Behind the Shield

Is FedRAMP 20x really making compliance easier, or is it fundamentally changing how organizations approach security?

In this episode of Behind the Shield, InfusionPoints CEO Gary Daemer sits down with Ajay Chandhok, CEO of Stratus Cyber, to discuss the realities of FedRAMP 20x, the growing role of GRC engineering, and why successful security programs require more than automated compliance checks.

Drawing on their experiences building and managing FedRAMP environments, Gary and Ajay explore the challenges of implementing Key Security Indicators (KSIs), integrating security operations with GRC workflows, and transitioning from traditional documentation-heavy compliance to continuous, machine-verifiable evidence.

They also discuss the evolving federal cloud security market, the importance of engineering talent, and why FedRAMP 20x represents both an opportunity and a challenge for Cloud Service Providers (CSPs).

What You'll Learn:

- Why FedRAMP 20x isn't necessarily easier than Rev. 5, and how it changes compliance expectations
- How GRC engineering and security automation are transforming FedRAMP compliance
- The challenges of implementing KSIs, automated validations, and continuous security monitoring
- Why integrating IT service management (ITSM) with GRC workflows is critical for operational security
- How CSPs can navigate the transition from FedRAMP Rev. 5 to FedRAMP 20x
- The growing importance of engineering expertise in federal cloud security
- How bootstrapped cybersecurity companies like InfusionPoints and Stratus Cyber approach innovation, hiring, and workforce development
- What's next for FedRAMP 20x, Class D, and federal agency adoption

Chapters:
0:00 Intro and Welcome to Behind the Shield
0:48 Ajay's Background and Stratus Cyber
3:13 Operations Over GRC Tools and FedRAMP 20x KSI Pipelines
7:23 Common FedRAMP 20x Misconceptions, Audits and Exceptions
12:31 Ticketing, ITSM Platforms and In-Boundary Tooling
16:37 Finding Customers and the Bootstrapped Origin Story
26:42 Building a Talent Pipeline: Hiring, Training and Culture
38:25 How FedRAMP 20x Has Changed the Landscape
44:32 Predictions and Challenges Ahead
51:35 Book Recommendations and Wrap-Up

Guest Links:
Ajay Chandhok: https://www.linkedin.com/in/ajay-chandhok/
Stratus Cyber: https://www.linkedin.com/company/stratus-cyber/
https://stratuscyber.com/

InfusionPoints Links:
Gary Daemer: https://www.linkedin.com/in/infusionpoints/
InfusionPoints: https://www.linkedin.com/company/infusionpoints/
https://infusionpoints.com/platform

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About InfusionPoints:
InfusionPoints is an evergreen cybersecurity, cloud engineering, and consulting firm helping organizations navigate the complexities of federal security and compliance. Since 2007, we’ve helped clients move beyond point-in-time compliance toward continuous trust through our Build. Operate. Prove. Defend. framework, bringing together secure cloud engineering, operations, continuous evidence, and active cyber defense. At the foundation is XBU40, our FedRAMP Class C Certified (Moderate) cloud platform, providing a secure, continuously operated foundation for government and regulated workloads.

What happens when traditional managed IT services and cybersecurity operations stop working in silos?

In this episode of Behind the Shield InfusionPoints' Chad Spears, CISO, and Mike Strohecker, VP of Engineering/Cloud Ops, explore the concept of the Secure Managed Service Provider (SMSP) and why a security-first approach to managed services is becoming increasingly important for organizations navigating cloud security, compliance, and evolving cyber threats.

Traditional Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) often operate separately, creating gaps in communication, accountability, and security. The SMSP approach brings infrastructure management, security operations, and compliance together to help organizations strengthen security, streamline operations, and respond to threats more effectively.

The conversation explores how emerging FedRAMP 20x requirements, Vulnerability Detection and Response (VDR), Vulnerability Exploitability Response (VER), CISA BOD 26-04, and AI-driven security challenges are accelerating the need for better collaboration between engineering, security, and compliance teams.

As cybersecurity threats evolve and compliance requirements become more demanding, security can no longer be an afterthought. Discover why bringing managed services and security together could be the next evolution in protecting modern cloud environments.

What You'll Learn

• What an SMSP is and how it differs from traditional MSP and MSSP models
• Why a security-first approach matters across both commercial and regulated environments
• How breaking down operational silos can improve cybersecurity and incident response
• The three key benefits of an SMSP: stronger security, time and cost savings, and greater operational maturity
• How FedRAMP 20x, VDR, and VER are changing vulnerability management expectations
• The role of AI in accelerating vulnerability detection, remediation, and secure operations
• How organizations can begin adopting an SMSP mindset without completely restructuring their existing vendor relationships

Chapters:

0:00 – Introducing SMSP
1:46 – Why Separate MSP and MSSP Vendors Fall Short
5:41 – Where SMSP Came From: FedRAMP, Commercial and VDR
9:09 – Benefit 1: Security First
13:23 – Benefit 2: Saving Time and Money
17:15 – Benefit 3: Maturity, AI and Vulnerabilities
22:52 – How to Start Operating This Way Today

Links:
Chad Spears: https://www.linkedin.com/in/chad-spears007/
Mike Strohecker: https://www.linkedin.com/in/michael-strohecker-238326172/
InfusionPoints: https://www.linkedin.com/company/infusionpoints/
https://infusionpoints.com/
https://infusionpoints.com/platform

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us: InfusionPoints helps organizations Build. Operate. Prove. Defend. secure, mission-ready environments in highly regulated markets. Our Continuous Trust Platform brings cloud, cybersecurity, compliance, and operations together to support FedRAMP, FedRAMP 20x, DoD, and other critical security requirements with greater automation, visibility, and continuous readiness.

What does it take to move beyond compliance checklists and build security into the foundation of your organization?

In this episode of Behind the Shield, InfusionPoints CEO and Co-Founder Gary Daemer sits down with Bhanu Jagasia, Chief Executive Samurai (CEO) & Founder at bladestack.io, to explore the evolution of FedRAMP, the growing role of AI in security engineering, and what FedRAMP 20x means for the future of cybersecurity and compliance.

Gary and Bhanu discuss why true security starts with engineering, not documentation, and how the industry is shifting toward greater transparency, automation, and collaboration. They also examine the changing roles of 3PAOs, independent assessors, and FedRAMP advisors as organizations prepare for a new era of continuous security assurance.

Beyond the technical conversation, they share their experiences building bootstrapped cybersecurity companies, maintaining customer-first cultures, and finding opportunities to innovate in a rapidly changing industry.

What You'll Learn

• Why security engineering should come before compliance documentation
• How FedRAMP 20x is changing the approach to security validation and certification
• The opportunities and challenges AI introduces for cybersecurity engineers
• How the roles of 3PAOs, independent assessors, and FedRAMP advisors are evolving
• Why greater transparency and collaboration within the FedRAMP community matter
• The benefits of building a bootstrapped, customer-focused cybersecurity company
• How automation and continuous validation are reshaping the future of compliance

Chapters

0:00 — Introduction to Bhanu Jagasia and bladestack.io
2:07 — Why Security Engineering Comes Before Compliance
5:07 — AI in Cybersecurity: Automation, Innovation, and Systems Thinking
13:07 — FedRAMP 20x: Transparency, Collaboration, and Industry Change
21:07 — How FedRAMP 20x Is Changing the Role of 3PAOs and Advisors
29:07 — Building Trust and Growing a Cybersecurity Business
32:07 — Bootstrapping a Cybersecurity Company Without Outside Investors
37:07 — Leadership Lessons, Business Values, and Book Recommendations
42:07 — The InfusionPoints Story: Building a Security-First Company
47:07 — Final Thoughts on Cybersecurity, FedRAMP 20x, and Innovation

Guest Links: 
Bhanu Jagasia: https://www.linkedin.com/in/bhanujagasia/
bladestack.io: https://www.linkedin.com/company/bladestackio/home/
https://bladestack.io

InfusionPoints Links:
Gary Daemer: https://www.linkedin.com/in/infusionpoints/
InfusionPoints: https://www.linkedin.com/company/infusionpoints/
Continuous Trust Platform: https://infusionpoints.com/platform
https://infusionpoints.com/

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us: InfusionPoints helps organizations Build. Operate. Prove. Defend. secure, mission-ready environments in highly regulated markets. Our Continuous Trust Platform brings cloud, cybersecurity, compliance, and operations together to support FedRAMP, FedRAMP 20x, DoD, and other critical security requirements with greater automation, visibility, and continuous readiness.

Is FedRAMP 20x making cybersecurity compliance easier, or is the industry overlooking what it actually takes to build and maintain secure systems?

In this episode of Behind the Shield, host Gary Daemer, CEO and Co-Founder of InfusionPoints, sits down with Matt Earley, President and Founder of 38 North Security, to discuss the evolution of FedRAMP, the challenges of cybersecurity compliance, and what the shift toward FedRAMP 20x means for cloud service providers (CSPs), third-party assessors, and federal agencies.

Drawing on decades of experience in cybersecurity, security engineering, and federal compliance, Gary and Matt explore why purchasing a GRC tool alone isn't enough to achieve FedRAMP certification, why security by design must come before compliance, and how automation is changing the way organizations approach continuous assurance.

They also discuss the evolving role of third-party assessment organizations (3PAOs), the challenges of FedRAMP 20x agency adoption, and the opportunities and limitations of artificial intelligence in cybersecurity.

From building cybersecurity teams and developing new compliance technologies to navigating the transition from FedRAMP Rev. 5 to FedRAMP 20x, this conversation takes an honest look at where the industry has been, where it's headed, and what organizations need to consider along the way.

What You'll Learn:

• FedRAMP 20x vs. Traditional FedRAMP: How compliance expectations and security assessments are changing.
• Why GRC Tools Aren't Enough: Why certification requires more than compliance software and automated checklists.
• Security by Design: Why secure engineering is essential for continuous assurance.
• The Future of Third-Party Assessments: How assessor roles and independence are evolving.
• AI in Cybersecurity: Where automation helps and where human oversight remains essential.
• Federal Agency Adoption: Challenges with machine-readable evidence and KSIs.
• Building Cybersecurity Teams: The importance of internships, mentorship, and engineering expertise.

Chapters: 
0:00 — Introduction and Background of Matt Earley
9:39 — The Evolution of 38 North Security
21:34 — Challenges in Achieving FedRAMP Compliance
23:21 — The Importance of Internships and Training
23:48 — Building a Diverse Team for Success
24:45 — Navigating FedRAMP and Third-Party Assessors
26:47 — The Evolving Role of Assessors
28:01 — Global Perspectives on Cybersecurity Standards
30:13 — The Future of FedRAMP and Agency Adoption
32:05 — Challenges in Compliance and Governance
33:27 — Developing New Products for FedRAMP 20x
36:03 — The Role of AI in Cybersecurity
40:42 — Questions and Insights on Federal Adoption
46:50 — Book Recommendations and Closing Thoughts

Guest Links: 
Matthew Earley: https://www.linkedin.com/in/earleym/
38North Security: https://www.linkedin.com/company/38north-security/
https://38northsecurity.com/

InfusionPoints Links:
Gary Daemer: https://www.linkedin.com/in/infusionpoints/
InfusionPoints: https://www.linkedin.com/company/infusionpoints/
Continuous Trust Platform: https://infusionpoints.com/platform
https://infusionpoints.com/

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us: InfusionPoints helps organizations Build. Operate. Prove. Defend. secure, mission-ready environments in highly regulated markets. Our Continuous Trust Platform brings cloud, cybersecurity, compliance, and operations together to support FedRAMP, FedRAMP 20x, DoD, and other critical security requirements with greater automation, visibility, and continuous readiness.

What happens when compliance starts operating at machine speed?

In this episode of Behind the Shield, Gary Daemer sits down with Tieu Luu, Chief Product Officer at Qmulos, to explore the evolution of compliance automation, continuous monitoring, AI, and evidence-driven security.

Tieu shares how Qmulos approaches compliance as a massive data problem, using security telemetry, automation, analytics, and Splunk to help organizations assess whether security controls are operating effectively.

The conversation explores the challenges of automating NIST 800-53 controls, collecting technical evidence at scale, normalizing data across different technologies, and keeping human assessors in the loop.

Gary and Tieu also discuss the growing role of AI and agentic technologies in cybersecurity and compliance, from generating documentation and SSP content to automating control assessments, analyzing large volumes of security data, and accelerating software development.

They also explore one of the biggest challenges emerging alongside that speed: how organizations verify and validate what AI produces.

The conversation turns to FedRAMP 20x and the broader movement toward continuous proof, machine-readable evidence, automated validation, and security outcomes that can be demonstrated continuously rather than through periodic compliance exercises.

For CISOs, CIOs, cybersecurity leaders, compliance teams, cloud service providers, and anyone working with FedRAMP, NIST 800-53, GRC, or continuous monitoring, this episode offers a look at where compliance automation is heading and why security and compliance increasingly need to operate as two sides of the same coin.

WHAT YOU’LL LEARN:
• Why compliance automation is fundamentally a data problem
• How organizations can automate evidence collection using security telemetry
• Where NIST 800-53 controls can and cannot realistically be automated
• How continuous monitoring can provide ongoing insight into control effectiveness
• Why normalized data models matter when working across multiple security technologies
• How AI and agentic technologies could transform control assessments and compliance workflows
• Why human verification and validation still matter as AI accelerates development
• How FedRAMP 20x is advancing continuous proof and automated security validation
• Why security and compliance need to operate at the same speed
• How building security correctly from the beginning can make compliance a natural byproduct

CHAPTERS:
0:00 - Introduction to Tieu Luu
1:33 - Qmulos, Splunk, and Compliance Automation
6:45 - The Challenges of Automating Compliance
9:26 - Automating Evidence Collection
11:30 - Security Telemetry vs. Screenshots
14:06 - Continuous Monitoring Across Complex Environments
18:18 - Compliance as a Massive Data Problem
23:01 - Building a Common Data Model for Security Evidence
24:55 - How AI Is Changing Compliance Automation
27:21 - AI, Security Operations, and Incident Response
29:24 - Bringing SOC Speed to Compliance
31:26 - FedRAMP 20x and Continuous Proof
36:15 - Building Teams in the Age of AI
38:31 - Validating and Evaluating AI-Generated Work
40:25 - Where InfusionPoints and Qmulos Align
42:09 - Why Security and Compliance Are Two Sides of the Same Coin
43:34 - Closing Thoughts

Guest Links:
Tieu Luu: https://www.linkedin.com/in/tieuluu/
Qmulos: https://www.linkedin.com/company/qmulos/about/
https://qmulos.com/


InfusionPoints Links:
Gary Daemer: https://www.linkedin.com/in/infusionpoints/
InfusionPoints: https://www.linkedin.com/company/infusionpoints/
Continuous Trust Platform: https://infpts.com/platform
https://infusionpoints.com/

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us: InfusionPoints helps organizations Build. Operate. Prove. Defend. secure, mission-ready environments in highly regulated markets. Our Continuous Trust Platform brings cloud, cybersecurity, compliance, and operations together to support FedRAMP, FedRAMP 20x, DoD, and other critical security requirements with greater automation, visibility, and continuous readiness.

Behind the Shield is officially one year old, and we’re looking back at how the show started, what we’ve learned along the way, and some of the moments that shaped its first year.

For the first time ever, Behind the Shield producer Caitlin Pitkin steps out from behind the camera and joins the conversation.

Felisha Daemer and Caitlin Pitkin reflect on Caitlin’s path to InfusionPoints, how producing nearly 50 episodes of Behind the Shield accelerated her understanding of FedRAMP, cybersecurity, cloud security, and compliance, and how the podcast has evolved alongside a rapidly changing industry. They also bring a little personality to the anniversary episode, with Caitlin repping Harry Styles and Felisha wearing Spiritbox as a subtle nod to the music they love.

Throughout the episode, Chad Spears, Mike Strohecker, Jason Shropshire, and Gary Daemer share favorite moments, lessons learned, behind-the-scenes stories, and reflections on how Behind the Shield has evolved.

A major part of that evolution has been FedRAMP.

When Behind the Shield began, the federal cloud security landscape was already changing quickly. Over the course of the first year, the podcast became a place to break down FedRAMP updates, FedRAMP 20x, vulnerability management, continuous monitoring, automated evidence, cloud security, and the broader shift toward more continuous approaches to trust and compliance.

Rather than simply reacting to new requirements, the team has used Behind the Shield to make complex FedRAMP and cybersecurity topics easier to understand, explain what changes mean in practice, and help CSPs, government teams, and security professionals keep up with a rapidly evolving environment.

The episode also brings things full circle as Jason Shropshire and Gary Daemer revisit the earliest days of the show and react to our first-ever Behind the Shield recording.

It has been a year of learning, experimenting, technical difficulties, great guests, plenty of laughs, and a lot of conversations about where FedRAMP, cybersecurity, and compliance are headed next.

In lieu of Caitlin's Favorite non-industry podcast, Armchair Expert, Here's a quick fact check section:

High flyer host count-
Gary: 24
Jason: 19
Chad: 9 
Mike: 9
Felisha: 5 

How long it takes to upload to Youtube:
In realtime, it's at 37% and has said "1 hour and 10 minutes left" for 10 minutes. 

Here’s to year two.


WHAT YOU’LL LEARN:

• How Behind the Shield grew into a cybersecurity and FedRAMP podcast
• How producing the show helped Caitlin Pitkin learn FedRAMP, cloud security, and compliance
• How FedRAMP 20x, vulnerability management, automation, and continuous trust shaped the first year
• How Chad Spears’ ransomware experience influenced his cybersecurity career
• Favorite moments and lessons from Chad Spears, Mike Strohecker, Jason Shropshire, Gary Daemer, Felisha Daemer, and Caitlin Pitkin
• How the podcast has evolved and what’s ahead for year two

Chapters:
 0:00 - Episode kickoff and the show’s first year
 2:20 - Caitlin’s path to InfusionPoints
 5:48 - Stepping in front of the camera
 12:21 - Why the podcast launched
 16:36 - What’s ahead in season two
 24:51 - Chad's path into IT and cybersecurity
 28:03 - The ransomware attack that changed everything
 33:47 - Memorable moments and fun facts
 43:45 - Mike Strohecker interview
 57:35 - Making short-form content for a technical audience
 01:05:09 - Looking back at the first episode
 01:15:20 - Favorite episodes and standout guests
 01:28:18 - The podcast’s impact on customers and the industry
 01:32:13 - Closing thoughts

Links: 
Caitlin Pitkin: https://www.linkedin.com/in/caitlin-pitkin/
Felisha Daemer: https://www.linkedin.com/in/felisha-daemer/
Chad Spears: https://www.linkedin.com/in/chad-spears007/
Mike Strohecker: https://www.linkedin.com/in/michael-strohecker-238326172/
Jason Shropshire: https://www.linkedin.com/in/shrop/
Gary Daemer: https://www.linkedin.com/in/infusionpoints/
InfusionPoints: https://www.linkedin.com/company/infusionpoints/
Continuous Trust Platform: https://infpts.com/platform
https://infusionpoints.com/

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us: InfusionPoints helps organizations Build. Operate. Prove. Defend. secure, mission-ready environments in highly regulated markets. Our Continuous Trust Platform brings cloud, cybersecurity, compliance, and operations together to support FedRAMP, FedRAMP 20x, DoD, and other critical security requirements with greater automation, visibility, and continuous readiness.

FedRAMP CR26 is changing how Cloud Service Providers approach vulnerability management, continuous monitoring, compliance, and the transition to FedRAMP 20x.

In the Season 1 finale of Behind the Shield, Mike Strohecker and Aidan Fratcher break down the Consolidated Rule Set 2026 (CR26), including what CSPs need to prioritize now, how VDR and VER are changing traditional vulnerability management, and how Binding Operational Directive 26-04 is accelerating key vulnerability management requirements and timelines for CSPs.

They also dig into some of the biggest areas of confusion surrounding CR26, including the difference between “must” and “should” requirements, what FedRAMP means by obtain, maintain, and grace period deadlines, and how security, compliance, engineering, and operations teams will need to work together as FedRAMP continues moving toward a more automated, continuous model.

What You’ll Learn

• What CR26 means for Cloud Service Providers
• Why VDR and VER are among the most immediate priorities for CSPs
• How BOD 26-04 impacts VDR and VER implementation timelines
• How vulnerability management is shifting beyond traditional 30/90/180-day remediation timelines
• Why vulnerability scanning failures can become vulnerabilities themselves
• How CSPs can operationalize VDR and VER across CloudOps, SOC, engineering, and compliance teams
• What FedRAMP means by “must” and “should” requirements
• The difference between obtain, maintain, and grace period deadlines
• What upcoming CR26 deadlines mean for existing and new FedRAMP authorizations
• How CR26 supports the broader transition from Rev. 5 to FedRAMP 20x
• Why continuous security evidence and automation are becoming increasingly important to the FedRAMP model

Chapters

0:00 Introduction and Overview of CR 26
0:05 Understanding CR 26 and Its Implications
1:19 Vulnerability Management in CR 26
3:14 Prioritizing Vulnerability Management
4:43 Operationalizing Vulnerability Management
7:26 Continuous Scanning and Security Operations
9:26 Understanding Vulnerability Management in Federal Compliance
14:14 The Importance of Incident Response Plans
19:55 Navigating Must and Should Requirements
24:02 Clarifying Obtain, Maintain, and Grace Periods
29:01 Transitioning to FedRAMP 20X
31:10 Looking Ahead: Expectations for CR 27

Links: 
CR26 Whitepaper: Coming soon
Mike Strohecker: https://www.linkedin.com/in/michael-strohecker-238326172/
Aidan Fratcher: https://www.linkedin.com/in/aidanfratcher/
InfusionPoints: https://www.linkedin.com/company/infusionpoints/
Continuous Trust Platform: https://infpts.com/platform
https://infusionpoints.com/

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

Ten years ago, InfusionPoints was faced with a challenge that went far beyond building another security tool or checking another box on a compliance checklist. While building and securing the Dell Cloud for US government, Dell needed more than an architecture, more than a FedRAMP package, and more than documented security controls. They needed people who could actively watch the environment, manage incidents, support continuous monitoring, and provide the evidence required to operate a federal cloud on US soil with US citizens. The question was simple, but the responsibility was enormous: Who’s watching now? That question became the foundation for what would become VNSOC 360.

What began as a customer requirement grew into a 24/7/365 security operations capability and ultimately became a defining part of Infusion Points. Over the past decade, the SOC has evolved from a room with monitors and dashboards into a disciplined security operation built around people, processes, technology, and continuous improvement. In this special 10 year anniversary episode of Behind the Shield, we go behind the scenes with the people who have been there throughout that journey. From the early days of standing up the SOC and building operating procedures, escalation paths, response playbooks, shift schedules, ticketing, and reporting, to the sophisticated security operations environment of today, this episode is a look at what it really takes to protect customers every hour of every day.

Join Chad Spears, along with Levi Church, Eric Bowles, Alex Earhart, and Jeremy Powers, as they share their experiences from inside the SOC.

Speakers
• Gary Daemer, CEO, InfusionPoints
• Chad Spears, CISO, InfusionPoints
• Levi Church, Information Security Analyst, InfusionPoints
• Eric Boles, SOC Analyst Lead, InfusionPoints
• Alex Earhart, Lead Security Operations Engineer, InfusionPoints
• Jeremy Powers, Senior SIEM Engineer, InfusionPoints


What You’ll Learn:
•  The origin story of VNSOC 360
•  What it takes to operate a SOC 24/7/365
•  The people behind the alerts and incidents
•  Career growth from analyst to leadership and engineering
•  How cloud, automation, and AI have transformed the SOC 
•  Lessons learned from a decade of cybersecurity operations 
•  The CrowdStrike outage and other memorable moments 
•  What the next 10 years could look like for security operations 


Chapters:
00:08 — 10 years of VNSOC 360
03:44 — Chad on the anniversary episode
05:39 — Levi Church’s SOC journey and shift work
18:31 — Eric Boles on leadership, customers, and morale
31:45 — Alex Earhart on engineering, audits, and AI
46:38 — Jeremy Powers on the SOC’s history and growth
01:01:28 — The CrowdStrike event and team response
01:09:31 — 10 years of growth and what’s next


InfusionPoints LinkedIn Links: https://www.linkedin.com/company/infusionpoints/ 

Gary Daemer, CEO, InfusionPoints - https://www.linkedin.com/in/infusionpoints/
Chad Spears, CISO, InfusionPoints - https://www.linkedin.com/in/chad-spears007/
Levi Church, Information Security Analyst, InfusionPoints - https://www.linkedin.com/in/levichurch/
Eric Boles, SOC Analyst Lead, InfusionPoints - https://www.linkedin.com/in/erik-boles-935741221/
Alex Earhart, Lead Security Operations Engineer, InfusionPoints - https://www.linkedin.com/in/charles-e-7a2b8016a/
Jeremy Powers, Senior SIEM Engineer, InfusionPoints - https://www.linkedin.com/in/jeremepowers/


InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

What does it take to build a cybersecurity company for the long haul while keeping pace with an industry that never stops changing?

In this episode of Behind the Shield, we sit down with Michael Peters of Lazarus Alliance to talk about his unconventional path from playing in a rock band to building a career in cybersecurity, the evolution of Lazarus Alliance, and what he has learned from decades of navigating security, compliance, and entrepreneurship.

The conversation dives into the realities of the FedRAMP process, where traditional GRC tools fall short, the growing role of OSCAL, and how AI and automation could reshape compliance engineering. Michael also shares his perspective on building an evergreen company and why sustainable growth can look very different from the traditional venture-backed model.

A quick note before you watch: This episode was recorded in late May 2026, so the FedRAMP landscape has continued to evolve since this conversation, particularly around Rev. 5 and the broader transition toward FedRAMP 20x. Some of the specific timelines, requirements, and processes discussed reflect what was known at the time of recording. You may also notice our previous InfusionPoints branding throughout the episode. We’ve had a bit of a glow-up since then, but the conversation was too good not to share.

What You’ll Learn
-How Michael went from the music world to cybersecurity
-Lessons learned from building and growing Lazarus Alliance
-The challenges organizations face navigating FedRAMP
-Where GRC platforms and OSCAL are headed
-Why compliance engineering needs more automation
-How AI could change the future of GRC
-The advantages of the evergreen company model
-Why cybersecurity and compliance processes need to evolve alongside  -the technology they protect

Chapters
0:00 - Introduction to Cybersecurity and Compliance
3:22 - The Journey of Building a Business
7:16 - From Rock Band to Cybersecurity
11:22 - The Evolution of Lazarus Alliance
16:34 - Navigating the FedRAMP Process
23:42 - The Future of GRC Tools and OSCAL
28:14 - Revamping Processes in Compliance Engineering
31:21 - The Future of GRC: AI and Automation
42:18 - Evergreen Companies: A Sustainable Business Model
45:56 - Navigating Compliance Challenges in the Industry

Guest Links:
Michael Peters- https://www.linkedin.com/in/michaeldpeters
Lazarus Alliance- https://www.linkedin.com/company/lazarus-alliance/
https://lazarusalliance.com/
Continuum- https://continuumgrc.com/

Connect with InfusionPoints: 
Gary Daemer: https://www.linkedin.com/in/infusionpoints/
InfusionPoints: https://www.infusionpoints.com
InfusionPoints LinkedIn: https://www.linkedin.com/company/infusionpoints/

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us:
InfusionPoints helps organizations Build, Operate, Prove, and Defend secure, mission-ready environments in highly regulated markets.

We combine cybersecurity, cloud engineering, compliance, and real-world operations expertise across FedRAMP, FedRAMP 20x, DoD, and enterprise frameworks. Through our Continuous Trust approach, we help customers move faster, maintain compliance, and strengthen security from authorization through ongoing operations.

Zero Trust is everywhere in cybersecurity conversations, but it is not a single product, tool, or technology. It is a fundamentally different way of designing, securing, and operating an entire system.

In this episode of Behind the Shield, Gary Daemer welcomes Michael Schroeder back to the podcast for a practical conversation about what Zero Trust really means, how it evolved from an architectural concept into federal policy, and why implementation requires more than adding MFA or replacing a VPN.

They explore the five pillars of Zero Trust, the maturity models and federal guidance shaping adoption, and the identity, access, architecture, and cultural challenges agencies and cloud service providers must overcome. They also examine one of the biggest remaining questions: How do organizations continuously prove that their Zero Trust architecture is actually working?

The conversation covers assessment and validation, commercial applications, just-in-time access, least privilege, observability, logging, automation, and the technologies that may shape the next phase of Zero Trust adoption.

This episode also marks a new chapter for Behind the Shield as the first release featuring our new branded introduction and refreshed thumbnail.

What You’ll Learn

• Why Zero Trust is an architecture, not a product
• What it means to operate without inherited or implicit trust
• The five pillars of the CISA Zero Trust Maturity Model
• How visibility, automation, and governance support every pillar
• How Zero Trust evolved from industry principles into federal policy
• The roles of NIST, CISA, OMB, NSA, and federal Zero Trust guidance
• Why identity, MFA, least privilege, and time-limited access are foundational
• How human and non-human identities create different security challenges
• Why legacy architecture and standing privileges complicate implementation
• How organizational culture can become a bigger obstacle than technology
• What Zero Trust validation could look like beyond checklists and self-attestation
• Why cost, interoperability, motivation, and assessment remain barriers to adoption
• How Zero Trust principles can reduce risk for commercial organizations
• How automation, logging, observability, and just-in-time access support implementation
• What may come next as federal agencies and technology providers continue to mature

Chapters

0:00 - Zero Trust Foundations
5:38 - Maturity Models and Federal Guidance
11:26 - How Zero Trust Became Federal Policy
15:57 - Identity, MFA, and Access Control
22:59 - Architecture and Cultural Challenges
26:58 - Validating Zero Trust Compliance
31:05 - Barriers to Adoption and Commercial Impact
36:05 - Practical Implementation and Automation
42:35 - What’s Next for Zero Trust

Guest Links:
https://www.linkedin.com/in/mjschroeder1/
https://www.linkedin.com/company/excentium/
https://excentium.com/

Connect with InfusionPoints: 
Gary Daemer: https://www.linkedin.com/in/infusionpoints/
InfusionPoints: https://www.infusionpoints.com
InfusionPoints LinkedIn: https://www.linkedin.com/company/infusionpoints/

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us:
InfusionPoints helps organizations Build, Operate, Prove, and Defend secure, mission-ready environments in highly regulated markets.

We combine cybersecurity, cloud engineering, compliance, and real-world operations expertise across FedRAMP, FedRAMP 20x, DoD, and enterprise frameworks. Through our Continuous Trust approach, we help customers move faster, maintain compliance, and strengthen security from authorization through ongoing operations.