Federal Tech Podcast: for innovators, entrepreneurs, and CEOs who want to increase reach and improve brand awareness
The federal government spends $90 billion on technology every year. If you are a tech innovator and want to expand your share of the market, this is the podcast for you to find new opportunities for growth. Every week, Federal Tech Podcast sits down with successful innovators who have solved complex computer system problems for federal agencies. They cover topics like Artificial Intelligence, Zero Trust, and the Hybrid Cloud. You can listen to the technical issues that concern federal agencies to see if you company’s capabilities can fit. The moderator, John Gilroy, is an award-winning lecturer at Georgetown University and has recorded over 1,000 interviews. His interviews are humorous and entertaining despite handing a serious topic. The podcast answers questions like . . . How can software companies work with the federal government? What are federal business opportunities? Who are the cloud providers who work with the federal government? Should I partner with a federal technology contractor? What is a federal reseller? Connect to John Gilroy on LinkedIn https://www.linkedin.com/in/john-gilroy/ Want to listen to other episodes? www.Federaltechpodcast.com
info_outline
Ep. 323 AI Threat Detection and Federal Cybersecurity Trends
05/21/2026
Ep. 323 AI Threat Detection and Federal Cybersecurity Trends
Connect to John Gilroy on LinkedIn Everyone seems to have an opinion on AI. Today, we interviewed Levi Gundert, the Chief Security and Intelligence Officer for Recorded Future. He thinks that AI gives federal leaders an opportunity to fight back. For example, one aspect of cybersecurity is velocity; the number of attacks has expanded exponentially. Gundert thinks this is an opportunity to match this attack's velocity. Many will balk at this opinion. They will describe federal data as challenged in cross-domain sharing, data labeling, and data trapped in PDFs or legacy systems. During the interview, in a refreshing observation, Gundert observes that defenders have always been on the back foot. Always in defense. Finally, AI can give tools that level the playing field. One application of AI is the ingestion of the data provided to federal systems. AI can be used to provide actionable intelligence. In some systems, this deluge can result in false alerts. When used properly, AI can filter through the signal and identify what is critical. Gundert emphasizes the need for automation and decision advantages in threat intelligence, the challenges of data fragmentation and legacy systems, and the urgency of upgrading systems to address vulnerabilities. They also touch on the role of AI in insider threats, the potential of Mythos to increase vulnerabilities, and the importance of sharing threat information to enhance cybersecurity.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/41347320
info_outline
Ep. 322 Mattermost Secures Mission Critical Federal Collaboration
05/19/2026
Ep. 322 Mattermost Secures Mission Critical Federal Collaboration
Ep. 322 Mattermost Secures Mission Critical Federal Collaboration Connect to John Gilroy on LinkedIn Want to listen to other episodes? The federal government has an unbelievably wide network. We all know about the IRS citizen-facing websites. We log in from our homes, the server is in the cloud somewhere, and we file our taxes. At the other end of the spectrum is the military and intelligence community. The military talks about a “contested” environment. This can be in Low Earth Orbit or can be underwater in a submarine. There are no simple connections in that world. Yet users demand security in a world constantly under attack and disconnected. Resilience means they must not lose packets of information. Also, just to make it interesting, this can be a life-or-death situation. Into this demanding world steps Corey Hulen, founder and CTO of Mattermost. Their mission is to provide collaboration software designed for high-trust, high-risk environments, including even air-gapped network components. The software emphasizes resilience in contested environments, ensuring collaboration continues even when network connections are lost. Hulin highlights the importance of both security and compliance, noting the challenges of meeting multiple regulatory standards. He also addresses the need for AI to support human decision-making in mission-critical scenarios, ensuring quick, informed responses.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/41330485
info_outline
Ep. 321 Skills-Based Hiring and AI in Federal Government HR
05/12/2026
Ep. 321 Skills-Based Hiring and AI in Federal Government HR
Want to listen to other episodes? Today we sit down with an HR company, Workday, to see if it can transfer the success it has had in the commercial world into helping federal agencies reach ambitious goals. Matthew Cornelius works for Workday, but he has spent mor than a decade working in a wider variety of federal agencies. The interview covers topics like the shift towards skills-based hiring, the challenges of outdated HR systems, and the need for comprehensive workforce data. One concern is that the applicant can report skills. One candidate’s Python experience may differ greatly from another’s. Presidential administrations have encouraged the concept of skills-based hiring. However, this is a subject that is difficult to implement. For example, it can clash with the standard GSA classification system. Today’s AI skills are changing so rapidly, it would be almost impossible for an HR person to understand what skill sets are important. Cornelius has firsthand experience in federal HR systems that are dated. He references using Excel spreadsheets that can have issues with version control and backup. One great place to start is to use a system than can give an HR manager a “birds eye” view of the skills of their current employees. He emphasizes the importance of communication, empathy, and leveraging modern HR technology to improve federal HR processes and outcomes.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/41261760
info_outline
Ep. 320 How to Mean Time to Resolution for Federal Systems
05/07/2026
Ep. 320 How to Mean Time to Resolution for Federal Systems
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Two of the least well-known, but most important acronyms in federal technology are ITSM and ITOM. IT Service Management focuses on services and user experience, while IT Operations Management focuses on technical performance and monitoring. These two concepts are the backbone for maintaining the massive federal IT systems we see everywhere. Today, we sat down with Seth Gardner from BMC Helix, who details how BMC Helix can provide insights for service management. He starts with the importance of visibility and generating clean, reusable data for AI. Gardner maintains AI is only as good as the data behind it—and most federal agencies are still “re-wrangling” fragmented systems. In this episode, BMC Helix explains how correlating incidents across 12+ tools can pinpoint root cause and dramatically reduce mean time to resolution. He also touches on the importance of data sovereignty and security in multi-tenant environments. The conversation concludes with Seth outlining BMC Helix's differentiator in adapting to rapid technological changes.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/41127440
info_outline
Ep. 319 Data Control Is Redefining Federal Security Strategy Now
05/05/2026
Ep. 319 Data Control Is Redefining Federal Security Strategy Now
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Angel Smith, President of Global Public Sector at Virtru, discussed the challenges of data interoperability in federal agencies, emphasizing that trust and policy issues often hinder data sharing more than technology. It took several years, but the federal government has realized that its defenses are not perfect and has had to adopt a zero-trust approach to limit access to important information. Zero Trust is Missing the Point During the interview, Angel Smith argues that Zero Trust seems to focus on the network and identity, rather than on data. While intended to secure infrastructure, these changes can create new attack vectors. Data Sovereignty is broken. Traditionally, a data set would reside in a hard drive in a server room down the hall. Because of this, thinking about security can be focused on the physical location of the data or its sovereignty. Sometimes, a strategic approach is necessary to protect data. This is an outdated approach because data can be protected by the data object itself, which can carry control. Security vs. Speed is a False Tradeoff. This legacy thinking also applies to security. Some will exist to control data because it has been viewed as too time-consuming. Smith also stressed the need for modern data governance to enable AI and other advanced technologies, advocating for a rethinking of legacy practices to enhance data security and usability without compromising mission speed.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/41127400
info_outline
Ep 318 Securing Millions of Federal Endpoints in the AI Era
04/28/2026
Ep 318 Securing Millions of Federal Endpoints in the AI Era
Connect to John Gilroy on LinkedIn Want to listen to other episodes? There is a popular podcast in the Washington, D.C. area called “Feds at the Edge.” The title alone acknowledges the importance of edge devices for the sprawling federal government. Today, we sat down with Tommy Gardner from HP to discuss the challenges of securing millions of endpoints in the federal government, including legacy systems and operational technology (OT). When it comes to OT, Gardner makes a shocking observation: if you take an endpoint, like a sensor in a boiler, and it gets compromised, it could shut down the refinery, and people could get hurt. That is why HP has developed a system called the Workforce Experience Platform (WXP), which manages diverse devices and applies updates remotely. One little-known fact Gardner brings up is that, when malicious actors assess vulnerabilities, the easiest way to get into a network is through the printer. In fact, HP now offers printers with defenses against post-quantum encryption. Given that a company like HP has thousands of products, the supply chain is a major consideration. During the interview, Gardner mentions that HP has over 10,000 vendors in its supply chain. He addresses the complexities of supply chain security, emphasizing the need for rigorous vendor verification and compliance with the Trade Act. He concludes by advocating for AI at the edge for real-time decision-making and cost efficiency.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/41044755
info_outline
Ep 317 Mission-Driven AI Modernization in Federal Health Systems
04/24/2026
Ep 317 Mission-Driven AI Modernization in Federal Health Systems
Connect to John Gilroy on LinkedIn Want to listen to other episodes? The Veterans Administration is a system with nine million enrolled veterans across 1,300 facilities. In a system like that, downtime is not an option. Today, we look at how a company successfully reduced documentation time, increasing adoption in one part of this massive system. We sat down with Nilanjan Sengupta from Thoughtworks to learn which methods proved successful. He began by stating the focus must not be on bits and bytes, but on mission outcomes. For example, for years, clinicians spent 10–20 minutes per patient on documentation, often taking 2 or more hours to leave their shift. Sengupta highlights a successful pilot of AI ambient scribe technology at the VA to address this issue. It was so successful that it achieved an 86% adoption rate among primary care providers. During the interview, Sengupta outlined topics such as the importance of data governance, trust infrastructure, and a responsible AI strategy. He emphasized the need for a well-governed data discovery process and a cultural shift towards treating data as a mission-critical product.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40973885
info_outline
Ep. 316 AI Supply Chain Risks Every Federal Leader Must Know
04/22/2026
Ep. 316 AI Supply Chain Risks Every Federal Leader Must Know
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Interest in technology comes in waves. Back in 2022, managing the supply chain became number one on the list of priorities for federal technology leaders. Since then, we have seen a huge cycle of AI dominating the federal government's attention span. This shift in focus may be causing you to overlook other critical supply chain concerns. Today, we sat down with Bob Kolasky from Exiger. His company got its start by helping the Department of Justice monitor HSBC, a large financial management company. That led to a successful reputation, prompting other federal agencies to ask for their help. During today’s interview, Kolasky gives an overview of due diligence, continuous monitoring, and risk management. He argues that AI-driven supply chain insights reveal hidden risks, fraud, and vulnerabilities that impact federal agencies and contractors. With attacks occurring so rapidly, Kolaksy expands on the application of continuous monitoring across the entire supply chain. He uses the term “illuminate” to describe the technology Exiger offers that can carefully examine all aspects of the supply chain. Exiger’s technology is so advanced that it can look at unstructured data, sanctions lists, adverse media, ownership records, and trade data. With that amount of information, systems must be put in place to ferret out abnormalities and prepare for the next wave of supply chain attacks. = = =
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40972385
info_outline
Ep. 315 Behavioral AI Stops Advanced Federal Phishing Attacks
04/16/2026
Ep. 315 Behavioral AI Stops Advanced Federal Phishing Attacks
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Sending deceptive email has been around for decades. It has gone from a Nigerian prince asking for financial assistance to 10,000 people. Today, phishing isn’t ‘spray and pray’ anymore—AI is creating hyper-personalized emails that look exactly like someone you trust. Today, we sat down with Patricia Titus from Abnormal AI to learn how the correct response to an enhanced AI phishing attack. Some may shock you. Voices are being emulated, hyper personalized threats are being developed, and threat actors are using AI faster than humans can respond. This deception is getting increasingly difficult to defend. One approach that Patricia Titus recommends is to start off being AI-native and using behavioral techniques to defeat the massed attacks. During the interview, Patricia Titus explains that the Abnormal AI system will look at normal behavior over 15-30 days and flags anomalies. Abnormal AI partners with major SaaS providers and offers a free 30-day proof of value. The technology aims to reduce alert fatigue and operational drag, enhancing cybersecurity efficiency.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40898855
info_outline
Ep 314 Federal API Security Risks Rise with Shadow IT Threat
04/14/2026
Ep 314 Federal API Security Risks Rise with Shadow IT Threat
If you go to Google Trends and type in API threats, you get a classic hockey stick. This is probably caused by the proliferation of connectors to cloud solutions paired with the popularity of AI. Today, we sat down with Brian Dennis from Akamai to talk about the problem this can present to federal systems. He begins by telling the audience that API attacks have increased by over 1,200 percent, reflecting the Google data. The shock is that many organizations, federal included, do not even know how many API’s they actually have. There may be APIs that were designed in earlier systems; there could have been APIs designed, used, and now dormant. Worse, it is possible that individuals have launched independent systems, called Shadow APIs, which can present unimagined vulnerabilities. The fact is malicious actors know this is a current vulnerability. It is a matter of knowing what to do when you get attacked. During the interview, Brian Dennis makes some suggestions that can help overcome some of these challenges. Microsegemetation will allow any breach to be blocked off. Traditionally, microsegmentation has been a time-consuming task but today’s AI can make it a trivial concern. Akamai has recently merged with a company called Guardicore that can provide enhanced network visibility. Today, developers are grabbing code off the shelf and plugging it in. There may be insecurities in this approach. Dennis explains how Akamai’s No Name can help identify and secure APIs at the code level, enabling operational security from development to runtime. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40872155
info_outline
Agentic AI Reshapes Federal Government Workflows Now
04/07/2026
Agentic AI Reshapes Federal Government Workflows Now
This is an interview at the Salesforce Agentforce World Tour in Washington, D.C., held on March 29, 2026, at the Washington Convention Center. Mia Jordan was the federal CIO twice and brings a unique view to the discussion of challenges and solutions around federal technology. She sat down with Federal Tech Podcast at the Salesforce Agentforce World Tour to give her thoughts on AI and innovation in the federal government. Jordan notes the federal government has used AI for a decade, but now faces pressure to move rapidly from concept to production. Although there is a sense of urgency from federal leaders, Jordan cautions that a human being should be in the loop when deploying AI. One way to accomplish this goal is to use tools that assist with it. One example she uses is the Salesforce tool Einstein Next Best Action. It can look at a workflow and make suggestions for a human to select. Jordan also addressed how the Informatica acquisition lets agencies track data lineage—who created it, when, and how it is used—so they can defend decisions during audits. touches on the role of low-code tools in automation and the need for reimagining workflows. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40709885
info_outline
Agentic AI Transforms Federal Mission at Scale
04/02/2026
Agentic AI Transforms Federal Mission at Scale
Today, we sat down with Paul Tatum, Executive Vice President, Global Public Sector at Salesforce, to hear how Salesforce can help federal agencies reach ambitious goals with Agentic AI. By now, everyone has played around with AI, and possibly some agents. Viewed independently, they can dazzle. Unfortunately, the federal government expects action based on data. If you isolate Agentic AI, you can fall into the trap of lacking the ability to scale, ensure security, and maintain control. In those several weeks, notable technology leaders have jumped headfirst into some agentic offerings from new vendors. What is not reported is that many have jumped back out because of privacy concerns. Salesforce can serve as the “adult in the room,” enabling federal leaders to leverage agentic technology in a secure and compliant manner. The good news: agents can connect just about everything. The bad news: agents can connect with everything. In the federal government, one needs trusted, mission-specific data through controlled interfaces. During the interview, Paul provides insight into innovation and security while using Agentic AI in a federal environment. He envisioned future AI evolving from reactive to initiative-taking and personalized, potentially becoming a concierge for citizens. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40709040
info_outline
Federal HR Modernization: Mapping Chaos to Clarity
03/30/2026
Federal HR Modernization: Mapping Chaos to Clarity
Today, we sat down with Charles Fiery from Excella to discuss the complexities of improving federal agency processes. He shared insights on the challenges of process discovery, change management, and data transformation. It is always difficult to assess a large enterprise, whether public or private, to determine how to improve complex processes. One approach is to look at duplicative systems; the federal government provides a notable example. The federal government has evolved into new agencies over the years. Because of technical and legal challenges, they have mostly remained siloed. As a result, we have human resource systems that do remarkably similar tasks. A consolidation effort would reduce costs, improve speed, and assist in interagency collaboration. The OMB mandate requires agencies to integrate core HR functions while maintaining ancillary services like payroll and benefits. The transition involves mapping current systems, identifying essential functions, and ensuring data compliance. Current systems need to ensure the data they provide is accurate and error-free. Each agency has unique data, and structuring that data is important. Visibility into system components is much more difficult. Connectors and integration are complicated by shadow IT and AI. Charles Fiery concludes that although the transition is challenging, completing the necessary groundwork will lead to stable and compliant improvements in federal HR systems. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40672020
info_outline
Fast Content Delivery and Security in Federal IT
03/26/2026
Fast Content Delivery and Security in Federal IT
In the 1990’s, the World Wide Web was so popular that it was facetiously called the Worldwide Wait. Centralized servers handled a small workload but bogged down as volumes increased. As a result, Content Delivery Services sprang up to distribute the workload worldwide. By 2001, large news organizations could manage unpredictable increases in traffic. The past decade saw a drastic increase in traffic and threats to it. During the interview, Omeed Nosarti describes how companies like Fastly began offering proprietary methods to deliver content faster. Nasrati highlights Fastly's proprietary technologies, such as Smart Parse, which reduces false positives in web application firewalls (WAFs), and its network architecture optimized for low latency and high cache hit ratios. Included in this conversation is the appearance of many remote points on many federal networks. These can function by increasing the attack surface and including the possibility of attacking the Application Programming Interface (API). Nasrati also mentions Fastly's API security features, including schema enforcement and discovery, and its significant ROI in terms of infrastructure and human capital costs. Nasrati emphasizes the importance of real-time traffic analysis and the evolving nature of DDoS attacks. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40602980
info_outline
Real-Time AI Intelligence and the New Federal Cyber Threat Landscape
03/24/2026
Real-Time AI Intelligence and the New Federal Cyber Threat Landscape
In 2026, we are seeing an increase in cyberattacks targeting defense contractors and defense production. Today, we met with Tim Miller, Field CTO at Dataminr, who explained how the company is helping the federal government address this growing threat. Traditionally, cyber threats could be classified as “Zero Day.” Essentially, this meant an attack targeting a software or hardware vulnerability that was unknown to the public. They were effective because no security patch existed, and they could bypass defenses. AI has compressed this 24-hour window to minutes. If your opponent is speeding up attacks, then the defender must use similar tools to prevent a breach. Dataminr has developed something called “real-time intelligence.” This concept can provide early warnings, help separate nuisance attacks from serious malware, and address today’s workforce gap in cyber defense knowledge. During the interview, Miller noted that the company also launched a new product for cyber defense that integrates threat intelligence with internal data. It is called Dataminr for Cyber Defense and leverages AI and Agentic AI to neutralize threats. = = Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40500770
info_outline
How Ethical Hackers Help Federal Agencies Find Hidden Cyber Vulnerabilities
03/17/2026
How Ethical Hackers Help Federal Agencies Find Hidden Cyber Vulnerabilities
Today, we sat down with Trey Ford from Bugcrowd to talk about ethical hacking. One of the most memorable phrases from ancient Rome is Quis custodiet custodes? (Who Watches the Watchman?). This ancient admonition has direct application to federal cybersecurity. We know federal agencies spend millions of dollars to protect data. How does one ensure the contracted companies are doing their jobs? Traditionally, an organization would use penetration testers, contractors, or basic scanning methods. However, today's attack surfaces are expanding, and malicious actors are innovating so rapidly that we are being forced to consider more creative options. In other words, an annual penetration test against an AI-inspired attack is too focused to be effective. The innovation Bugcrowd brings to the table is a community of researchers who can attack a system from many perspectives. During the discussion, you will learn about federal vulnerability disclosure programs, how to overcome talent shortages, and how Bugcrown vets its research community. Trey Ford also touches on the FedRAMP journey, AI integration, and the evolving cybersecurity landscape, stressing the need for human creativity and dynamic responses to threats. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40499035
info_outline
Mission-Ready Data: The Front Line of Federal Cybersecurity
03/12/2026
Mission-Ready Data: The Front Line of Federal Cybersecurity
The word “deplorable” signals something shockingly bad. Often used for the truly awful or dreadful, Todd Harbour, with decades of federal data experience, applies it specifically to data quality. That may be an overstatement, but the description certainly makes the point that today AI is based on fragmented, incomplete data sets. The bright, shiny thing called AI is so much in focus that federal leaders may not pause to ask what data is being used to train today’s models. During the interview, Harbour acknowledges that nobody is seeking perfection here. He has coined the term “mission-ready” to describe the kind of data that should be used for decision-making in the federal government. This would indicate a serious attempt to include siloed and poorly structured data. In a fascinating digression, he refers to MIT’s Project Iceberg. This initiative suggests that AI is only the “tip of the iceberg” of its economic impact. The majority are in the future and beneath the surface. If that is the case, the case for mission-ready data is even stronger. Harbour urges immediate initiative-taking measures to confront these challenges and proactively prepare for rapid AI-driven changes to cybersecurity and national defense. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40394755
info_outline
Fed up with FedRAMP? How Knox Delivers Authorization in 90 Days
02/24/2026
Fed up with FedRAMP? How Knox Delivers Authorization in 90 Days
Connect to John Gilroy on LinkedIn Want to listen to other episodes? When people look back on 2025 they will see many changes in the FedRAMP process. It looks like a new administration examined the process, got feedback from companies, and launched new initiatives to speed up the process. During today’s interview, Irina Denisenko (Knox CEO) details FedRAMP’s challenges and something called “FedRAMP 20x.” Knox runs the largest FedRAMP-managed cloud, enabling 90-day authorizations by hosting customers’ production environments. Denisenko explains the story of the origin of Knox Systems: she was running a training company and the Air Force wanted to use her product. It would have taken so long to complete the FedRAMP requirements that she just bought a company that was FedRAMP compliant. It is hard to believe that the process is so frustrating that fewer than 500 apps are authorized at moderate/high FedRAMP The initiative from the GSA is called FedRAMP 20x It shifts to continuous monitoring and continuous authorization, moving from annual audits (sampled every 3 years) and monthly CVE spreadsheets to real-time, machine-readable data. What Knox offers is a tried-and-true platform that has reduced time for compliance in order to better serve federal needs.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40127380
info_outline
Fixing FedRAMP: How Automation Cuts ATO Time by 36 Weeks
02/17/2026
Fixing FedRAMP: How Automation Cuts ATO Time by 36 Weeks
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Way back in 2011, one of the goals of FedRAMP was to eliminate software redundancy. The federal government had evolved to the point where one agency would spend millions of dollars on the same application program that the agency in the same zip code had just invested heavily in. The theory proposed by luminaries like Vivek Kundra was to move to the cloud to share services. Reducing cost and improving resilience. FedRAMP was the initiative that established a safe environment for federal cloud use. Companies can comply with regulations outlined in an Authorization to Operate (ATO). Well, fifteen years later, and we are seeing the same duplication not in the application programs, but in the process to get the ATO itself. For example, FedRAMP, RMF, and agency internal policies may require specific artifacts to satisfy one or the other. During the interview, Travis Howerton paints the legacy model—static documentation, annual/3-year audits, spreadsheets. His solution is to have AI assist with documentation, which will drastically reduce compliance time; he cites an example of reducing a process from 52 weeks to 356 weeks. RegScale uses OSCAL (XML/YAML/JSON) to auto-generate RMF artifacts and integrate with SIEMs (Splunk, Elastic), Axonius, ServiceNow, and APIs. Howerton understands the limitations of many automated systems and suggests that a human is a key component after the machine language has assembled the data to make the decision.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40127480
info_outline
Ep 302 API attacks, discovery, and resilience for federal agencies
02/16/2026
Ep 302 API attacks, discovery, and resilience for federal agencies
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Cybersecurity is a rapidly evolving field, where every effective defense technique is quickly noticed and adapted to by malicious actors. The real question is how fast each side of this ongoing cat-and-mouse game can respond. Let us take an example of web applications. In the decade-long slog of the cloud, federal users migrated to web-based applications protected by Web Application Firewalls (WAFs). firewalls. As that method matured, malicious observers noted that the Application Programming Interface (API) allowed these software programs to communicate and exchange data. Voila, another attack vector was born. During today’s interview, Joe Henry from Akamai Technologies notes that 80% of their customers report API attacks. Henry details a curious term called “Broken-Object Level Authorization.” In this attack, an application fails to check if a user is authorized to access specific data objects. The ID is manipulated, and the malicious actor gets access. Akamai’s API Security performs behavioral analysis beyond WAFs, flags PII exposure, and supports a zero-trust posture. Software developers talk about a “shift left”; we apply that to the Akamai approach. They have a worldwide network of Points of Presence (POPs) and data centers where they can observe attacks as they develop. It is so strong that it provides fail-open resilience with a 100% SLA. Akamai provides (quarterly). If you would like to stay connected with the next manifestation of attack, consider subscribing or visiting their website to stay informed about the latest trend
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/40124110
info_outline
Ep. 301 Edge Computing for Government: Rancher’s Role in Secure Hybrid Federal Environments
02/10/2026
Ep. 301 Edge Computing for Government: Rancher’s Role in Secure Hybrid Federal Environments
Twenty years ago, the concept of Bring Your Own Device (BYOD) entered the federal IT landscape with the advent of network-connected devices like Blackberries—sometimes even within secure federal networks. This slow start has exploded into a federal information technology system with sensors on satellites, submarines, and everywhere in between. That “in between” can include on-prem networks, multiple clouds, and hybrid clouds. Today, we sit down with Ryan Leiws, the CEO of Rancher Government Solutions, to look at some of the challenges in managing this dispersed environment and how to manage it. Lewis describes how Rancher connects hybrid environments using containers and Kubernetes for secure orchestration. Lewis emphasizes continuous compliance and DevSecOps via Rancher’s Carbide stack, SBOM-level visibility, and rapid recovery in contested, denied/disconnected/intermittent/limited (DDIL) environments. Lewis notes that Rancher’s declarative stack reduces maintenance and allows simple app redeployment. They also emphasize portability, cost efficiency, and alignment with zero-trust principles, with upcoming hardened features. = Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39893995
info_outline
Ep. 300 From Reactive to Initiative-taking: How Maximus Improves Federal Citizen Services with AI
02/05/2026
Ep. 300 From Reactive to Initiative-taking: How Maximus Improves Federal Citizen Services with AI
We began the interview with a startling fact. Maximus' federal systems interface with one in three Americans each year—about 110 million people. Building on Maximus’s broad reach, Pledger says the company’s core is designing world‑class digital experiences by starting with the end goal (e.g., veterans’ benefits) and using automation, AI, analytics, and omni‑channel outreach. We have all heard about improvements in systems; today, Pledger offers specifics on how health care can improve. He cites his own 2008 Iraq injury and notes veteran case durations historically ran three hundred to four hundred days; Maximus has reduced that to two hundred to 270 days, but still deems it too long. Maximus' success is due to its unique ability to leverage AI to drive this transformation. One approach is to partner with companies with vertical-market expertise. For instance, Maximus partners with Salesforce (CRM) and Genesis (telephony) to respond to complex medical cases. Example: outbound campaigns (text, email, AI‑generated calls) cut lapses; proactive engagement improves experience and reduces call‑center burden. Maximus is a story about a complex environment being tamed through understanding processes, applying technology, and making the right partnerships. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39894655
info_outline
Ep. 299 Wipers, Rogue AI, and Resilience: How Federal Agencies Can Respond and Recover from Attacks in 2026
02/03/2026
Ep. 299 Wipers, Rogue AI, and Resilience: How Federal Agencies Can Respond and Recover from Attacks in 2026
Everyone reading this has had minor delays at the airport. It is remarkable that more problems have not developed. Look at Chicago O’Hare International Airport—it has 857,392 takeoffs and landings in a year. Each one has passengers, and most have luggage. The opportunities for problems are overwhelming. Now add an increasing number of sensors and interlaced networks, and you have an attack surface of biblical proportions. All an adversary needs is one single point of vulnerability to attack a system. Think what could happen if an airport network were disabled by a ransomware attack. During today’s interview, Lou Karu makes suggestions for defense that include a multi-layered strategy emphasizing zero trust and network segmentation. However, Karu reminds us that a cybersecurity strategy is not complete without a robust recovery plan. For example, if a basic recovery plan was deployed, it is possible that a system can have compromised code locked into a backup. An airport suffers an attack, pays the ransom, and the recovered data has more attacks built in. Best practice here is to have a backup system that is rapid and accurate, and that restores the code without it being hot-infected with additional malicious code. Systems like this from Rubrik call these backups “immutable.” The next time you go to the airport, try to imagine the numerous attack points that an airport must contend with. Even the most robust cyber defense must include plans for safe, secure recovery. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39893980
info_outline
Ep. 298 Resilience by Design: Federal Cyber Predictions, AI-Driven Threats, and Immutable Backups with Rubrik
01/29/2026
Ep. 298 Resilience by Design: Federal Cyber Predictions, AI-Driven Threats, and Immutable Backups with Rubrik
Technology is changing so fast that it is impossible to predict the next twelve days. Despite that, we have asked Travis Rosiek, Public Sector CTO at Rubrik, to gaze into his crystal ball and make some predictions for the next twelve months. The good news is that Rosiek sees a shift from intellectual property theft to disruptive attacks on critical infrastructure. The bad news is that Rosiek thinks attacks are increasing to the point that an event will light a fire under the current cybersecurity plans. During the interview, the concept of Zero Trust was unpacked. The idea is that federal systems have already been breached. As a result, the focus must be on microsegmentation, with permission as the limiting factor. Roseik’s opinion is that malicious actors have planted code into systems that are acting as “sleepers.” At one time in the indeterminate future, this code can be invoked, and severe damage can take place. If this nightmare situation occurs, the best defense is to have recovery built in. Today, leaders must have a system in place to restore data from backups. Unfortunately, malicious actors know this plan as well and have been known to insert code into backups that renders them useless. In a complex game of attack and counterattack, Roseik believes that a recovery strategy that includes immutable backups and an audit mechanism is the best approach in the 21st-century world of threats and countermeasures. He also stressed the necessity of reducing complexity to enhance cybersecurity and the need for initiative-taking measures, including regular stress testing and resilience training. = = Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39848380
info_outline
Ep. 297 Seeing the Invisible: Using AI to Detect Threats in Encrypted Federal Networks
01/27/2026
Ep. 297 Seeing the Invisible: Using AI to Detect Threats in Encrypted Federal Networks
It is always tricky to compare commercial networking challenges with those faced by federal leaders. For example, the military and intelligence agencies require traffic encryption. How can an organization detect threats while observing this traffic? Today, we discuss Vectra AI's network threat detection capabilities with Wes Nagel, DoD sales manager, and Gage Cowger, a security engineer. With technology from Vectra AI, network traffic can be analyzed for timing, size, direction, and protocol use. These can give behavioral patterns for network visibility without worrying about encryption. Cowger will argue that behavioral patterns are more effective than signatures, especially in mitigating alert fatigue. Signatures can overwhelm monitors with false positives; Vectra's AI and ML capabilities provide trustworthy alerts. This ability positions Vectra AI to adapt to new networking initiatives, such as software-defined and OT/IoT networks, which will be prevalent in the future. The discussion also touches on the future of network detection, emphasizing the need for real-time, behavior-based detection to counteract advanced threats and adapt to evolving networks. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39848365
info_outline
Ep. 296 Securing the Federal Software Supply Chain: Why SBOMs aren’t enough
01/22/2026
Ep. 296 Securing the Federal Software Supply Chain: Why SBOMs aren’t enough
One of the biggest trends in software development over the past 10 years is the shift from writing code to “assembling” code from off-the-shelf components. During today’s interview with Javed Hasan from Lineaje, we learned that 70% of that pre-assembled code is open source. In other words, an anonymous person in some countries modified software instructions. This casual approach may be fine for small businesses, but an organization like the federal government must be highly cautious. Hasan describes how his company was one of the first to work with the federal government to set standards for this existing code. These initial efforts began ten years ago and resulted in Executive Order #14028, which requires a Software Bill of Materials for any organization selling to the federal government. This initiative expanded in 2021-2022 when NIST published related guidelines. These efforts are a good start. However, federal leaders must evaluate SBOM technology from many perspectives. For example, how to incorporate this mandate into air-gapped networks, legacy COTS, or even in a classified environment. System administrators also need to know if they are exposed. Further, every organization has a varying definition of what “deep software transparency” is. Hassan also discusses Lineage's innovative approach to creating "Gold open source" software, ensuring it is free of malware and vulnerabilities. If you are interested in seeing a demonstration of how Lineaje can help with software forensics, there is an event at the Carahsoft office in Reston, Virginia, on January 30 = = Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39841505
info_outline
Ep. 295 AWS leadership
01/20/2026
Ep. 295 AWS leadership
In the past 10 years, Amazon Web Services has gone from a niche player in the federal government to being responsible for billions in sales. One key aspect of this is how Amazon integrates leadership with innovation to address complex federal requirements. Today, we sit down with Andrew Christian to get an overview of concepts like customer obsession, working backwards, and the sixteen leadership principles that AWS implements to accomplish that drastic growth. ONE Customer-focus In the commercial marketplace, the concept of being “customer-focused” is certainly not breaking news. However, as Christian explains, AWS tries to understand (almost obsessively) what the requirements are for federal systems. No, technically, they are not “customers,” but they are the end users for any technology project. This focus has given AWS remarkable success in the commercial world, and when they apply it to federal technology, they can succeed where others have failed. TWO Working Backwards Christian explains that “working backwards” is a concept where a team is forced to write a mock press release and FAQ for a future project. This is before they build anything. This helps to clarify the customers’ needs by identifying gaps early. THREE encouraging innovations Many describe innovation as failing fast, then recovering. That may hold up in a commercial application where lives are not at stake. During the interview, Andrew Christian differentiates between the importance of making quick, reversible decisions (two-way doors) versus long-term, impactful ones (one-way doors). He encourages federal agencies to adopt these principles to enhance their innovation and adapt to a world co constantly changing technology. Connect to John Gilroy on LinkedIn Want to listen to other episodes?
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39767165
info_outline
Ep. 294 From Defense to Offense: Proactive Strategies to Protect Federal Data
01/15/2026
Ep. 294 From Defense to Offense: Proactive Strategies to Protect Federal Data
One famous cartoon featured two vultures sitting on a fence; one turned to the other and said, “I am sick of waiting, let’s kill something.” When it comes to preventing cyberattacks, the federal government is well known for a defensive approach. They have security systems, air gap systems, and even a zero-trust approach. This defensive approach is essential but may not give the federal government a complete view of how to protect data. Today, we sat down with Chris Jones, Nightwing's Chief Technical Officer. He outlines some of the characteristics of a concept called “offense informs defense.” This is a method that Nightwing has developed through over 40 years of working with federal technology leaders. For example, they developed their Counter Trace service, which uses offensive cyber strategies to defend critical infrastructure. The service involves proactively hunting for vulnerabilities, identifying access points, and analyzing digital evidence to expose cyberattacks. During the interview, Jones mentions that the GSA has received this approach well. In fact, Nightwing recently won all six GSA Highly Adaptive Security Services categories. These handle security aspects like Penetration Testing, Incident Response, Risk Assessments, Cyber Hunt, and High Value Asses Assessments. Jones emphasizes the importance of initiative-taking, cybersecurity, AI integration, and collaboration across agencies to adapt to protect federal data.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39526100
info_outline
Ep. 293 Predictions for 2026 from Gitlab
01/13/2026
Ep. 293 Predictions for 2026 from Gitlab
Connect to John Gilroy on LinkedIn Want to listen to other episodes? Today, we have an experienced tech veteran, Bob Stevens from GitLab, offering insights on how he sees the federal government overcoming three main technology challenges in 2026. Challenge ONE: Software improvement on scale. Stevens observed that everyone has seen AI's ability to review code. It has passed the basic phase, and now, in 2026, it cannot only review code but also identify security vulnerabilities, ensure compliance, and even generate documentation. This means that older, expensive-to-maintain systems can be transitioned to more flexible, economical cloud models. Challenge TWO: Going away from reacting. The word “continuous” has been the goal for cyber defenders for the past several years. Fortunately, AI is allowing that noble goal to be put into practice. When applied appropriately, newer technology can achieve lower breach rates and faster threat response times. Challenge THREE: emergence of a “universal” developer. Traditionally, requirements would be gathered by an intermediary and then translated into instructions for software developers. Stevens shows how newer AI-based approaches can eliminate that intermediary step. In other words, a pilot can precisely describe what they want in an avionics system, and the developers can work from that description. That means solving domain-specific problems with traditional development skills. Ideally, subject matter experts directly translate their knowledge into functional software systems. Some call this the “universal” developer approach. Stevens emphasized the importance of AI, security, and flexibility for future developers. GitLab's DevSecOps platform integrates AI across the entire software development process.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39713775
info_outline
Ep. 292 From Detection to Prevention: Using Technology to Reduce Fraud in Federal Programs
01/08/2026
Ep. 292 From Detection to Prevention: Using Technology to Reduce Fraud in Federal Programs
(We recorded this interview at Monk’s BBQ in lovely downtown Purcellville, VA) Connect to John Gilroy on LinkedIn Want to listen to other episodes? Defrauding the federal government is like the weather; everyone wants to complain, but nobody can do anything about it. For example, a joint DOL-SBA report from December 2024 revealed $2.3 billion in potentially fraudulent payments. Today, we sat down with Jeff Gallimore from Excella, where he will diagnose the problem of federal waste, fraud, and abuse. From there, he presents a solution that has already saved millions of dollars. The problem: too many silos From a data management perspective, most enterprise computational capabilities evolved through a federated approach. From a historical perspective, it makes sense that each agency would have its own computers and storage. It makes sense that individual data stores in this environment would be separated, or perhaps the word “siloed”, into distinct areas. Now, if you have one silo, you can protect it; if you have a thousand, then there is a problem. During the interview, Gallimore mentioned an agency that manages 9,000 grants. That is a lot of data to coordinate when it is stored in its “silos.” The solution: gap analysis Silos can be secure, but the architecture can allow for gaps in security coverage. These gaps, or seams, can allow fraudsters to exploit this structure. For example, an agency may have a division that has identified a person as a fraudster. If that information is not shared, this person can use the same exploit on another area of the agency. Further, interlinks between federated systems can allow adversaries to gain access. Excella has a profile of how they have managed to fill in the gaps in siloed data architecture.
/episode/index/show/86da2e04-6de5-40f5-9fe5-ff006b5de38d/id/39526060