Behind the Shield

Behind the Shield- Episode 4:
FedRAMP 20x, KSIs, and the End of Screenshots (with Fortreum’s Ethan Troy & InfusionPoints’ Tanner Bailey)

In this episode we explore how FedRAMP 20x is changing audits. Instead of relying on screenshots, auditors now focus on scripts, APIs, and code logic. Host Gary Daemer sits down with InfusionPoints’ Tanner Bailey and Fortreum’s Ethan Troy to talk about KSIs, Trust Centers, and the skills auditors need for the future.

What you’ll learn:

Why screenshots are being replaced with automated, repeatable checks

How KSIs and themes make audits clearer and faster

Trust Centers built on JSON and Markdown instead of PDFs

Why auditors must understand Python, Linux, networking, and infrastructure as code

How InfusionPoints is building AuditShield and Command Center to support FedRAMP 20x

Host: 
Gary Daemer – CEO and Founder of InfusionPoints
Guests:
Ethan Troy – Assessor at Fortreum, focused on technical audits and code review
Tanner Bailey – Advisory team lead at InfusionPoints and coordinator for the 20x project

Subscribe for more conversations on FedRAMP, audit automation, and the future of cloud security.

#FedRAMP #FedRAMP20x #AuditAutomation #CloudSecurity #InfusionPoints #Fortreum

 Behind the Shield - Episode 3: 
Meet one of our hosts, Chad Spears (Director of Security Operations at InfusionPoints), as he sits down with Gary Daemer to talk about the journey from hands-on IT to leading a modern SOC, the power of automation, and how FedRAMP 20x is reshaping audits, evidence, and continuous monitoring.

What you’ll learn

How a major ransomware event shaped Chad’s approach to defense and incident response

Why we split Security Operations and Security Engineering to scale outcomes

The origin of AuditShield and what “automated evidence collection” looks like in practice

The core goals of FedRAMP 20x: automation, inheritance, continuous monitoring, trust, and faster innovation

Phase 1 lessons and our path into Phase 2 (Moderate), including KSI validation, self-healing remediations, and significant change notifications

How Command Center, Trust Center, and VDR (“Vader”) tie into faster ATOs and better agency confidence

Subscribe for more conversations on FedRAMP, automation, and security engineering.
Watch, comment, and tell us what you want covered next.

Behind the Shield – Episode 2: 
In our first episode featuring a guest, hosts Jason Shropshire and Jason Redding sit down with a public-sector security leader, Said Syed, CISO Snyk for Government, to unpack the real story behind FedRAMP—from the messy early days and the shared-responsibility model, to today’s accelerated authorizations and the 20x roadmap. We cover hard-won lessons, how process (not just tech) slows teams down, what RC-12 means for vulnerability reality checks, and where AI, KSIs, and agency expectations are heading next.

What you’ll learn:

How early cloud providers navigated FedRAMP before inheritable controls were common

Why the process—and acceptance criteria—trips up most teams more than technology

The shift from Rev4 → Rev5 and how to plan upgrades without derailing product roadmaps

20x Phase 1 outcomes, the move to Moderate (Phase 2), and what faster ATOs mean for SaaS

RC-12, “reachable ≠ accessible,” and pushing back on non-applicable vulns with evidence

Practical ways to use opinionated architectures, automation, and live evidence collection

Sensible guardrails for AI features in regulated environments

Mentioned:

Snyk Government: security in modern DevSecOps pipelines

InfusionPoints XBU40 + Command Center + AuditShield: “audit-ready, always-on” compliance

FedRAMP Day at GSA and growing marketplace velocity


Subscribe for new episodes on FedRAMP 20x, ATO strategy, and real-world build/manage/defend tactics coming out every Tuesday.

Have a FedRAMP question? Drop it in the comments or reach out to InfusionPoints. 

#fedramp #fedramp20x #govcloud #ATO #GRC #cybersecurity #devsecops #snyk #infusionpoints

Links:
• Learn more about InfusionPoints: https://infusionpoints.com/
• Learn more about Snyk: https://snyk.io/
• Connect with us on LinkedIn: https://www.linkedin.com/company/infusionpoints

Behind the Shield- Episode 1: 
In the premiere episode of Behind the Shield, hosts Gary Daemer (CEO of InfusionPoints) and Jason Shropshire (COO) share the story of InfusionPoints’ journey from its early federal and commercial projects to becoming a leader in cloud compliance and security engineering. They discuss how the rise of FedRAMP in 2012 pushed the team to pioneer automation, compliance-as-code, and platform engineering long before it became industry standard.
Listeners will hear candid stories about the “hardware days” of building compliant systems, the painful lessons learned from InfusionPoints’ first customers, and how those experiences fueled the creation of the XccelerATOr platform—a solution that helps SaaS providers accelerate their ATO journey. The conversation also dives into the evolution of platform engineering, opinionated architectures, and the Command Center, InfusionPoints’ “crown jewel” for managing compliance, risk, vulnerabilities, and evidence in a single pane of glass.
This episode sets the stage for the Behind the Shield series: authentic conversations about the challenges, innovations, and future of federal cloud security and compliance—with insights drawn from real-world engineering, not just theory.