The GIST of Govt IT podcast

Protect the Internet! A Fed’s Guide to PQC Compliance

Season 2, Episode 4

Show notes

Adversaries are collecting encrypted federal data today to decrypt tomorrow, and the deadline to stop them just got closer. With NIST's final IR 8547 out only days before recording, Brian and Sean go hosts-only to unpack what the post-quantum transition means for federal agencies. Sean walks through the deadlines set by NSM-10, Executive Order 14412, OMB M-26-15, and CNSA 2.0, from high-impact systems that must use quantum-resistant key exchange by 2030 to network gear that must be refreshed or retired by the same year. The good news is that much of the work is a configuration change, not a purchase, because many vendors are already run post-quantum cryptography by default.

Then they get practical about what can break. Larger keys can spill across two packets, vendor implementations don't always interoperate, and failed handshakes surface as dropped sessions, which is why Sean argues the truth is always in the packets. He shares takeaways from the GIST360 breakfast briefing with CBP's Dr. Edward Mays and Cloudflare's Jeremy Corey, explains why crypto agility is the hidden payoff, and closes with a clear Monday-morning priority. Protect internet-facing applications and remote access first, because that traffic is the most likely to be harvested now and decrypted later.

Resources Mentioned in This Episode

Federal PQC Guidance and Deadlines

• NIST IR 8547, Transition to Post-Quantum Cryptography Standards (final, October 2026)

• OMB M-26-15, Execution of the Migration to Post-Quantum Cryptography

• Executive Order 14412 and the accelerated deadlines for high-impact systems

• National Security Memorandum 10 (NSM-10) on quantum computing and vulnerable cryptographic systems

• NSA Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)

• NIST Post-Quantum Cryptography project and FIPS 203, 204, and 205

• CISA Post-Quantum Cryptography Initiative

The Migration Timeline Discussed

• Software and firmware signing, PQC exclusively by 2030

• Traditional networking equipment, PQC preferred in 2026 and exclusive by 2030

• High-impact systems, quantum-resistant key establishment by end of 2030 and digital signatures by 2031

• Operating systems, PQC preferred in 2027 and exclusive by 2033

• Web browsers, servers, and cloud services, PQC exclusive by 2033

• Federal system deadline for full migration, 2035

Industry Perspectives

• Cloudflare, running post-quantum cryptography by default

• CBP's push toward quantum readiness (MeriTalk)

• Cisco's PQC Capabilities

From the GIST360 PQC Breakfast Briefing

• Dr. Edward Mays, Deputy Assistant Commissioner, U.S. Customs and Border Protection

• Jeremy Corey, Public Sector Solutions Engineer, Cloudflare

• Recap Blog

• Use commercial services that already support PQC for public-facing apps and remote users

• Key exchange is mature, while digital signatures, authentication, and private DNS are still catching up

• Crypto agility is the long-term payoff of the migration

The Monday-Morning Takeaways (Sean Applegate)

• Share NIST IR 8547 with the team and make sure everyone reads it

• Confirm the inventory covers internet-facing systems and internet-heavy users

• Turn on PQC for public-facing apps at the CDN, WAF, or application delivery layer

• Turn on PQC for zero trust remote access and VPNs

The Hosts and Show

• Swish

• GIST 360 Program

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Nov 2, 2026 38 min

Why a Former DHS CISO Never Wasted a Good Crisis

Season 2, Episode 3

Show notes

Kenneth Bible walked into the DHS CISO job on January 3, 2021, with the agency still reeling from the SolarWinds hack. Now a board member at Crytica Security, the former DHS CISO and Marine Corps CIO joins the show to trace a career that started on nuclear submarines at the Charleston Naval Shipyard and ran through the NMCI transition to NGEN. He explains why governance, not technology, was the real fix after SolarWinds, how a Unified Cybersecurity Maturity Model helped 13 component CISOs prioritize roughly a billion dollars in requests, and why he pushed NIST to wrap governance around the entire Cybersecurity Framework rather than bolt it on as another pillar.

Then the conversation turns to the attack surface nobody owns. Ken makes the case that operational technology has become the adversary's preferred target, from port cranes and water meters to LNG tankers and a grid that spent four hours rebalancing after a single Northern Virginia data center dropped its AI load. He explains why a 600MB EDR agent will never fit on an 8MB PLC, why IT and OT teams still don't talk, and what it takes to bring OT risk to the board.

Resources Mentioned in This Episode

Featured Guest

• Kenneth Bible, Board Member, Crytica Security, and former CISO, U.S. Department of Homeland Security

• Crytica Security

• Crytica announcement of Ken joining its board

SolarWinds and Federal Cyber Governance

• Executive Order 14028, Improving the Nation's Cybersecurity

• NIST Cybersecurity Framework 2.0

• CISA Known Exploited Vulnerabilities (KEV) Catalog

• CISA Software Bill of Materials (SBOM)

• CISA Binding Operational Directive 26-02

• NIST SP 800-171

• Committee on National Security Systems (CNSS)

OT and Critical Infrastructure Security

• CISA advisory on Volt Typhoon targeting U.S. critical infrastructure

• NIST SP 800-82, Guide to Operational Technology Security

• CISA Industrial Control Systems resources

• WaterISAC

• National Council of ISACs

• National Rural Water Association

• DEF CON Franklin volunteers helping small water utilities

The Hosts & Show

• Swish

• GIST 360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Sep 14, 2026 46 min

The LRA is Here and the Clock is Ticking!

Season 1, Episode 17

Show notes

It's here. On August 20, CISA dropped the Logging Reference Architecture (LRA) a practitioner's guide that operationalizes OMB M-26-14 and the countdown just got real. In this episode of The GIST of Govt IT, Brian and Sean break down the aggressive timeline it sets: agencies have 90 days to inventory their environment and submit a plan in Cyberscope (the week before Thanksgiving), then about 30 more to hit Baseline 1 maturity (the week before Christmas). Surprisingly, or not, Sean's read is refreshingly positive, this guide was written by practitioners for practitioners, with concrete advice, outcome-focused questions to ask your teams, and clear thresholds: 70% of assets inventoried, 50% logging coverage, 50% actionable alerts, six-month retention.

The conversation digs into why IoT and OT are the hard part (segmented networks, third-party-managed devices, systems you can't actively scan), why the LRA deliberately doesn't mandate AI, and a practical path forward: assign a single LRA owner, reconcile your CMDB against your property book, deploy passive OT listening kits rather than scanning fragile systems, and use end-of-fiscal-year funds now to close gaps you can't fill over the holidays. The clock is ticking and agencies are going to have to build the airplane while they fly.

Resources Mentioned in This Episode

The Core Documents

• CISA Logging Reference Architecture (LRA), released August 20

• OMB M-26-14 (the logging mandate the LRA operationalizes)

• CyberScope (where agencies submit their plans)

The Baseline 1 Thresholds

• Inventory visibility: 70% of assets captured in a centralized inventory

• Collection coverage: 50% of inventoried assets logging

• Collection operations: 50% of logs producing actionable alerts

• Data retention: minimum six months (per M-26-14; the LRA guide notes a slightly different figure)

• Timeline: plan ~Nov 18, Baseline 1 ~mid-December

Frameworks & Technical References

• MITRE ATT&CK (adversary behavior models)

• CISA Zero Trust Maturity Model

• NIST SP 800-92 (log management guidance)

The Threat Backdrop

• DOJ/FBI seizure of Chinese state-sponsored hacking infrastructure (August 26)

• CISA advisory on edge-device compromise and lateral movement

• Anthropic and OpenAI on the narrowing window to defend against AI cyber threats

From Swish / GIST 360

• Swish LRA planning assessmen

• “When the Perimeter Disappears” breakfast briefing recap

Related Episodes

• Episode 13: Fed Christmas in July? The OMB M-26-14 Holiday Rush Begins!

• Episode 15: Billion Dollar Pilots and Boil Water Notices: Securing OT Environments

• Episode 7: Iran Came for the Dams and We Got Lucky: Frontline Insights into the OT Fight

The Hosts & Show

• Swish

• GIST 360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Aug 31, 2026 33 min

Federal AI Wants to Fly but Data Weighs it Down

Season 1, Episode 16

Show notes

Somewhere between 60% and 80% of federal AI projects have stalled out and the common denominator almost always traces back to the data. In Episode 16 of The GIST of Govt IT, Brian and Sean sit down with Matt Lawson, Director of Solution Engineering for NetApp Federal, to unpack what it actually takes to build a data foundation that lets AI succeed. Matt's thesis is that projects keep stalling because teams can't get the right data, in the right place, at the right cost.

The conversation digs into data gravity (you can't move petabytes overnight, and you can't beat the speed of light), the take-the-data-to-the-model vs. bring-the-model-to-the-data debate (answer: you need both), and the copy-of-a-copy sprawl that quietly wrecks both budgets and data authority. Matt walks through ideas that change the math, and the guys close out on post-quantum cryptography and why “harvest now, decrypt later” makes it a today problem, not a tomorrow problem. Plus Matt on why he always chooses the blue pill.

Featured Guest

• Matt Lawson, Director of Solution Engineering, NetApp Federal

• NetApp Public Sector

The “Why AI Projects Fail” Data

• The concept of data gravity

AI, RAG & Partners

• Retrieval-Augmented Generation (RAG) explained

• Apache Kafka (real-time event streaming)

Post-Quantum Cryptography

• NIST Post-Quantum Cryptography Standards (FIPS 203/204/205)

• OMB M-23-02 (migrating to post-quantum cryptography)

The Monday-Morning Playbook (Matt Lawson)

• 1. Catalog your data — know what data sets you actually have

• 2. Plan for a federated environment — data will live in many places, some not even yours

• 3. Design for security from day one — immutability, ransomware recovery, and PQC can't be bolted on later

Related Episodes

• Episode 9: Quad Charts Be Damned: Data Meets the Mission

Upcoming Event

• GIST 360 Breakfast Briefing with NetApp — Washington, DC, November 10

The Hosts & Show

• Swish

• GIST 360 Program

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Aug 24, 2026 43 min

Billion Dollar Pilots and Boil Water Notices: Securing OT Environments

Season 1, Episode 15

Show notes

“The only thing that isn't digital in the Department of War is the bayonet.” That line from DoW CISO Aaron Bishop set the tone for a standing-room panel Brian moderated in Washington, DC, with partners at Armis. In Episode 15 of The GIST of Govt IT, Brian and Sean bring listeners the lessons learned from that breakfast briefing on securing the converged IT, IoT, and OT enterprise — featuring Bishop, Department of Transportation CISO Dr. Justin Ubert, and Armis’ Director of Civilian Strategy Matthew Shelbetter.

The conversation digs into the central insight all three panelists shared: the hardest part of convergence isn't the technology, it's the culture. IT security teams and OT operators speak different languages, hold different priorities (availability and safety first), and have to learn to meet in the middle — often starting with nothing more sophisticated than a room, a tabletop exercise, and a lot of pizza and Mountain Dew.

Brian and Sean also unpack Bishop's concept of mission-relevant terrain for cybersecurity, why attack path mapping and asset discovery are the foundation, how to pay for OT security when the funding is scattered (identity-for-agents riding on AI budgets, consensus-building at HHS, and Bishop's $1B OT security pilot anchored to a zero trust framework), and why the community — local utilities, mayors, volunteer responders, partners like Dominion Energy — has to be in the room before the house is on fire. Plus, three Monday-morning takeaways straight from the panelists.

The Panel & Blog

• When the Perimeter Disappears Breakfast Briefing Recap Blog

• Aaron Bishop, CISO, Department of War

• Dr. Justin Ubert, CISO, Department of Transportation

• Matthew Shelbetter, Director of Civilian Strategy, Armis

• Armis Federal

Policy & Frameworks Referenced

• OMB M-26-14 and the CISA Logging Reference Architecture : https://www.whitehouse.gov/omb/memoranda/

• DoD OT Zero Trust Reference Architecture

• CISA Zero Trust Maturity Model

• GSA “Eliminate, Automate, and Optimize” playbook for AI/agents

• NIST SP 800-82 — Guide to Operational Technology Security

The Threat Backdrop

• CISA advisory on Iranian-affiliated actors targeting water and critical infrastructure

• CISA Industrial Control Systems resources

• EPA Water and Wastewater cybersecurity resources

The Three Monday-Morning Takeaways

• Dr. Justin Ubert: Get the disparate teams — red, blue, OT, leadership — in the same room

• Matthew Shelbetter: Talk to the operators; educate leadership and frontline managers, then get the right platforms and partners

• Aaron Bishop: Start with asset discovery — know what you have, where it is, and who owns it

Related Episodes

• Episode 14: A Pause, Not a Pass on CMMC

• Episode 13: Fed Christmas in July? The OMB M-26-14 Holiday Rush Begins!

• Episode 7: Iran Came for the Dams and We Got Lucky: Frontline Insights into the OT Fight

Upcoming Events

• Upcoming GIST 360 webinars and fall breakfast briefings

The Hosts & Show

• Swish

• GIST 360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Aug 11, 2026 32 min

A Pause, Not a Pass on CMMC

Season 1, Episode 14

Show notes

On July 13, the Department of War hit pause on one of the most consequential compliance regimes in the defense industrial base. In Episode 14 of The GIST of Govt IT, Brian and Sean break down the suspension of CMMC Phase II — the third-party assessment requirement that was set to take effect November 10 — and what it actually means for the thousands of contractors caught in the middle. Sean's message is blunt: this is a pause, not a repeal. The requirement to protect controlled unclassified information isn't going anywhere, and the smart move is to keep marching toward NIST SP 800-171 compliance regardless of what the 60-day CMMC Reform Task Force recommends. The conversation digs into the real economics that triggered the review, the False Claims Act lawsuits already settling in the six-to-eight-figure range for contractors who attested to compliance they didn't have, why ISO 27001 is the closest on-ramp for commercial companies new to the space, and a clear Monday-morning playbook. Plus, CISA Director Nick Andersen's hacker name (hint: he's a Matrix fan).

Resources Mentioned in This Episode

The Core Story

• Department of War release: "Forging the Arsenal of Freedom: DoW Suspends CMMC Phase II Requirements" (July 13)
• Office of Industrial Base Growth version of the announcement
• Federal News Network coverage
• The CMMC Reform Task Force RFI (responses due 12:00 PM ET, Friday, August 14) — posted on SAM.gov

Legal & Advisory Analysis

• Morgan Lewis — "Cybersecurity Obligations Remain"
• Crowell & Moring — DFARS obligations & contractor action steps
• Greenberg Traurig — the July 13 memoranda explained

Standards & Frameworks Referenced

• NIST SP 800-171 Rev. 2 (protecting Controlled Unclassified Information)
• NIST SP 800-171 Rev. 3
• CMMC Program overview (DoD CIO)
• ISO/IEC 27001 (the commercial on-ramp Sean recommends)
• DFARS 252.204-7012 (safeguarding covered defense information)
• FIPS 140 validated encryption

Compliance & Assessment Concepts

• SPRS (Supplier Performance Risk System) — where self-assessments are posted
• DIBCAC (Defense Industrial Base Cybersecurity Assessment Center)
• C3PAO (CMMC Third-Party Assessment Organizations) via the Cyber AB

The False Claims Act Angle

• DOJ Civil Cyber-Fraud Initiative
• The False Claims Act (DOJ overview)

The Hosts & Show

• Swish
• GIST 360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Jul 21, 2026 24 min

Fed Christmas in July? The OMB M-26-14 Holiday Rush Begins!

Season 1, Episode 13

Show notes

Level One by Christmas. Level Two by Valentine's Day. Level Three by Independence Day. That's the OMB M-26-14 logging mandate clock federal agencies are now racing against — and if you don't want to spend your holidays at the office, it's time to start planning now! In Episode 13 of The GIST of Govt IT, Brian and Sean dig into OMB M-26-14 on the eve of Sean's fireside chat with CISA Director Nick Andersen. Sean breaks down what actually changed: the shift from long-term log hoarding (30 months of cold retention) to an outcomes-driven model focused on defending the cyberspace effectively, and the dramatic expansion of scope to include IoT and operational technology — the unmanaged, line-of-business-owned, often third-party-managed devices that CISOs have never had eyes on. The conversation walks through the mechanics: the Logging Reference Architecture (LRA) dropping mid-August, the 90-day plan requirement, and the three maturity levels with their rising inventory-and-logging thresholds (70/50, 80/80, 90/90). Brian and Sean unpack why asset inventory is the real "creeper" that will blindside teams, why OT discovery requires drop-in kits and passive network detection rather than active scanning that can break physical systems, why centralized logging matters for coordinated FSEB-wide defense, and how to think about "three-for-one" investments that solve this mandate and other capability gaps at once.
----------

RESOURCES MENTIONED IN THIS EPISODE

The Core Policy
- OMB M-26-14 (new logging mandate, issued May 22)
- OMB M-21-31 (the rescinded SolarWinds-era predecessor)
- OMB M-26-14 Signals a New Era for Cyber Visibility (BLOG)

Background: The SolarWinds / Sunburst Hack
- CISA on the SolarWinds supply chain compromise
- GAO review of federal M-21-31 log management adoption

The Maturity Milestones (per the memo)
- Level 1 (Basic) — ~120 days after LRA: 70% of assets inventoried, 50% logged centrally
- Level 2 (Intermediate) — ~Valentine's Day 2027: 80% inventoried, 80% logged
- Level 3 (Advanced) — ~320 days / Independence Day 2027: 90% inventoried, 90% logged

OT/IoT Discovery & Network Detection Solutions Referenced
- Zeek
- Corelight (commercial Zeek / "Sericana" reference
- Armis
- Dragos
- Nozomi Networks

SIEM, SOAR & SOC Modernization
- Continuous Threat Exposure Management (CTEM)
- CISA SIEM-as-a-service with Elastic

Related Episodes
- Episode 12: The Founding Father's Guide to Federal IT
- Episode 7: Iran Came for the US Dams and We Got Lucky: Frontline Insight from the OT Fight
- Episode 6: Cupcakes and OODA Loops: Inside(r)'s Insights Into the New Federal Cyber Playbook

Upcoming Events
- July 14 Breakfast Briefing at the National Press Club — "When the Perimeter Disappears: Securing the Converged Federal Enterprise Across IT, IoT, and OT":
- July 14 Mid-Year Federal IT Priority Setting Session with a fireside chat featuring CISA Director Nick Andersen

The Hosts & Show
- Swish Data
- GIST 360

----------

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Jul 13, 2026 36 min

The Founding Fathers' Guide to Federal IT

Season 1, Episode 12

Show notes

Happy 250th birthday, America. In this special shortened Fourth of July episode of The GIST of Govt IT, Brian and Sean keep it snackable for the beach-and-boat crowd — kicking off with a debate over favorite founding fathers before turning to a rundown of the GIST 360 summer event lineup. Sean previews what's coming: a July 14 breakfast briefing at the National Press Club on securing the converged IT/OT/IoT enterprise; a mid-year federal IT priority-setting session featuring a fireside chat with CISA Director Nick Andersen, an ATARC roundtable on operationalizing continuous threat exposure management, as well as several webinars on deck. If you want to know where federal IT leaders are placing their bets for the last stretch of the fiscal year, this is your map to the conversations that matter. Plus a kite-surfing Ben Franklin!

----------

RESOURCES MENTIONED IN THIS EPISODE

Upcoming GIST 360 Events

- July 14 — Breakfast Briefing, National Press Club - "When the Perimeter Disappears: Securing the Converged Federal Enterprise Across IT, IoT, and OT"

- July 14 — Mid-Year Federal IT Priority Setting & Listening Session, The Riggs Rooftop (9th & E, Washington DC, 5:30–7:30 PM)

- August 13 — Webinar: "From the Edge to the Enterprise: The Future of Mission-Critical Infrastructure"

- August 25 — Webinar: "Rethinking Command and Control Resiliency at the Tactical Edge"

The Hosts & Show
- Swish
- GIST 360
----------

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Jul 6, 2026 19 min

The Five-Dollar Agentic AI Hacker

Season 1, Episode 11

Show notes

Four days. A spare $500 mini PC from Microcenter. An open-source quantized model running on 512 MB of VRAM. And by Thursday morning, an autonomous AI agent named Jenkins was finding vulnerabilities, chaining exploits, gaining root, and maintaining persistence — entirely on its own, with no human in the loop. In Episode 11 of The GIST of Govt IT, Brian and Sean are joined by Marlin McFate, Federal CTO and CISO at Cohesity to dig into the experiment Marlin documented on his new Substack, Peripheral Tech. Marlin walks through the architectural choices that made Jenkins possible — the "discussion skill" approach to working with agents like colleagues, the orchestrator-subagent model, the safety capability files that proved more effective than external guardrails — and why the implications go far beyond "Mythos changed everything." The conversation digs into the real thesis: the barrier to nation-state-grade offensive cyber didn't just fall — it fell years ago, and most organizations are still spending 80% of their cybersecurity budget trying to prevent attacks rather than recover from them. Brian, Sean, and Marlin unpack the digital jump bag, the minimum viable agency concept, why finding the last clean backup is "a bad lie" the industry has been telling for years, and what Cohesity's RAG-enabled secondary data approach means for agencies trying to feed AI without standing up a fifth copy of their data. Plus, AI agents throw fits and take on personalities for their own.

----------

RESOURCES MENTIONED IN THIS EPISODE

Featured Guest
- Marlin McFate, Federal CTO & CISO, Cohesity
- Peripheral Tech (Marlin's Substack)
- Jenkins
- Cohesity Federal
- Cohesity Gaia (conversational AI search for backup data)

The Experiment & The Stack
- Kali Linux (penetration testing OS)
- Ollama (local LLM runtime)
- Qwen open-source models (Alibaba)
- The Mythos vulnerability discovery report (Cloud Security Alliance)
- Anthropic Project Glasswing

Agentic AI & Security
- Gambit Security research on multi-AI hacker (Anthropic + OpenAI split-context attack on Mexican government)

Federal Cyber Policy & Frameworks
- OMB M-26-14 (cybersecurity logging and monitoring for IT/IoT/OT)
- CISA Industrial Control Systems resources
- NIST AI Risk Management Framework

Concepts Discussed
- Westrum Organizational Culture Typology
- Project Bravo (Stuart Wagner, formerly Air Force, now Navy)
- Platform One (DoD DevSecOps platform)

Open Source AI Frameworks
- vLLM (high-throughput LLM inference)
- Red Hat OpenShift AI

Learning Resources
- O'Reilly Learning Platform
- O'Reilly AI Sandboxes & Guided Labs

Related Episodes
- Episode 7: Iran Came for the Dams and We Lucky
- Episode 2: Fighting Fire with Fire to Secure Federal Agents

Upcoming Event
- Marlin speaking at AWS Public Sector Summit DC — Tuesday, June 30, 2:00 PM, Convention Center side theater

The Hosts & Show
- Swish
- GIST 360 program

----------

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Jun 29, 2026 1 hr 14 min

An Apache Down. An ASV Up: Crossing the Rubicon for Autonomous Warfare

Season 1, Episode 10

Show notes

In Episode 10 of The GIST of Govt IT, Brian and Sean are joined by David Hutchins, Director of Naval Systems and Defense Technology at Forecast International, fresh off SOF Week in Tampa to discuss the pervasiveness of autonomous systems and platforms that is changing calculus of warfare. David, a Marine Corps veteran who enlisted at 17, walks through the moment autonomous warfare crossed the Rubicon. The conversation digs into the cat-and-mouse evolution of counter-drone tech in Ukraine, why the LCS may finally have found its purpose in de-mining the Strait of Hormuz, the supply chain reality of mass-producing autonomous systems, the role of contested logistics and modular open architectures, and the upcoming World Cup. Plus the ever creative tactics of Marines in the field and how Sean once used pantyhose to keep sand out of IT systems when he was down range.

----------

RESOURCES MENTIONED IN THIS EPISODE

Featured Guest
- David Hutchins, Director of Defense Technology and Naval Systems, Forecast International
- Forecast International
-Defense & Security Monitor (Forecast's research blog)

Forecast International Related Resources

- Strait of Hormuz Under Threat of Mines, Are Literal Combat Ships the Solution
- A New DAWG in the Fight: The Pentagon's $54B Bet on Autonomous Warfare https://dsm.forecastinternational.com/- Safeguarding the World Cup: The Critical Role of Counter Drone Systems

Defense Autonomous Warfare Group (DAWG) Coverage
- DefenseScoop on the FY27 DAWG budget
- Task & Purpose on the $54B DAWG ask
- The Hill analysis on the autonomous warfare pivot
- SOUTHCOM Autonomous Warfare Command (SAWC)

Key Events Referenced
- SOF Week 2026
- Maneuver Warfighter Conference (Fort Benning, GA)

The Strait of Hormuz Helicopter Rescue
- AH-64 Pilots Rescued by Uncrewed Surface Drone (BBC)
- Saronic Corsair USV platform overview

Unmanned Naval Systems Discused
- SailDrone (Coast Guard partner, Great Lakes & North Atlantic)
- US Coast Guard Coastal Sentinel program

Drone & Counter-Drone Programs Referenced
- Project Maven (DoD AI-enabled targeting)
- DoD Drone Dominance program

World Cup 2026 Counter-UAS Funding
- DHS Counter-UAS resources: https://www.cisa.gov/topics/physical-security/unmanned-aircraft-systems-uas
- Counter-UAS for World Cup

Counter-Drone Technology & Standards
- FAA Drone Regulations & Pilot Licensing
- FAA Beyond Visual Line of Sight (BVLOS) rules

The Hosts & Show
- Swish
- GIST 360

----------

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Jun 22, 2026 57 min

Quad Charts be Damned: Data Meets the Mission

Season 1, Episode 9

Show notes

For years now, the question for federal agencies has been the same: is your data ready for AI? In Episode 9 of The GIST of Govt IT, Brian and Sean sit down with Andrew Churchill, who leads Qlik's Public Sector Business across the US and Canada, to dig into whether the answer is finally shifting from "not yet" to "we're getting there" — and what's actually driving it. Andrew shares how policy moves are pushing the idea that data belongs to the mission, not the system owner; how AI is automating the mundane data prep work; and why the trust score on the data behind an AI recommendation is becoming the single most important factor for senior leaders making decisions. Brian, Sean, and Andrew unpack the agentic identity challenge nobody's talking about, the IBM Think team that burned 20% of its annual Mythos token budget in a single weekend, why a federal employee who knows the mission plus AI beats a forward-deployed engineer every time. Why federal data progress is a war of inches and why leaders need to turn the people delivering small wins into heroes — quad charts be damned. Plus, live music recommendations for the DC region.

----------

RESOURCES MENTIONED IN THIS EPISODE

Featured Guest
- Andrew Churchill, VP Public Sector, Qlik
- Qlik Public Sector
- Qlik Data Literacy Program (free resources)
- Qlik FedRAMP authorization status

Hegseth's Advana Memorandum
- Advana restructuring memo and program overhaul (Jan 2026)
- Hegseth's "Transforming the Warfighting Acquisition System" memo (Nov 7, 2025)

DoD AI/Data Programs Referenced
- Advana (DoD enterprise data and analytics platform)
- Project Maven (DoD computer vision/AI)
- Project Bravo (Air Force innovation initiative)

Federal Data Policy
- DoD Data Strategy
- Federal Data Strategy (strategy.data.gov)
- Data.gov

Live Music Featured
- Tedeschi Trucks Band - Bound for Glory
- Tedeschi Trucks Band Live from Red Rocks - Full Concert
- Point Break Music Festival
- Warped Tour DC

References & Concepts
- Gartner BI/Analytics Magic Quadrant
- Stuart Wagner (Navy, former Air Force CTO)
- Lori Mangold (Booz Allen, former Army Chief G3/5/7)

Previous Events
- Transforming Data Into a Strategic National Asset w/ NASA CDO
- Qlik Public Sector Summit

Life's a Game of Inches

- "Al Pacino" Epic Monologue from Any Given Sunday

The Hosts & Show
- Swish
- GIST 360

Come find Brian, Andrew, and Sean at a show this summer. Quad charts not required!

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Jun 15, 2026 52 min

Minutes, Not Months: Inside the New Cyber Velocity Facing Federal Agencies

Show notes

48 hours. That's the time it took for a federal employee credentials to be stolen as a result of a phishing attack, to being listed on a dark web marketplace. In Episode 8 of The GIST of Govt IT, Brian and Sean sit down at Check Point's Engage Summit in DC with Yochai Corem, General Manager of Check Point's Exposure Management division, to unpack what happens when both sides of cyber warfare have agentic AI — and why the next three years will not be kind to defenders. Yochai shares why pen testing once a quarter is no longer relevant, how a single Chinese developer built an entire attack program in a week using an army of agents, and what Iranian threat actors targeting Israeli hospitals look like in real-time during active kinetic conflict. The conversation digs into agentic red teaming vs. automated red teaming (and why the difference matters), why "safe remediation" still keeps a human in the loop, how to use the firewalls, WAFs, and IPS you already own as compensating controls when patching takes weeks, and the under-discussed reality that government leaders must put their hands on the keyboard with AI. Plus: Yochai's family cookbook and other vibe-coding stories.

RESOURCES MENTIONED IN THIS EPISODE

Featured Guest

- Yochai Corem, GM, Exposure Management, Check Point
- Corem Travel — Yochai's travel planning app

Check Point
- Check Point

- Check Point Exposure Management
- Check Point Engage Summit - Washington, DC

Check Point's Exposure Management Acquisitions
- Cyberint (now part of Check Point's external risk management)
- Veriti (automated security control management)
- Cyclops (now Check Point's CAASM offering)

Exposure Management & CTEM Framework
- Gartner Continuous Threat Exposure Management (CTEM) overview
- CISA Known Exploited Vulnerabilities (KEV) Catalog

Agentic AI & Red Teaming
- OWASP Top 10 for LLM Applications
- OWASP AIVSS — AI Vulnerability Scoring System for Agentic AI
- MITRE ATLAS (Adversarial Threat Landscape for AI Systems)

Threat Actor Tracking

- Check Point Research (threat intelligence blog)

- Check Point ThreatCloud AI

Concepts & References

- Air-gapped network security guidance (NIST SP 800-82)

- IRGC (Iranian threat actor background — CISA advisory on CyberAv3ngers)

Related Episodes

- Episode 7: Iran Came for the Dams and We Got Lucky: Frontline Insights into the OT Fight
- Episode 6: Cupcakes & OODA Loops: Inside(r) Insights Into the New Federal AI Cyber Playbook
- Episode 5: Vibe Hacking and Nation State Cyber Threats

Upcoming Events

- GIST 360 Breakfast Briefing at the National Press Club, July 14, 2026 - When the Perimeter Disappears

The Hosts & Show
- Swish
- GIST 360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Jun 8, 2026 41 min

Iran Came for US Dams and We Got Lucky: Frontline Insights from the OT Fight

Season 1, Episode 7

Show notes

When Iranian-linked cyber actors hit U.S. water, energy, and government facilities through internet-exposed Rockwell Allen-Bradley PLCs during the sixth week of the U.S.–Iran military campaign, they did it with attacks that were eightfold above baseline and got within 30 to 40 minutes of opening dam gates. In Episode 7 of The GIST of Govt IT, Brian and Sean sit down with Matthew Shalbetter, Director of Strategy for Civilian Agencies at Armis Federal and a 16-year HHS veteran, to unpack what's really happening at the convergence of IT and OT. Matthew breaks down why cyber has become the great equalizer for nation-state actors, the difference between Iranian "disrupt and distract" tactics, and Chinese prepositioning ahead of a potential Taiwan invasion. The conversation digs into the cultural chasm between IT and OT teams, what the Ukrainians taught a roomful of Western OT practitioners at RSA about why red teaming beats paperwork, and the basics that still aren't done. Trump's seven-page cyber strategy and what ServiceNow's $7.75B acquisition of Armis — closed April 20 — means for federal customers. Plus: Matthew's Hacker Name...DirtTrack

RESOURCES MENTIONED IN THIS EPISODE

Featured Guest

- Matthew Shallbetter, Director of Strategy for Civilian Agencies, Armis Federal
- Armis Federal

The Iranian PLC Attacks

- CISA Joint Advisory AA26-097A — Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure
- Rockwell Automation security advisories
- CyberAv3ngers / IRGC threat actor background

OT Discovery & Exposure Research
- Shodan — internet-exposed device search engine
- Censys — internet asset discovery
- Armis State of Cyberwarfare Report

OT/ICS Frameworks & Government Guidance

- NIST SP 800-82 — Guide to Operational Technology Security
- CISA Cross-Sector Cybersecurity Performance Goals (CPGs)
- DoD Zero Trust Overlays (including OT guidance)
- NERC CIP Standards (electric sector OT)

Federal Cyber Policy

- White House National Cyber Strategy (the seven-page version)
- CDM Program (Continuous Diagnostics and Mitigation)
- CISA Industrial Control Systems resources

The ServiceNow + Armis Deal
- ServiceNow completes Armis acquisition (April 20, 2026)

Threat Actor Tracking Partners Referenced
- Armis Centrix Threat Intelligence
- Dragos

Related Episodes
- Episode 5: Vibe Hacking” and Nation State Cyber Threats
- Episode 6: Cupcakes & OODA Loops: Inside(r) Insights Into The New Federal AI Cyber Playbook

Upcoming Event
- GIST 360 Breakfast Briefing at the National Press Club, July 14 - When the Perimeter Disappears Securing the Converged Federal Enterprise Across IT, OT and IoT Environments

The Hosts & Show
- Swish
- GIST 360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

Jun 1, 2026 57 min

Cupcakes & OODA Loops: Inside(r) Insights Into the New Federal AI Cyber Playbook

Season 1, Episode 6

Show notes

Last episode, we left you hanging with a question: when it comes to cybersecurity, what is the federal government doing to both leverage AI and defend against AI threats and most importantly, are we moving fast enough? In the conclusion of this two-part series, Sean takes us inside a White House industry day convened at the request of the Federal CISO Council. He breaks down the two themes of the day that framed very different problems: using AI to optimize cybersecurity (running a SOC, governance, and compliance faster) and securing AI itself. Brian and Sean dig into the agentic SOC, the build-vs-buy question for federal agencies, why data fragmentation is the recurring obstacle in every AI conversation, the role of MCP and RAG in getting agents to the data, and live demos. Cupcakes and OODA loops make an appearance and Sean provides his verdict on whether the government is moving fast enough and his hacker name is finally revealed.

RESOURCES MENTIONED IN THIS EPISODE

The White House Industry Day

- About the Indian Treaty Room, Eisenhower Executive Office Building

Vendors & Demos Featured in the Episode

- Lasso Security (AI red teaming and purple teaming)

- SimSpace (full-stack cyber range simulation)

- Elastic AI workflows (bring-your-own-LLM, air-gap deployable)

AI Security Frameworks & Standards

- OWASP Top 10 for LLM Applications

- OWASP AIVSS — AI Vulnerability Scoring System (agentic AI)

- MITRE ATLAS (Adversarial Threat Landscape for AI Systems)

Key Technical Concepts
- Model Context Protocol (MCP) — bringing the agent to the data

- Retrieval-Augmented Generation (RAG) explained

- CDM Program (Continuous Diagnostics and Mitigation)

- OODA Loop

Industry & Government Collaboration Communities

- ATARC — Advanced Technology Academic Research Center

- ATARC Working Groups (Zero Trust, Agentic AI, Cyber AI Convergence)

- Northern Virginia Technology Council (NVTC)

- OWASP (Open Worldwide Application Security Project)

Other References
- Geoffrey Moore, Crossing the Chasm (technology adoption lifecycle)

- Jerry Garcia Ties

- Grateful Dead Merch

- Phish (The Band)

Related Episodes
- Episode 5: "Vibe Hacking" and Nation State Cyber Threats

- Episode 2: Fighting Fire with Fire: Federal AI Security - Securing Agentic AI with Elad Schulman, CEO of Lasso Security

The Hosts & Show
- Swish
- GIST360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

May 25, 2026 38 min

Vibe Hacking and Nation State Cyber Threats

Season 1, Episode 5

Show notes

Your router may not be your router. It could be a Russian surveillance device. In Episode 5 of The GIST of Govt IT, Brian and Sean unpack a stunning two weeks in cybersecurity: the FBI's court-authorized takedown of a Russian GRU operation that silently hijacked thousands of TP-Link routers across 23 American states, an Iranian-linked APT group actively disrupting U.S. water and energy systems through Allen-Bradley PLCs, and Anthropic's release of Claude Mythos — a frontier model so capable at finding zero-day vulnerabilities that the company chose not to release it publicly. They break down what Project Glasswing means for industry, how AI is becoming both the most dangerous offensive weapon and the most powerful defensive tool a CISO has ever had, why "vibe hacking" is democratizing cyber attacks (one low-skill actor compromised 600 FortiGate firewalls across 55 countries), and why the old playbook for SOC operations needs to be blown up entirely. What the unresolved tension between Anthropic and the DoD over supply chain risk designation means for federal agencies trying to defend critical infrastructure while CISA operates at 38% capacity. Plus Sean shares his hacker name (maybe) if he wasn't a CTO and instead worked in a windowless office in Pyongyang.

----------
RESOURCES MENTIONED IN THIS EPISODE

The Russian GRU Router Operation

- DOJ announcement: Operation Masquerade — court-authorized disruption of DNS hijacking network
- FBI Public Service Announcement on GRU exploitation of TP-Link routers

- NSA statement on Russian GRU router threats
- CVE-2023-50224 (the TP-Link vulnerability exploited)

Iranian-Linked Attacks on U.S. Critical Infrastructure

- CISA Joint Advisory AA26-097A — Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure
- Rockwell Automation security guidance

Anthropic, Claude Mythos & Project Glasswing

- Anthropic on Project Glasswing
- Anthropic's statement on the DoD supply chain risk designation
- Cloud Security Alliance whitepaper on Mythos vulnerability discovery

Cybersecurity Frameworks & Government Resources
- CISA Edge Device Security
- CISA Cross-Sector Cybersecurity Performance Goals (CPGs 2.0)
- MITRE ATT&CK Framework
- CISA Industrial Control Systems advisories

Related Episodes
- Episode 2: Fighting Fire with Fire: Federal AI Security - Securing Agentic AI with Elad Schulman, CEO of Lasso Security
- Episode 3: Chaos, Change, and Opportunity in Federal IT - $50B in Q4 federal IT contracting, Golden Dome, and the Anthropic supply chain risk designation

The Hosts & Show

- Swish
- GIST360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com

Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

May 18, 2026 34 min

A New Playbook for Small Businesses and Startups in Federal IT

Season 1, Episode 4

Show notes

From a startup consulting shop to a $1.4B IBM acquisition, Octo Consulting Group's story is one of the great growth journeys in government IT. Brian and Sean sit down with Jay Shah, Octo's former COO, who helped guide the company through every inflection point — the pivot to DevSecOps and agile, the move from sub to prime, the strategic (and intentional non-) use of the 8(a) program, the 2019 Arlington Capital investment, four acquisitions, the launch of OLabs, and the IBM exit in December 2022. Jay shares the unvarnished playbook for scaling in the federal market: why diversification matters more than the 8(a) badge, when to be bold with primes (and when to bluff), how to turn billable services into IP, why OLabs only worked because they had base hits first, and what most founders get wrong about working capital. Plus, Brian and Jay geek out on funk master flautist Karl Denson.
----------

RESOURCES MENTIONED IN THIS EPISODE

Featured Guest
- Jay Shah
- Octo
- OLabs

Capital, Mentorship & Workforce Development
- Mason Enterprise — APEX Accelerator
- Veterans Institute for Procurement (VIP)
- Andreessen Horowitz American Dynamism
- Pax Ventures

Books & Frameworks Referenced
- The Trusted Advisor by David Maister, Charles Green, and Robert Galford
- The Scaled Agile Framework (SAFe)
- Westrum Organizational Culture Typology
- Gene Kim & The Phoenix Project
- DORA (DevOps Research and Assessment)

Live Music Worth Checking Out
- Karl Denson's Tiny Universe
- The Greyboy Allstars
- Kenny Rogers

Insane Knuckleballs

Jay's Nonprofit Work
- The Children's Inn at NIH
- Wolf Trap Foundation for the Performing Arts
- Loudoun Hunger Relief

The Hosts & Show
- Swish
- GIST360

CONNECT WITH US

Got an idea for a future episode? Want to be a guest? Let us know.

Brian Lake - blake@swishdata.com

Sean Applegate - sapplegate@swishdata.com