The BLUF Podcast

On this episode we breakdown a webinar with OKTA focused on securing AI agents. It explains that AI agents bring non-deterministic behavior, machine-speed execution, and autonomous decision-making that break legacy security assumptions built for human users, expanding attack surface and complicating accountability. The core issue is identity and control: managing non-human identities and answering where agents are, what they can access, and what they’re allowed to do across cloud, hybrid, and classified environments. It emphasizes chain-of-custody tracing from user to agent to sub-agent, especially for ephemeral agents, and argues authorization is now the key zero-trust battleground amid rising AI-driven threats like prompt injection and phishing, highlighting identity-silo reduction and real-time authorization.
00:00 How AI Agents Change Security 01:16 Why Agents Break Assumptions 02:14 Identity As Control Plane 02:51 Chain Of Custody 03:37 Authorization is the New Zero Trust! 04:16 AI Threat Landscape 04:45 Bottom Line Up Front 05:12 Integration And Execution 06:03 Wrap Up And Subscribe
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This week's episode explains why traditional workstation-centric KVM architectures are becoming obsolete for command centers and cyber operations as missions become distributed, virtualized, and collaboration-driven. It highlights Black Box’s Emerald modern KVM over IP approach, where devices act as native IP endpoints integrated into enterprise layer-three networks, enabling multi-site and remote operations. Emerald supports unified access to physical systems, virtual machines, web apps, and IP video feeds, and offers multi-view interaction with up to 16 sources to improve situational awareness and reduce cognitive load. We emphasize resilience through redundancy and endpoint independence, scalability over LAN/WAN/VPN with compression tuning, and note KVM over IP augments—rather than replaces—air-gapped and NIAP-certified secure KVM requirements. 
00:00 Why Workstations Fail 01:27 The KVM Over IP Shift 02:03 Unified Source Integration 02:40 Multi View Operations 03:13 Resilience And Redundancy 03:43 Scale Across Missions 04:06 Security And Compliance 04:40 Bottom Line Takeaways 05:05 Integrating and Modernizing Next Steps 05:53 Subscribe And Sign Off
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This week we're focused on the operational reality of AI: rising costs, control, governance, and mission impact. It argues AI has moved beyond experimentation into budgets and oversight, with recent billing changes (e.g., Anthropic) highlighting unpredictable token-based consumption and pricing volatility. Examples from an Apptio session show enterprises exhausting annual token budgets early, framing this as a visibility, control, and governance failure, and introducing “token economics” as a new FinOps challenge tied to PPBE and cloud vs on-prem/sovereign decisions. It warns governance is the biggest risk, citing an AI agent deleting production systems, and emphasizes defining value and success metrics before scaling. It outlines three progress areas—strategic planning, infrastructure strategy, and governance—and positions Apptio and ATPGov as partners to implement FinOps/token economics, AI governance frameworks, and AI centers of excellence.
00:00 The AI Reality Check 01:13 Costs Are Catching Up 02:36 Token Economics Explained 03:31 Governance Risk Stories 05:01 AI Accelerates Everything 05:48 Operationalize AI Frameworks 06:31 Bottom Line Takeaways 06:54 How ATPGov Helps
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

On this episode we distill a Dragos public sector session on industrial control system (ICS) threat intelligence and the Worldview platform, framing OT cyber as a national security priority and part of the modern battlespace. We explains why OT defense differs from IT—legacy systems, limited patching, flat trust-based networks, living-off-the-land techniques, and physical consequences—and highlights a shift by threat actors from reconnaissance to operational effects, including coordinated grid activity in Poland, persistent access in power grids for potential kinetic scenarios, maritime targeting of ports and naval logistics, and opportunistic scanning/exploitation of internet-facing OT assets. Dragos is positioned as intelligence-driven, providing adversary tracking, OT-specific IOCs, impact-based vulnerability prioritization, and continuous reporting based on real incident experience. ATPGov emphasizes operationalizing this intelligence through SOC/SIEM integration, secure IT/OT convergence, and mission-aligned execution.
00:00 Why ICS Intel Matters 01:10 Threat Actors Inside OT 03:01 OT Defense Is Different 03:38 Real World OT Attacks 04:32 What Dragos Delivers 05:22 The Dragos Worldview Intelligence Platform 06:02 Mission Assurance Takeaways 06:50 Bottom Line Up Front 07:10 Operationalizing With ATPGov
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode of The Bottom Line Up Front focuses on AI governance and ISO 42001, the first global auditable standard for AI management systems. We explain how ISO 42001 certifies an organization’s decision-making and governance processes around AI—not specific models or products—and emphasizes that auditors validate real-world behavior, evidence, and repeatable processes such as AI inventories, clear objectives, risk and impact assessments, assigned accountability, and oversight of third-party AI. A fair warning that “paper-only” governance fails audits, and stresses starting with mission objectives and risk rather than implementing controls blindly. The script notes overlap with ISO 27001, RMF, SOC 2, CMMC, and NIST AI RMF, outlines a typical 6–9 month implementation, and highlights growing contractual and legislative pressure for provable AI governance, offering ATPGov support to operationalize and audit-prepare these efforts.
00:00 Why AI Governance Now 01:18 ISO 42001 Explained 02:33 What Auditors Verify 03:42 Common Failure Modes 04:30 Risk First Then Controls 05:34 Leverage Existing Frameworks 06:53 When to Adopt ISO 42001 07:19 Implementation Roadmap 07:41 Contractual Pressure Ahead 08:01 Bottom Line, Takeaways and Wrap Up
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode of The BLUF explores agentic AI and how to secure autonomous AI systems before they become a major attack surface. Guests Jacqueline Biggio (Menlo Security) and Eric Avigdor (Chief Product Officer for Menlo Advanced Runtime Security, MARS) define a spectrum from AI assistants and coding tools to fully autonomous agents that can access systems like Salesforce or ServiceNow and execute tasks without human intervention. They describe customer concerns ranging from “shadow AI” data leakage by employees to mature deployments lacking guardrails against agents going rogue, goal hijacking, and data exfiltration. Menlo’s approach includes real-time inspection and sanitization to prevent poisoning and indirect prompt injection, plus Adaptive DLP for masking sensitive data, and warns that browser AI sidebars can access and send context from open tabs to LLMs. 
00:00 Agentic AI Stakes01:12 Meet The Guests01:48 What Are AI Agents?03:08 Customer Security Concerns05:10 MARS Runtime Protections06:51 Sidebar AI Data Risks08:43 Bottom Line Up Front09:23 Agency Adoption Roadmap10:11 Wrap Up
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This special edition of The Bottom Line Up Front “Quantum Security: Where to Start and What to Do Now,” was  moderated by Jason Gustetic from Arrow, along with ATP's Joey Swartz. During the webinar they explain why quantum computing changes the encryption landscape, define Q-Day as the arrival of a cryptographically relevant quantum computer, and argue the threat is already present due to “harvest now, decrypt later” data theft by nation-state-linked actors. They emphasize agencies must start planning now because post-quantum cryptography (PQC) migration can take years, recommending an organized approach centered on cryptographic discovery, dynamic inventorying, CBOM creation, automation, and “crypto agility” to swap algorithms. They discuss using proxies for immediate protection, prioritizing persistent high-value data, integrating tooling with CI/CD and ticketing, and measuring progress through integrated, reportable posture and compliance.
00:00 Special Episode: Briefing Setup and Speakers 01:43 Why Quantum Matters Now 03:18 Quantum Basics and Q-Day 06:14 Harvest Now Decrypt Later 07:42 Building a PQC Backbone 10:16 Proxies and Data Priorities 13:45 Crypto Discovery Essentials 16:56 Day One Four-Step Plan 18:58 CBOM and Business Decisions 21:13 Tools for Actionable Remediation 24:19 Operational Challenges at Scale 27:17 Measuring Crypto Agility 31:01 Wrap Up and Next Steps
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode of the BLUF focuses on AI systems that work in federal environments by summarizing a technical session on how AI shifts government needs from storage capacity to real-time, secure, actionable data for RAG, streaming inference, and thousands of concurrent agents. It explains why legacy architectures fail on data movement, latency, and security, then outlines VAST Data’s DASE (Disaggregated And Shared Everything) architecture. We describe VAST’s expansion from storage to an “AI operating system” unifying file/object/structured data, SQL and vector databases, Kafka-native streams, triggers/functions, and agent/insight engines, emphasizing baked-in zero trust with RBAC/ABAC and a global namespace across clouds and on-prem. Use cases include cyber investigations, IRS-style chatbots, and multi-tenant agency platforms, and it closes by positioning integrators like ATPGov to operationalize these solutions.
00:00 Introduction00:38 Why Federal AI Breaks 01:29 Real Time RAG Demands 02:19 Data Stack Bottlenecks 02:48 DASE Architecture Explained 03:23 Inside VAST Nodes 04:57 From Storage to AI OS 06:09 Proven Federal Use Cases 06:49 Triggers, Functions & Pipelines 07:35 Zero Trust ABAC Built In 08:05 Global Namespace Hybrid Data 09:02 Bottom Line Takeaways 09:39 Integrator Call to Action 10:10 Subscribe and Sign Off
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode distills Delinea’s walkthrough on quantum computing risk, post-quantum cryptography, and the Quantum Lock feature in Secret Server. It explains how quantum computers and Shor’s algorithm threaten public-key cryptography like RSA and ECC, enabling “harvest now, decrypt later” against data requiring 20–50 years of confidentiality, while symmetric encryption like AES-256 is more resilient. It highlights NIST-aligned post-quantum approaches such as lattice-based CRYSTALIS-Kyber (Kyber 1024) for key encapsulation. Quantum Lock adds an extra layer: secrets are encrypted with AES-256, the AES key is wrapped with RSA 2048 or Kyber 1024, and decryption requires a human password even if Secret Server is compromised; it is intended for tier-zero, static, long-term high-impact secrets and disables rotation/heartbeat features.
00:00 Why Quantum Risk Matters 01:07 Quantum Basics Explained 01:55 What Quantum Breaks 02:36 Post Quantum Crypto Kyber 03:09 Quantum Lock In Secret Server 03:57 Operational Constraints Use Cases 04:34 Why Act Before 2030 05:05 Bottom Line Takeaways 05:41 Integration Strategy And Support 06:20 Closing And Contact
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode focuses on AI as an indirect, increasingly automated threat to operational technology (OT). Drawing on a Blastwave webinar, it argues that offensive AI can rapidly exploit or even generate vulnerabilities, making “patch and pray” and human-speed detection/response inadequate for OT environments where mistakes can cause real-world safety impacts. We highlights risks from indirect AI exposure such as accidental data sharing, AI-generated scripts or PLC configurations, and hallucinations that can produce unsafe settings. It emphasizes fundamentals that scale against AI: assume breach, prevent discovery, stop IT-to-OT lateral movement, and use human-in-the-loop authentication and zero trust controls, positioning Blastwave and ATPGov as partners to operationalize these measures.
00:00 Introduction00:38 AI Threat To OT02:10 Machine Speed Attacks03:13 Indirect AI Exposure04:50 OT And AI Storm06:10 Why Defense AI Lags06:39 Zero Trust Fundamentals07:53 Blastwave In Practice08:35 Bottom Line Recap09:14 Next Steps And Outro
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.