Army Principal Cyber Advisor Brandon Pugh joins Frank Cilluffo to address a stark reality: if critical infrastructure fails, the Army cannot mobilize. To meet this "no fail" mission, Pugh explains how the service is aggressively merging cyber with electronic warfare and cutting red tape to field new technology in days rather than years. They also discuss the Army's unique edge in this digital fight—Reservists who bring high-level private sector expertise directly to the battlefield. The conversation also explores how AI and operational technology are reshaping the Army's cyber battlefield and threat landscape.

Main Topics Covered • How Congress created the principal cyber advisor role and defined its authorities. • Army cyber's four focus areas: AI, defense critical infrastructure, acquisition, and workforce. • Integrating cyber, electronic warfare, RF, and information operations into Army warfighting doctrine. • Defending defense critical infrastructure and preparing for Volt Typhoon-style cyber disruptions. • Leveraging AI for continuous monitoring, faster detection, and protection of sensitive Army data. • Reforming cyber acquisition through FUZE prototypes, VC-style partnerships, and Guard and Reserve expertise.

Key Quotes "Cyber is not an isolated capability. It's not something that just rests at Fort Gordon or Fort Meade." – Brandon Pugh

"If an adversary goes after one of our military bases and we can't mobilize people, tanks, equipment in a time of conflict, that is a major concern… we can't accept the fact that cyber could be the barrier to our ability to do other military tasks." – Brandon Pugh

"It's a national security imperative to leverage AI. We know adversaries are going to leverage AI or exploit our AI regardless of what we do here. We could put barriers in terms of aggressive regulation which some have proposed in the past or seek to slow it down. All that's going to do is help our adversaries." – Brandon Pugh

"We have some individuals that show up their reserve weekend in $300,000-$400,000 vehicles because they are the experts in what they do as civilians. They have signed up and taken the oath because they want to serve this country. That is the talent we have in the Reserve and Guard that we need to continue to expand." – Brandon Pugh

"We don't have to go through a multi-year acquisition cycle, spend millions of dollars where we've seen 3D printed drones for mere dollars in some cases being leveraged [in Ukraine]… We need some of these capabilities in a matter of days or weeks, not years." – Brandon Pugh

Relevant Links and Resources • Jack Voltaic: Critical infrastructure resiliency • Army's FUZE Initiative

Guest Bio Brandon Pugh is the Principal Cyber Advisor to the Secretary of the Army, advising the Secretary and Army Chief of Staff on cyber readiness, budget, capabilities, and strategy. He previously served as a director at the R Street Institute and continues to serve in the U.S. Army Reserve as a national security law professor, having earlier been a paratrooper and international law officer.

State and local governments are stepping up to defend critical services against fast-evolving cyber threats. In this episode of Cyber Focus, Alabama's top IT leaders show how they're staying ahead of the curve. They explain how a hybrid, highly decentralized environment forces them to lean on shared standards, SLCGP funding, and whole-of-state partnerships. Along the way, they unpack a recent incident that came dangerously close to crisis and what it revealed about tools, visibility, and trust. They also look ahead to AI-enabled attacks, deepfakes, and "distortion," and why automation and better intel will shape Alabama's next moves. Watch to see what other states, utilities, and local leaders can learn from Alabama's playbook.

Main Topics:

• How Alabama OIT governs technology across roughly 140 executive agencies in a mostly decentralized environment.
• Using SLCGP funds, shared contracts, and enterprise tools to lift up smaller municipalities that lack resources.
• Rethinking threat intelligence by pairing MS-ISAC and CISA feeds with deep knowledge of state business processes.
• Lessons from a major cyber incident, including incident-response retainers, tooling gaps, and the value of open communication.
• Building whole-of-state partnerships with CISA, FBI, utilities, National Guard, and the McCrary Institute through exercises and real incidents.
• Preparing for AI-enabled cyberattacks through automation, platform integration, and continuous upskilling for Alabama's cyber workforce.

Key Quotes:

"Cybersecurity is a team sport. It's not just one person. We're trying to build the community." — Daniel Urquhart

"There's a huge concern that I have as we think about the amount of threats that are going to come at us from an AI enabled cyber attack. It is going to be so broad and so unlike anything that we've seen today." — Chad Smith

"I think we have to be willing to talk about [a recent cyber incident] so that people can learn from it, but also so that people know, hey, they're actually doing something and things are happening in a way that we can respect."— Chad Smith

"We try to do a lot of education and team building and building that cohesive whole estate approach by setting up technology demos and articulating the why." — Daniel Urquhart

"We've done a really good job the last couple of years working with the FBI, Secret Service, National Guard. Those types of partnerships can make us stronger as a state." — Daniel Urquhart

Relevant Links and Resources

· Alabama Office of Information Technology

· Multi-State Information Sharing and Analysis Center

Guest Bios:

Daniel Urquhart is the Secretary of the Alabama Office of Information Technology. OIT is responsible for the strategic planning, governance, and resource utilization of all IT for the State of Alabama. Before joining OIT, he served as CIO for the Alabama Law Enforcement Agency, where he worked with industry partners to build a state-of-the-art criminal justice network.

Chadwick Smith serves as the Chief Information Security Officer for Alabama's Office of Information Technology (OIT). Mr. Smith has worked in the technology industry for over twenty-five years. Prior to joining OIT, Chad worked in the insurance, banking, and data communications industries.

SecurityScorecard CEO Aleksandr Yampolskiy joins Cyber Focus to warn that third-party risk is now the dominant cybersecurity epidemic. With just 150 companies responsible for 90% of the global attack surface, a single compromise can ripple across sectors and continents. He and host Frank Cilluffo explore the cascading risks of software dependencies, fourth- and fifth-party exposure, and the challenges of shadow IT and shadow AI. Yampolskiy outlines where companies fall short on governance and calls for outcome-driven oversight, not just busywork. They also discuss how AI can be both a vulnerability vector and a force multiplier for defense.

Main Topics Covered • Third-party breaches now account for 65% of cyber incidents globally • Only 150 companies comprise 90% of the global attack surface • The risks of shadow IT and "shadow AI" leaking sensitive data • Systemic vulnerabilities in critical infrastructure like U.S. ports and healthcare • Limitations of compliance-driven approaches without continuous risk measurement • The need for clear governance, outcome-oriented metrics, and board-level engagement

Key Quotes "65% of data breaches today happen through use of a third party. Hackers go after one weak link." — Aleksandr Yampolskiy

"150 companies' products comprise 90% of a global attack surface. So if one of those companies gets compromised, all of a sudden, you can compromise almost everybody." — Aleksandr Yampolskiy

"You can be fully compliant with all the regulations, but not secure. Or you could be really secure but not compliant." — Aleksandr Yampolskiy

"An employee takes [the] general ledger or... some sensitive corporate information, uploads it to ChatGPT—or worse, to [a model] in China—gets a beautiful response, looks like a champion... but then you just leaked sensitive information from a company and nobody knows about it." — Aleksandr Yampolskiy

"Our ability to network has far outpaced our ability to protect networks." — Frank Cilluffo

Relevant Links and Resources • SecurityScorecard Research

Guest Bio Aleksandr Yampolskiy is the Co-Founder and CEO of SecurityScorecard, a global leader in cybersecurity ratings and risk management. A former CISO and CTO, he has led the company since 2014 in helping tens of thousands of organizations—including half of the Fortune 100—measure and strengthen their cyber resilience.

Cybersecurity veteran Nick Leiserson joins Cyber Focus this week to break down critical governance gaps in the Common Vulnerabilities and Exposures (CVE) system and what's at stake if they're not fixed. He and host Frank Cilluffo explore the risks of global fragmentation, the lingering fallout from the F5 breach, and why policy tools like Executive Order 14028 remain stalled. Leiserson warns that the U.S. court system faces an under-the-radar cyber crisis, and shares specific, actionable funding priorities Congress should tackle now. From software supply chain failures to operational coordination gaps, the episode provides a sharp look at what's missing in the federal cybersecurity response—and what can still be done to fix it.

Main Topics Covered

· Why CVE is the global "lingua franca" for vulnerabilities—and what happens if it fails

· How a near-shutdown exposed CVE's fragile funding and governance model

· The F5 breach and what it reveals about persistent risks in the software supply chain

· Missed opportunities in EO 14028 and regulatory inertia in implementation

· Why the U.S. court system breach is a cybersecurity crisis hiding in plain sight

· Urgent spending needs: water system grants, K-12 cybersecurity, and court system defense

Key Quotes

"CVE... It's the universal language that we can all look at and understand what we're talking about. And today in 2025, we totally take that for granted."

"The worst case is fragmentation. The second worst is [when] government comes in and says, we're going to supplant the expertise that's been built up over 25 years" —Nick Leiserson

"[Some ask] 'Didn't we put a bunch of policy in place to stop SolarWinds?' The answer is we did. If you look at Executive Order 14028… it came out in the immediate aftermath of SolarWinds, and it has not been implemented." —Nick Leiserson

"This is just one of those things that's vaguely terrifying, and it takes a lot to terrify me after 15 years in this space. But as best we can tell from public reporting, either there's been one continuous breach since 2020, or at least similar types of actors are continually being able to get into the federal court system." —Nick Leiserson

"[F5 is] one of these bits of technologies that most people would not immediately wake up and say that's essential to our economy, our national security, our public safety. But it is." —Frank Cilluffo

Relevant Links and Resources

Institute for Security + Technology report on CVE reform

Executive Order 14028 – Improving the Nation's Cybersecurity

CISA's Known Exploited Vulnerabilities (KEV) Catalog

FCC K–12 Cybersecurity Pilot Program

Guest Bio Nick Leiserson is Senior Vice President for Policy at the Institute for Security and Technology. He was a founding member of the Office of the National Cyber Director, where he led national cyber policy development and helped launch the National Cybersecurity Strategy Implementation Plan. Previously, he served as Chief of Staff to Rep. Jim Langevin and helped enact dozens of recommendations from the Cyberspace Solarium Commission. A longtime strategist on Capitol Hill and in the White House, Leiserson is known for translating complex tech policy into action on issues ranging from regulatory harmonization to software liability.

What do Volt Typhoon, Salt Typhoon, and Flax Typhoon reveal about China's cyber playbook? This episode of Cyber Focus breaks down a new McCrary Institute report on China's advanced persistent threat campaigns—and what they mean for U.S. national security. Frank Cilluffo sits down with Mark Montgomery, Brad Medairy, and Bill Evanina to explain how China is embedding itself in American infrastructure, telecom, and data systems. They warn that Beijing is laying the groundwork for future conflict and that the U.S. response has been dangerously slow. The guests call for stronger deterrence, better public awareness, and a renewed focus on the economic toll of cyber theft.

Main Topics Covered

• China's long-term cyber threat strategy
• Volt Typhoon and infrastructure targeting
• Salt Typhoon and telecom espionage
• Flax Typhoon and persistent access
• Gaps in U.S. cyber deterrence
• Economic costs of IP theft

Relevant Links and Resources

McCrary Institute Typhoon Report

Booz Allen October 2025 China report

Key Quotes:

"Each year we can say the threat has grown. And I would say the leading driver of that growth in the cyber threat environment in the United States is China." — Mark Montgomery

"China is using cyberspace to project power. And as a nation, I think that we need to recognize this threat." — Brad Medairy (~05:50)

"Until people believe that [China's cyber actions] matters to them, we're not going to get the kind of actions we need." — Mark Montgomery

"China['s] … offensive cyber tradecraft is going to be AI enabled. They're going to be able to deliver effects and capabilities at pace that we never imagined. — Brad Medairy

"I think the Chinese want not only us, but they want the world to know that they're inside… Xi wants… the world to know that he can do this." — Bill Evanina

"We have to expeditiously get into place where we could harden ourselves so the railroad could work, the ports work, the electricity grids work. We're not ready. We're nowhere near ready." — Bill Evanina

Guest Bios:

RADM Mark Montgomery (Ret.) is Senior Director of the Center on Cyber and Technology Innovation and a Senior Fellow at the Foundation for Defense of Democracies. He also serves as Executive Director of Cybersolarium.org, a nonprofit advancing the recommendations of the Cyberspace Solarium Commission, which he led from 2019 to 2021. Previously, he was Policy Director for the Senate Armed Services Committee under Senator John McCain, following a 32-year career as a nuclear-trained surface warfare officer in the U.S. Navy, retiring as a Rear Admiral in 2017.

Bill Evanina is the Founder and CEO of the Evanina Group, where he advises corporate boards and CEOs on strategic risk, counterintelligence, and national security threats. He served as the first Senate-confirmed Director of the National Counterintelligence and Security Center (NCSC), leading U.S. government efforts to defend against espionage and foreign influence. A 24-year FBI veteran, Evanina held senior roles in both counterintelligence and counterterrorism and previously led the CIA's Counterespionage Group. He also chairs national and international security boards and is an instructor at the University of Chicago.

Brad Medairy is an Executive Vice President at Booz Allen Hamilton, where he leads the firm's cybersecurity business and supports national-level clients including the FBI, DHS, DOD, U.S. Cyber Command, and the Intelligence Community. He focuses on protecting critical infrastructure, securing emerging technologies, and defending against advanced cyber threats. Medairy leads multidisciplinary teams that integrate AI, cloud, and cyber operations to deliver full-spectrum solutions. He has been recognized as a Top 50 Cybersecurity Leader and Cyber Executive of the Year, and holds degrees from UMBC and Johns Hopkins University.

What if the easiest way to disrupt U.S. military operations isn't with missiles—but by targeting fuel logistics? In this episode, Chris Cleary explains how civilian infrastructure has become a frontline in national defense. He and Frank Cilluffo discuss how adversaries exploit cyber vulnerabilities to slow military response, and why deterrence requires more than just rhetoric. They unpack the case for a dedicated Cyber Force, the suprising way Chris thinks it should be structured, and the challenges of coordinating across government and industry. With prepositioned threats like Volt Typhoon in the headlines, the stakes are higher than ever.

Main Topics Covered

• How fuel logistics shape U.S. military readiness in the Pacific
• Why adversaries target civilian infrastructure like water and power systems
• What defines a "cyber attack" under rules of engagement
• Gaps in deterrence, response, and public signaling
• The case for a U.S. Cyber Force modeled after the Coast Guard
• Challenges of coordination across agencies and private sector providers

Key Quotes

"I could degrade the Navy's ability to run around in the Pacific by just limiting the ability to move fuel on the west coast of the United States." — Chris Cleary

"If [China's cyber forces] are in Littleton, Massachusetts, they're everywhere." — Chris Cleary

"I would argue a cyber force of the future looks more like a Coast Guard than a Navy."— Chris Cleary

"I am a true believer that cyber is a legitimate means and methods of warfare. And we are going to have to professionalize in it." — Chris Cleary

"All the zero trust in the world is not going to stop—a China, a Russia, a sophisticated organization—from targeting you." — Chris Cleary

Relevant Links and Resources

60 Minutes on China's Cyber Infiltation: https://www.cbsnews.com/news/china-hacking-us-critical-infrastructure-retired-general-tim-haugh-warns-60-minutes-transcript/

Guest Bio

Christopher Cleary is Vice President of Global Cyber Practice at ManTech. He previously served as the Department of the Navy's Principal Cyber Advisor, where he led the implementation of the DoD Cyber Strategy across the Navy and Marine Corps. Prior to that, he was the Navy's Chief Information Security Officer and Director of Cybersecurity within the Department of the Navy CIO's office.

Should the U.S. have a dedicated Cyber Force? In this episode, General Ed Cardon and Josh Stiefel examine persistent gaps in the nation's cyber posture, from undefined mission boundaries to unclear return on billions in cyber spending. They explore the organizational tradeoffs, workforce realities, and coordination challenges that have stalled progress, despite years of warnings. With host Frank Cilluffo, they unpack what it would take to move beyond patchwork solutions.

Main Topics Covered

• The failure of past "wake-up calls" to drive meaningful cyber reform
• Gaps in command, control, and mission clarity across defensive cyber operations
• The case for a dedicated Cyber Force and what it would need to solve on day one
• Why workforce development—not just recruitment—is central to cyber readiness
• The role of metrics and return-on-investment in cyber spending
• The importance of establishing clear operational roles between NSA, CNMF, DC3, DCDC

Key Quotes:

"How many of these have we been through, these quote, unquote, watershed moments that were going to change everything? … How cataclysmic does an incident have to be to get us to actually move one way or the other? - Josh Stiefel

"From 2020 to 2025, if you take all the budgets together, we've spent $29.9 billion on cyber operations. That's as much as two Ford-class aircraft carriers. Do we have the equivalent combat capability in cyberspace as two Ford-class carriers? I'd argue no." - Josh Stiefel

"[Cyber Com] just is not where it needs to be. It's doing great work, but not at the scale and breadth that we know we're going to need. – Ed Cardon

"In my experience, we tend to study [decisions like standing up a Cyber Force] for a couple of years before we implement it. We don't have that kind of time." – Ed Cardon

"Each one [of the typhoons] is a really bad day. Collectively, it's the perfect storm. And the fact that we at least publicly haven't made it a much bigger set of issues is going to send a signal to all of our adversaries that this is okay." – Frank Cilluffo

Relevant Links and Resources

CSIS Cyber Force Commission: https://www.csis.org/programs/strategic-technologies-program/projects/commission-us-cyber-force-generation

Guest Bios:

Joshua Stiefel is the former Professional Staff Member on the House Armed Services Committee, where he oversaw cyber and IT policy, operations, and procurement. He previously served as Senior Cyber Policy Advisor at the Department of the Treasury, leading sector-wide cybersecurity initiatives and authoring its first vulnerabilities study. A former DoD intelligence officer who deployed with Special Operations Forces in Iraq, he now serves in the U.S. Navy Reserve. He is a Term Member of the Council on Foreign Relations and holds degrees from Harvard and Lehigh.

Lt. Gen. Edward Cardon (Ret.) served 36 years in the U.S. Army, including as Commanding General of Army Cyber Command, where he built it into a world-class force with 41 cyber mission teams. He later directed the Army Office of Business Transformation, helping establish Army Futures Command. His career also included leading the 2nd Infantry Division in South Korea and multiple combat deployments. Today, he is a Senior Counselor at The Cohen Group and advises defense and technology organizations.

Katie Gray, a senior partner at In-Q-Tel, joins host Frank Cilluffo to pull back the curtain on the venture firm's role in advancing U.S. national security through tech innovation. As head of In-Q-Tel's cyber investment practice, Gray offers rare insight into the organization's dual-use investment model, its evolving priorities, and the technologies it believes will define the next 25 years. They discuss how In-Q-Tel identifies emerging threats, evaluates startups, and bridges the gap between cutting-edge technology and urgent government needs. Topics include AI, quantum, cyber-physical security, and the vulnerabilities shaping today's threat landscape. The conversation also highlights In-Q-Tel's unique role as both strategic investor and national security partner.

Main Topics Covered

• In-Q-Tel's origin, mission, and evolution beyond the intelligence community
• How In-Q-Tel identifies promising startups and matches them with agency needs
• The shifting threat landscape in cyber, including Volt Typhoon and AI-driven attacks
• Investment priorities in space, supply chain security, and operational technology
• The dual-use tech model and building resilience at machine speed
• A case study: VulnCheck and its impact across multiple government agencies

Key Quotes

"We are dramatically under invested as a nation in our cyber defenses… as we look to the future conflict, we're so vulnerable from a cybersecurity standpoint. " – Katie Gray

"[For] every dollar that In-Q-Tel invests in a company, there's $40 that are invested from the private sector." – Katie Gray

"One of the things we do look for is to try and fund dual-use technology that has strong commercial [and] government market." – Katie Gray

"We're going to be in a world where 80-90% of the code that is being written is being written by AI systems. – Katie Gray

"We can't be responding to [AI-driven cyber attacks] at human speed. We have to be responding to that at machine speed." – Katie Gray

Relevant Links and Resources

• https://www.iqt.org/mission
• https://mccraryinstitute.com/time-to-designate-space-systems-as-critical-infrastructure/

Guest Bio Katie Gray is a senior partner at In-Q-Tel, where she leads the organization's cyber investment practice and supports mission-driven innovation across the U.S. national security landscape. She previously spent more than a decade in software product management, leading development for mobile devices at Palm, HP, and Plastic Logic.

Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance, joins host Frank Cilluffo to discuss how public education can combat online scams, fraud, and cyber threats. With billions of campaign impressions and only a nine-person team, the Alliance focuses on motivating behavior change through creative, jargon-free outreach. Plaggemier explains how scams like pig butchering are orchestrated by organized crime and even nation-state actors—and why the U.S. needs a coordinated national response. The episode highlights the growing need for cross-sector data sharing, targeted messaging for seniors, and a "scam czar" to unite fragmented efforts. As Cybersecurity Awareness Month kicks off, the conversation underscores how individual actions and shared responsibility can help close critical gaps in digital safety.

Main Topics Covered • The mission of the National Cybersecurity Alliance and its consumer-focused campaigns • Core Cybersecurity Awareness Month themes: MFA, passwords, updates, and scams • Reaching overlooked populations through creative outreach like Kubikle and safe-word campaigns • The scale and structure of online scams like pig butchering and their ties to nation-state actors • The call for a national "scam czar" to coordinate public-private response • Challenges in cross-sector data sharing and the limits of current fraud response models • Upcoming efforts to reach K-12 audiences and improve campaign impact across age groups

Key Quotes "We are a tiny nonprofit of nine people and we reach billions of people every October." — Lisa Plaggemier "I can hack away at our banks and probably not come away with any cash. [But] I can hack away at individual customers of the bank and come away with millions of dollars, and there's no ISAC for my mom." — Lisa Plaggemier "I do not think it would be a bad idea if we had a scam czar at this point because the adversary is so well organized." — Lisa Plaggemier "Older folks are targeted less often, but when they fall victim, the dollar amounts are very high. They have their whole life savings at stake." — Lisa Plaggemier "We've got in a lot of organizations, fraud teams that don't talk to security teams that don't talk to trust and safety teams. And so if you're still siloed in your organization, I think the call to action here is that that all needs to be seen as one." — Lisa Plaggemier

Relevant Links and Resources

• National Cybersecurity Awareness – staysafeonline.org

• Then & Now: Helping Older Adults Stay Secure

• Kubikle Series

Guest Bio Lisa Plaggemier is Executive Director of the National Cybersecurity Alliance, where she leads efforts to make cybersecurity practical and accessible. She describes herself as "on a crusade to eliminate stock photos of hackers in hoodies," underscoring her focus on real-world education over clichés. A former Ford Motor Company marketing executive, she now serves on the U.S. Secret Service Cyber Investigations Advisory Board and is based in Austin, Texas.

In this episode of Cyber Focus: To the Point, Frank Cilluffo sits down with Matt Hayden, former DHS official and current GDIT executive, to unpack the looming expiration of the Preventing Emerging Threats Act. Together, they explore the growing dangers posed by drones—from hobbyist disruptions to nation-state threats—and what's at stake if Congress fails to reauthorize key counter-UAS authorities by October 1. Hayden explains why current authorities are essential for protecting the homeland and how they fall short when it comes to local law enforcement, airports, and evolving drone technology.

Op-Ed: Flying under the radar: Congress is poised to let key counter-drone authorities lapse