Why a Former DHS CISO Never Wasted a Good Crisis
October 26, 2026With Kenneth Bible, Board Member, Crytica Security, and former CISO, U.S. Department of Homeland Security
Kenneth Bible walked into the DHS CISO job on January 3, 2021, with the agency still reeling from the SolarWinds hack. Now a board member at Crytica Security, the former DHS CISO and Marine Corps CIO joins the show to trace a career that started on nuclear submarines at the Charleston Naval Shipyard and ran through the NMCI transition to NGEN. He explains why governance, not technology, was the real fix after SolarWinds, how a Unified Cybersecurity Maturity Model helped 13 component CISOs prioritize roughly a billion dollars in requests, and why he pushed NIST to wrap governance around the entire Cybersecurity Framework rather than bolt it on as another pillar. Then the conversation turns to the attack surface nobody owns. Ken makes the case that operational technology has become the adversary's preferred target, from port cranes and water meters to LNG tankers and a grid that spent four hours rebalancing after a single Northern Virginia data center dropped its AI load. He explains why a 600MB EDR agent will never fit on an 8MB PLC, why IT and OT teams still don't talk, and what it takes to bring OT risk to the board.
Mission Executive: Insights from a Six-Time Federal CIO
October 19, 2026With Dr. Barry West, Founder and President, West Wing Advisory ServicesSix federal CIO roles, and every one of them secured by an intentional process, hard work, and homework. Brian and Sean sit down with Dr. Barry West, founder of West Wing Advisory Services and program chairman of the Government Business Executive Forum, who led IT at the National Weather Service, at FEMA through Hurricane Katrina, at the Department of Commerce, and at PBGC. Barry traces a path from Air Force weather observer to technical lead on FirstGov, the site that became USA.gov, and explains why today's CIO has to operate as a mission executive who turns business requirements into outcomes while managing risk. The conversation gets practical fast. Barry lays out the six attributes every CIO needs, the reality check executives face when they move to industry and have to flip the switch, and why a GS-15 chasing SES should attack the job like a capture plan, with ECQs, metrics, GAO reports, and strategic plans studied cold. Sean shares mentorship stories from CBP and the FBI, and all three make the case for associations, a plan B and plan C, health, and financial planning at every stage of a career. Plus, the band that gets the lead out.
If You're Not First, You're Last: A Former Govt. CTO's Perspective
October 12, 2026With Steve Wallace, Public Sector CTO, F5Steve Wallace spent 15 years at DISA, seven and a half of them as CTO, building some of the largest IT programs the Department has ever attempted. Now 130 days into his role as Public Sector CTO at F5, Steve joins Brian and Sean to share what those programs taught him. He walks through scaling DoD Enterprise Email to 1.8 million users before Office 365 existed, why a design only succeeds if operations can run it, and how a borrowed Lotus philosophy shaped his approach to systems engineering. Simpler systems are easier to troubleshoot, easier to operate, and far easier to defend because adversaries have fewer folds to hide in. That lesson drove the move from the Joint Regional Security Stack, with 20-plus vendors and a print job that traveled hundreds of miles to reach a printer down the hall, to Thunderdome, a zero trust architecture whose name came from the idea that two solutions enter and one leaves. The conversation turns to cutting through AI hype the same way Steve once cut through blockchain and zero trust washing. He warns that the rush to deploy AI echoes the late-1990s scramble to install antivirus after the fact, and he flags API security as the screen door on the side of a house with a bolted front door. Steve and Sean dig into F5's acquisition of CalypsoAI, agentic red teaming that adapts its attacks in real time, why guardrails are never fire and forget, and how distillation puts fine-tuned agency knowledge at risk. Plus why the token party is over, the danger of cognitive surrender, and Steve's Monday-morning creed of delivering for people on the worst day of their lives, holding teams accountable, spending taxpayer dollars wisely, and never letting the adversary win on his watch.
FY26: Trading Disruption for Execution
September 28, 2026In this season finale, Brian and Sean look back on a year that traded disruption for execution. Sean breaks down the wave of end-of-year infrastructure buys as CIOs finally funded the routers, switches, and Wi-Fi that leadership rarely sees but every AI agent, sensor, and data feed depends on. The conversation covers more legacy modernization in one year than in the past decade, OT security surging to the top of CISO agendas after real attacks on water and energy systems, and a reskilling wave that reached all the way to two-star generals writing their own agents. Brian and Sean also walk through the four seats shaping FY27 and a preview of Season Two's first guests.
Security Compliance Checklists vs. Commander's Intent
September 14, 2026With Ian Kelly, Senior Director of Solutions Engineering, Cloudflare Public SectorThe government is great at security governance — but that isn't the same as being secure. In Episode 18 of The GIST of Govt IT, Brian and Sean sit down with Ian Kelly of Cloudflare, a self-described liberal arts major turned 15-year Google veteran turned public-sector technologist, to talk about closing the gap between the checkbox and the outcome. The conversation digs into why the exploit window has collapsed from weeks to roughly five minutes, the pivot from point-in-time compliance to continuous, risk-based security, and AI governance before the horse leaves the barn. Sean and Ian also get into edge compute, the CBP conversational video bot built for the FIFA games, infrastructure as code for repeatable accreditation, and the emerging discipline of AEO — optimizing content so agents, not just humans, can use it. Plus, Cloudflare's FedRAMP High authorization and IL4 intentions, a wall of lava lamps as a cryptographic entropy source, and three Monday-morning takeaways, not to mention KatEye makes an appearance.
The LRA is Here and the Clock is Ticking!
August 31, 2026It's here. On August 20, CISA dropped the Logging Reference Architecture (LRA) a practitioner's guide that operationalizes OMB M-26-14 and the countdown just got real. In this episode of The GIST of Govt IT, Brian and Sean break down the aggressive timeline it sets: agencies have 90 days to inventory their environment and submit a plan in Cyberscope (the week before Thanksgiving), then about 30 more to hit Baseline 1 maturity (the week before Christmas). Surprisingly, or not, Sean's read is refreshingly positive, this guide was written by practitioners for practitioners, with concrete advice, outcome-focused questions to ask your teams, and clear thresholds: 70% of assets inventoried, 50% logging coverage, 50% actionable alerts, six-month retention. The conversation digs into why IoT and OT are the hard part (segmented networks, third-party-managed devices, systems you can't actively scan), why the LRA deliberately doesn't mandate AI, and a practical path forward: assign a single LRA owner, reconcile your CMDB against your property book, deploy passive OT listening kits rather than scanning fragile systems, and use end-of-fiscal-year funds now to close gaps you can't fill over the holidays. The clock is ticking and agencies are going to have to build the airplane while they fly.
Federal AI Wants to Fly but Data Weighs it Down
August 24, 2026With Matt Lawson, Director of Solution Engineering, NetApp FederalSomewhere between 60% and 80% of federal AI projects have stalled out and the common denominator almost always traces back to the data. In Episode 16 of The GIST of Govt IT, Brian and Sean sit down with Matt Lawson, Director of Solution Engineering for NetApp Federal, to unpack what it actually takes to build a data foundation that lets AI succeed. Matt's thesis is that projects keep stalling because teams can't get the right data, in the right place, at the right cost. The conversation digs into data gravity (you can't move petabytes overnight, and you can't beat the speed of light), the take-the-data-to-the-model vs. bring-the-model-to-the-data debate (answer: you need both), and the copy-of-a-copy sprawl that quietly wrecks both budgets and data authority. Matt walks through ideas that change the math, and the guys close out on post-quantum cryptography and why “harvest now, decrypt later” makes it a today problem, not a tomorrow problem. Plus Matt on why he always chooses the blue pill.
Billion Dollar Pilots and Boil Water Notices: Securing OT Environments
August 10, 2026“The only thing that isn't digital in the Department of War is the bayonet.” That line from DoW CISO Aaron Bishop set the tone for a standing-room panel Brian moderated in Washington, DC, with partners at Armis. In Episode 15 of The GIST of Govt IT, Brian and Sean bring listeners the lessons learned from that breakfast briefing on securing the converged IT, IoT, and OT enterprise — featuring Bishop, Department of Transportation CISO Dr. Justin Ubert, and Armis’ Director of Civilian Strategy Matthew Shelbetter. The conversation digs into the central insight all three panelists shared: the hardest part of convergence isn't the technology, it's the culture. IT security teams and OT operators speak different languages, hold different priorities (availability and safety first), and have to learn to meet in the middle — often starting with nothing more sophisticated than a room, a tabletop exercise, and a lot of pizza and Mountain Dew. Brian and Sean also unpack Bishop's concept of mission-relevant terrain for cybersecurity, why attack path mapping and asset discovery are the foundation, how to pay for OT security when the funding is scattered (identity-for-agents riding on AI budgets, consensus-building at HHS, and Bishop's $1B OT security pilot anchored to a zero trust framework), and why the community — local utilities, mayors, volunteer responders, partners like Dominion Energy — has to be in the room before the house is on fire. Plus, three Monday-morning takeaways straight from the panelists.
A Pause, Not a Pass on CMMC
July 20, 2026On July 13, the Department of War hit pause on one of the most consequential compliance regimes in the defense industrial base. In Episode 14 of The GIST of Govt IT, Brian and Sean break down the suspension of CMMC Phase II — the third-party assessment requirement that was set to take effect November 10 — and what it actually means for the thousands of contractors caught in the middle. Sean's message is blunt: this is a pause, not a repeal. The requirement to protect controlled unclassified information isn't going anywhere, and the smart move is to keep marching toward NIST SP 800-171 compliance regardless of what the 60-day CMMC Reform Task Force recommends. The conversation digs into the real economics that triggered the review, the False Claims Act lawsuits already settling in the six-to-eight-figure range for contractors who attested to compliance they didn't have, why ISO 27001 is the closest on-ramp for commercial companies new to the space, and a clear Monday-morning playbook. Plus, CISA Director Nick Andersen's hacker name (hint: he's a Matrix fan).
Fed Christmas in July? The OMB M-26-14 Holiday Rush Begins!
July 13, 2026Level One by Christmas. Level Two by Valentine's Day. Level Three by Independence Day. That's the OMB M-26-14 logging mandate clock federal agencies are now racing against — and if you don't want to spend your holidays at the office, it's time to start planning now! In Episode 13 of The GIST of Govt IT, Brian and Sean dig into OMB M-26-14 on the eve of Sean's fireside chat with CISA Director Nick Andersen. Sean breaks down what actually changed: the shift from long-term log hoarding (30 months of cold retention) to an outcomes-driven model focused on defending the cyberspace effectively, and the dramatic expansion of scope to include IoT and operational technology — the unmanaged, line-of-business-owned, often third-party-managed devices that CISOs have never had eyes on. The conversation walks through the mechanics: the Logging Reference Architecture (LRA) dropping mid-August, the 90-day plan requirement, and the three maturity levels with their rising inventory-and-logging thresholds (70/50, 80/80, 90/90). Brian and Sean unpack why asset inventory is the real "creeper" that will blindside teams, why OT discovery requires drop-in kits and passive network detection rather than active scanning that can break physical systems, why centralized logging matters for coordinated FSEB-wide defense, and how to think about "three-for-one" investments that solve this mandate and other capability gaps at once.
The Founding Fathers' Guide to Federal IT
July 6, 2026Happy 250th birthday, America. In this special shortened Fourth of July episode of The GIST of Govt IT, Brian and Sean keep it snackable for the beach-and-boat crowd — kicking off with a debate over favorite founding fathers before turning to a rundown of the GIST 360 summer event lineup. Sean previews what's coming: a July 14 breakfast briefing at the National Press Club on securing the converged IT/OT/IoT enterprise; a mid-year federal IT priority-setting session featuring a fireside chat with CISA Director Nick Andersen, an ATARC roundtable on operationalizing continuous threat exposure management, as well as several webinars on deck. If you want to know where federal IT leaders are placing their bets for the last stretch of the fiscal year, this is your map to the conversations that matter. Plus a kite-surfing Ben Franklin!
The Five-Dollar Agentic AI Hacker
June 29, 2026With Marlin McFate, Federal CTO & CISO, CohesityFour days. A spare $500 mini PC from Microcenter. An open-source quantized model running on 512 MB of VRAM. And by Thursday morning, an autonomous AI agent named Jenkins was finding vulnerabilities, chaining exploits, gaining root, and maintaining persistence — entirely on its own, with no human in the loop. In Episode 11 of The GIST of Govt IT, Brian and Sean are joined by Marlin McFate, Federal CTO and CISO at Cohesity to dig into the experiment Marlin documented on his new Substack, Peripheral Tech. Marlin walks through the architectural choices that made Jenkins possible — the "discussion skill" approach to working with agents like colleagues, the orchestrator-subagent model, the safety capability files that proved more effective than external guardrails — and why the implications go far beyond "Mythos changed everything." The conversation digs into the real thesis: the barrier to nation-state-grade offensive cyber didn't just fall — it fell years ago, and most organizations are still spending 80% of their cybersecurity budget trying to prevent attacks rather than recover from them. Brian, Sean, and Marlin unpack the digital jump bag, the minimum viable agency concept, why finding the last clean backup is "a bad lie" the industry has been telling for years, and what Cohesity's RAG-enabled secondary data approach means for agencies trying to feed AI without standing up a fifth copy of their data. Plus, AI agents throw fits and take on personalities for their own.
.png?width=300&name=Podcast%20(4).png)
