Software Engineering Institute (SEI) Webcast Series

Software management is too frequently ignored or addressed piecemeal in systems. Cyber threat actors take advantage of gaps and errors in their attacks, which they can accomplish throughout the lifecycle. Exploiting these gaps and errors allows them to compromise processes, practices, and procedures that touch a system's design, component development, and supply chain to bypass controls and leverage available vulnerabilities. Key software assurance activities must be embedded within the acquisition lifecycle to effectively combat these threat actors.

What Will Attendees Learn?

• How software assurance can be addressed with limited cost and schedule impact if it is effectively integrated into the acquisition lifecycle
• Which knowledge and resources are critical to software assurance and the risks that can be missed if they are underrepresented
• Key aspects of managing acquisition and development that are critical to software assurance and why they are important

AI is transforming both the threat landscape and our defensive capabilities. What does cyber mission readiness mean in this new environment? A researcher from the CERT Division of Carnegie Mellon University's (CMU's) Software Engineering Institute (SEI) describes the current challenges and emerging solutions that individuals and teams can use to build and sustain their cyber and AI-readiness. The webcast showcases Crucible, an open source framework that integrates learning management, hands-on labs, team exercises, competitions, threat sharing, and AI models into a unified cyber readiness platform.

What Will Attendees Learn?

• How to leverage AI to build cyber capacity and effectively share threat information across organizations
• Techniques for motivating performance through cyber challenge competitions
• Methods for using AI to assist in developing cyber-skills mastery via guided self-assessment
• AI-driven strategies for forging elite teams that are prepared for cyber and cognitive operations amid nation-state competitions

Is your program really ready to adopt the SWP? Next in the Software Acquisition Go Bag series, we'll walk you through our new Tactical Guide called SWP: Ready, Set, Go! This guide provides proven techniques to assess the project's readiness to adopt the SWP; identify any shortfalls; and obtain the resources, information, and support needed for success.

What Will Attendees Learn?

• How to know if your acquisition program is really ready to adopt the SWP

• What "Instill an Agile Culture" actually means for your program

• How programs enter or transition to the SWP

• A dispelled myth about adopting SWP

Many organizations practicing DevSecOps have collapsed under the weight of their own tooling. These organizations tried to solve delivery problems by stacking Kubernetes, Helm, GitOps controllers, scanners, and templating systems until no one can explain their own deployment path. This webcast cuts through that complexity and shows how right-sizing DevSecOps—reproducible environments, deterministic builds, type-safe configuration, and small iterative releases—restores velocity and reliability. We focus on what high-stakes teams actually need, not what vendors or compliance frameworks prescribe.

What Will Attendees Learn?

• Why complexity, not capability, is the primary barrier to fast, secure delivery

• How reproducibility, pre-rendering, and type-safe configuration eliminate entire categories of deployment failure

• How to design a "paved road" that scales across teams without drowning them in tooling

• How to move from episodic, end-state-driven integration to continuous, incremental delivery

This webcast offers a solution to the problem of poorly defined requirements in system design that can lead to software flaws, cost and time overruns, and stakeholder dissatisfaction. We will tell you how to use a structured process called the ATAM (architectural tradeoffs analysis method) to develop a system design by eliciting requirements, scenarios, and priorities from stakeholders. Then, we will explain how to measure compliance with those requirements during testing using DevSecOps principles and tools, such as the SEI's Silent Sentinel.

What Will Attendees Learn?

• What software quality attributes are and why they are important
• How to prioritize competing requirements
• How to ensure architectural requirements are satisfied during development in a DevSecOps toolchain

The SEI contributed its expertise to the development of the Software Acquisition Pathway (SWP), which the Department of Defense (DoD) issued in 2020 as DoD Instruction 5000.87. Since the SWP's issuance, SEI researchers have collaborated with DoD program teams and policy owners to effectively implement the pathway in different program contexts, identify barriers and challenges, and monitor outcomes. Throughout that work, we've identified common questions and stumbling blocks that programs encounter as they adopt the SWP. Answering these questions often warrants additional tools and resources that enable programs to position their SWP programs for success. With that in mind, the SEI announces the launch of the Software Acquisition Go Bag. Our SEI team has helped hundreds of DoD programs deliver software-enabled capability through our unique integration of data-driven insights, software engineering research, and acquisition science. We're "packing" that experience into Go Bag kits so program teams can implement proven practices.

Experts agree that quantum computing will likely become powerful enough to break modern-day encryption within the next 10–15 years on "Q Day." Once encryption is defeated, the computing world will never be the same. Organizations need to identify the correct courses of action to take today so that the sudden onset of quantum computing does not threaten their critical assets. In this webcast, Brett Tucker, Dan Justice, and Matthew Butkovic discuss the challenges expected with the realization of quantum computing capabilities. Furthermore, the group will provide possible responses to mitigate future impacts from the onset of quantum computing.

What Will Attendees Learn?

• what Q Day is
• events that may occur leading up to the actual day itself
• challenges that must be overcome in quantum computing (attendees need to learn and appreciate the factors that may influence the successful emergence of quantum computing)
• actions that can be taken today to build resilience from this technological disruption

Finding and fixing weaknesses and vulnerabilities in source code has been an ongoing challenge. There is a lot of excitement about the ability of large language models (LLMs, e.g., GenAI) to produce and evaluate programs. One question related to this ability is: Do these systems help in practice? We ran experiments with various LLMs to see if they could correctly identify problems with source code or determine that there were no problems. This webcast will provide background on our methods and a summary of our results.

What Will Attendees Learn?

• how well LLMs can evaluate source code

• evolution of capability as new LLMs are released

• how to address potential gaps in capability

Often, agile implementations are a struggle. Dedicated agile teams focus hard and deliver value on a regular cadence. But when results are tallied, the value teams produce may not fit neatly into the expectations of senior stakeholders. Why? In this webcast, Peter Capell addresses the importance of a practical vision to express outcomes, so that the program's "target picture" is clear to all parties involved. Peter highlights the value of tools such as Model-Based Systems Engineering (MBSE) in engineering processes, and how the combination of architecture and MBSE can anchor the implementation within those expectations.

What Attendees Will Learn:

• The concept of "just enough"

• How speed of delivery is only relevant when delivery is on target

• How the "targets" for team success begin with the program vision

• How modeling and architecture can serve as valuable tools to accomplish a practical vision

Finding and growing AI and Data talent is essential for mission success, but many skilled workers remain unseen because they lack traditional credentials. This session introduces practical strategies and prototype tools that help individuals demonstrate what they know while helping managers identify and evaluate emerging talent in these fields. Attendees will explore micro-assessments reflecting real data science and AI workflows, see how skills can be measured meaningfully at scale, and gain insights on fostering AI and Data readiness across the federal workforce. Whether you're building your career or building your team, come learn how to connect talent with opportunity in the evolving AI landscape.

What Attendees Will Learn:

• Common barriers to finding and recognizing hidden AI and Data talent.

• The role of a practical work role rubric in aligning skills with mission needs.

• How prototype assessments and discovery tools can help surface and showcase talent.