Gilroy on LinkedIn Want to listen to other episodes? The federal government recognizes that threats are multiplying at an exponential level. In fact, in October 2025, CISA released a free vulnerability scanner, and 10,000 organizations have signed up. Today, CISA is at its current capacity. Today, we examine solutions from a successful startup called CrunchAtlas. One of the co-founders, Ben Fabrelle, will share with the audience his experience in threat hunting in the federal government and why he combined with another veteran to form a company that can assist in threat intelligence, data analysis, and automation. During the interview, Fabrelle says that CrunchAtlas likes to attack “wicked” complex problems. One of the most complicated problems the federal government has is identifying threats in a world where the DoD is being attacked by malicious actors every day. Fabrelle suggests that the solution is a persistent cyber-hunt platform. It can search for threats in a wide range of environments. This means it can be deployed on-prem, in the cloud, or in an air-gapped environment. The founders view that a platform approach is the best way to scale against these adversaries. One of the key differentiators for CrunchAtlas is its ability to operate in the cloud, on-prem, and even in an air-gapped environment. In fact, their offering’s code stack, from design, operates in an air-gapped environment. Automation in this kind of environment will allow for a reduction in false positives, which will, in turn, reduce fatigue and decrease the need for human threat hunters.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39092825
info_outline
Ep. 280 How Zero Trust Automation Helps Federal Agencies do More with Less
11/06/2025
Ep. 280 How Zero Trust Automation Helps Federal Agencies do More with Less
Ep. 281 How Zero Trust Automation Helps Federal Agencies do More with Less Connect to John Gilroy on LinkedIn Want to listen to other episodes? As this interview was recorded, the federal government was in the middle of a shutdown. Hundreds of pundits have given interviews about the politics of the situation; very few have looked at the impact on cybersecurity during a phase of workforce reduction. Today, we sat down with Gary Barlet, the Public Sector CTO at Illumio, to see whether Zero Trust can help the federal government bridge this short personnel gap. Barlet begins by giving an overview of Zero Trust and automation. Rather than having human beings vet entry into federal systems, the concept is to use an automated process that reviews credentials and decides on permission. Barlet emphasizes the importance of Zero Trust in automating security tasks and maintaining operational resilience, especially with reduced staff. He continues to mention several other benefits of Zero Trust in a federal environment. Compliance: A well-thought-out Zero Trust architecture will enable managers to collect data to demonstrate policy enforcement. Legacy: One can effectively take existing systems and “ring fence” them off. This approach creates hundreds and hundreds of rings of defense. Design: During the interview, Gary recommends that you have a handle on the real traffic to reduce complexity. That way, when policies change, the rules can adapt to the environment. Maturity Level: Although CISA has a maturity level for Zero Trust. Barlet distills down some of the requirements for which efforts can be applied to sensitive systems. He suggests focusing on security, not necessarily on a grade. Additionally, he addresses the challenges of managing complex, hybrid environments and the emergence of shadow AI models, stressing the need for robust policies and controls.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/38937235
info_outline
Ep. 281 AI-Powered Application Risk Management
11/05/2025
Ep. 281 AI-Powered Application Risk Management
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Today, we sat down with Chris Wysopal from Veracode to talk about how to leverage the power of AI to increase productivity in federal systems. It seems like every headline you read talks about AI speeding up the process of writing code. However, there may be mixed messages here. Wysopan read some academic reports that talked about vulnerabilities being introduced in human code as well as AI code. Because this has been a concern for a while, He initiated the Gen AI Code Security report. They examined a wide range of LLMs to get a fair overview. They discovered 45% introduced vulnerabilities. What is even more shocking is this is similar to the rate from regular, old, garden variety software developers. You can get more details from the Veracode's 2025 Gen AI Code Security Report. It details methodology and notes despite improvements in syntax; security remains a concern. When he presented at a recent Billington Cyber Summit, he was deluged with people interested in problems with AI generated code. The overview is Implement a centralized risk management approach to prioritize and address the most critical vulnerabilities.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/38807025
info_outline
Ep. 279 Avoiding Agentic AI Pitfalls in Federal Digital Transformation
11/04/2025
Ep. 279 Avoiding Agentic AI Pitfalls in Federal Digital Transformation
A recent study from Carnegie Mellon University is titled "AI Agents Fail at Office Tasks Nearly 70% of the Time." Federal agencies are adopting Agentic AI for the efficiency it can deliver. Unfortunately, many do not realize that Agentic AI is prone to operational risks, ranging from technical glitches to legal complications to accidental database deletion. When Agentic AI causes problems at a federal agency, there can be lives at stake. Today, we sat down with Travis Rosiek, Rubrik's Public Sector Chief Technology Officer. During the interview, he explores the federal challenges of implementing Agentic AI, building an Agentic AI inventory, and making Agentic AI visible, auditable, and reversible. CHALLENGES Everyone —from a systems administrator to an agency administrator —knows that data must be backed up. However, very few understand that Agentic AI is a collection of agents that can be attacked, just like a database. Rubrik offers the capability to reassure users that Agentic AI can be reversed if malicious actors enter the picture. STARTING POINT Most cybersecurity professionals agree that one starts by understanding a system's apps, data, and connections. Five years ago, it was easy; getting a grasp on what Agentic AI connects to is a much more intangible concept. During the interview, Travis Rosiek unpacks Rubrik's history and its unique ability to understand complex systems. CAREFUL In a rather shocking statement, Rosiek says one should approach introducing technology with the assumption that it will fail. This is not a pessimistic approach, but a nuanced understanding of how complexities in current systems can lead to unintended consequences. Rosiek advises starting with the end goal in mind, planning for worst-case scenarios, and building trustworthy AI architectures to mitigate risks and ensure reliable operations.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/38806900
info_outline
Ep. 277 How Elastic Helps Federal Agencies Navigate Federal Procurement Modernization
10/28/2025
Ep. 277 How Elastic Helps Federal Agencies Navigate Federal Procurement Modernization
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Elastic has been around since 2012 and has been gradually gaining traction in the commercial world. In fact, Elastic has recently signed agreements with Nvidia and Google to improve integration with its distributed search analysis. All this assists with AI search and observability. Today, we sat down with Chris Thompson from Elastic to highlight how commercial success can be applied to the federal world. Looking back at his decades of work with federal agencies, he sees one of the problems in acquisition. In a world of rapid change, it is challenging to acquire technology that can keep pace with the fast pace of change. During the interview, Thompson discusses a recent strategic agreement developed by Elastic working with the GSA and other companies. This streamlines the process of providing technology to federal professionals. This agreement accomplished several tasks at once: >>It leverages the GSA’s collective buying power. Rather than negotiating separate prices for dozens of agencies, it has substantial discounts with all the major cloud providers. >>> It reduces duplication. We know several federal agencies are facing similar tech challenges. Rather than duplicating requirements gathering and testing before making a purchase, the GSA approach eliminates this duplicative process. >>With numerous AI tools flooding the market, this agreement enables the accelerated use of these tools. >> When you have standardized contracts, enhanced security is typically the result. No contract is perfect, and people who have developed this agreement know it is a living document that can flex and adapt to technical situations as they arise. GSA officials have stated this is an evolving approach, giving it the ability to adapt to innovative technology, new companies, and a rapidly changing cyber threat.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/38724645
info_outline
Ep. 278 How to deliver Secure, Compliant, and Scalable Cloud Databases for Federal Missions
10/28/2025
Ep. 278 How to deliver Secure, Compliant, and Scalable Cloud Databases for Federal Missions
Connect to John Gilroy on LinkedIn Want to listen to other episodes? MongoDB has spent years earning a formidable reputation in the developer world; today, we will unpack some of its capabilities for project managers and federal leaders so they can understand where MongoDB may fit in their stack. Conventional wisdom is that MongoDB is a flexible open-source database. Although that is true, this does not do justice to some characteristics that will appeal to the federal audience. ONE: An agency may have restrictions on where the cloud is not suitable for storage. Because of its ability to use flexible, JSON-like documents, MongoDB has listened to those needs and can have storage in many varying regions. In fact, we have seen a movement to move cloud applications back on premises. MongoDB provides flexibility for working in both hybrid and on-premises environments. TWO: Most readers have studied encryption and think of it primarily as data at rest. Cloud storage transitions have forced a method where data is encrypted during transit. MongoDB can take encrypted data and search while it remains encrypted. Some will describe encryption at rest, in transit, and now, data in use. THREE MongoDB has listened to the federal community and is offering something called MongoDB Atlas for Government. It is a secure, fully managed cloud database service for U.S. Government agencies to modernize applications and oversee sensitive data. During the interview, Ben Cephalo revealed the effort MongoDB is making to serve federal agencies that require FedRAMP high capabilities.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/38724155
info_outline
Ep. 276 Model Context Protocol, Agentic AI, and the Future of Federal Software Integration
10/23/2025
Ep. 276 Model Context Protocol, Agentic AI, and the Future of Federal Software Integration
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Many listeners have become so familiar with AI that they may have assumed it has been around for decades. Today, we sat down with Will Angel from Excella to explore the application of AI to federal technology from a more nuanced perspective. We dive into three main aspects of AI: challenges of integrating AI services, Model Context Protocol, and security considerations with agentic systems. Challenges: No company has grown as fast as ChatGPT; in fact, it is the fastest-adopted consumer application in history. Today, it has an estimated eight hundred million weekly users. This has attracted developers who work on federal projects. Wil Angel recommends careful consideration of people arbitrarily porting data to or from products like ChatGPT because it can compromise data security. MCP In certain circles, the term “Model Context Protocol” is used constantly. It has become so popular that people do not realize it was just coined by Anthropic in November of 2024. During the interview, Angel presents variations on MCP for software development and warns about the hype surrounding the relatively new standard for AI systems. Agentic AI Autonomous systems have been the holy grail for every software developer. The promise of Agentic AI is so powerful that some have jumped into applications without a more prudent approach. When a series of tasks is assembled, unintended consequences can come into play. It is one thing in the commercial world to reveal essential data; it is a completely different situation when the DoD is dealing with life and death situations. Angel predicts significant changes in AI over the next few years, with large language models revolutionizing software systems.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/38724345
info_outline
Ep. 275 Securing Federal Data: The Evolution from Zero Trust to Least Permissive Trust
10/16/2025
Ep. 275 Securing Federal Data: The Evolution from Zero Trust to Least Permissive Trust
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Sometimes, the plow must go deeper. Current approaches to Zeer Trust implementation can leave gaps in security. Today, we sat down with Akamai’s Mike Colson to discuss the concept of combining Identity Credential Access Management with Least Permissive Trust. Setting the stage, Mike Colson details some of the challenges in the varying kinds of Zero Trust that are being applied in the Federal Government. The standard way of implementing ICM can result in assigning more resources than necessary, leading to permission creep and inflexible permission. Over provisioning: The amount of data being created is almost impossible to manage. A person may be given access to a data set they are not permitted to see. A “just in time” permission structure would help avoid that situation. Stale: Just because a person has access to a data set on a Tuesday does not mean he has access on a Wednesday. People can leave the workforce, be reassigned, or change roles. Access must be constantly updated. Static: Ron Popiel made the phrase, “Set it and forget it,” memorable. Unfortunately, this approach can lead to a permission structure that may limit access to key data. This may be considered under-provisioning, potentially leading to time delays in obtaining key information. Colson took the listeners through several iterations of access control, including Role-Based Access Control and Attribute-Based Access Control. On top of these old favorites, Colson discussed what may be called Context-Based Access Control, or what he calls Least Permissive Trust. Least permissive trust is a concept Colson outlined, which uses user behavior, device health, and contextual factors to grant permission dynamically. The conclusion is simple: not all Zero Trust is created equal.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/38563855