The BLUF Podcast

This episode of The Bottom Line Up Front focuses on post-quantum cryptography readiness by first achieving comprehensive visibility into existing cryptography. Drawing from a technical session with TYCHON, explaining how NSM-10 and OMB M-23-02 emphasize a sequence of discovery, inventory, and roadmap, with DoD prioritizing planning over immediate remediation. Tychon is presented as an agentless, endpoint-level cryptographic discovery and inventory platform that collects data on protocols, algorithms, certificates, and more, scores risk against NIST standards, integrates with tools like Splunk/Elastic and eMASS, and outputs recommendations such as TLS upgrades, weak cipher identification, PQC readiness, and cost estimates. We notes gaps including limited asset context without CMDB/tagging, lack of code-level analysis, and challenges with ephemeral containerized infrastructure, and concludes that agencies need integrators like ATPGov to turn discovery into phased modernization roadmaps.

00:00 Why Crypto Visibility?

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

On this episode we breakdown a webinar with OKTA focused on securing AI agents. It explains that AI agents bring non-deterministic behavior, machine-speed execution, and autonomous decision-making that break legacy security assumptions built for human users, expanding attack surface and complicating accountability. The core issue is identity and control: managing non-human identities and answering where agents are, what they can access, and what they’re allowed to do across cloud, hybrid, and classified environments. It emphasizes chain-of-custody tracing from user to agent to sub-agent, especially for ephemeral agents, and argues authorization is now the key zero-trust battleground amid rising AI-driven threats like prompt injection and phishing, highlighting identity-silo reduction and real-time authorization.

00:00 How AI Agents Change Security

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This week's episode explains why traditional workstation-centric KVM architectures are becoming obsolete for command centers and cyber operations as missions become distributed, virtualized, and collaboration-driven. It highlights Black Box’s Emerald modern KVM over IP approach, where devices act as native IP endpoints integrated into enterprise layer-three networks, enabling multi-site and remote operations. Emerald supports unified access to physical systems, virtual machines, web apps, and IP video feeds, and offers multi-view interaction with up to 16 sources to improve situational awareness and reduce cognitive load. We emphasize resilience through redundancy and endpoint independence, scalability over LAN/WAN/VPN with compression tuning, and note KVM over IP augments—rather than replaces—air-gapped and NIAP-certified secure KVM requirements. 

00:00 Why Workstations Fail

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This week we're focused on the operational reality of AI: rising costs, control, governance, and mission impact. It argues AI has moved beyond experimentation into budgets and oversight, with recent billing changes (e.g., Anthropic) highlighting unpredictable token-based consumption and pricing volatility. Examples from an Apptio session show enterprises exhausting annual token budgets early, framing this as a visibility, control, and governance failure, and introducing “token economics” as a new FinOps challenge tied to PPBE and cloud vs on-prem/sovereign decisions. It warns governance is the biggest risk, citing an AI agent deleting production systems, and emphasizes defining value and success metrics before scaling. It outlines three progress areas—strategic planning, infrastructure strategy, and governance—and positions Apptio and ATPGov as partners to implement FinOps/token economics, AI governance frameworks, and AI centers of excellence.

00:00 The AI Reality Check

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

On this episode we distill a Dragos public sector session on industrial control system (ICS) threat intelligence and the Worldview platform, framing OT cyber as a national security priority and part of the modern battlespace. We explains why OT defense differs from IT—legacy systems, limited patching, flat trust-based networks, living-off-the-land techniques, and physical consequences—and highlights a shift by threat actors from reconnaissance to operational effects, including coordinated grid activity in Poland, persistent access in power grids for potential kinetic scenarios, maritime targeting of ports and naval logistics, and opportunistic scanning/exploitation of internet-facing OT assets. Dragos is positioned as intelligence-driven, providing adversary tracking, OT-specific IOCs, impact-based vulnerability prioritization, and continuous reporting based on real incident experience. ATPGov emphasizes operationalizing this intelligence through SOC/SIEM integration, secure IT/OT convergence, and mission-aligned execution.

00:00 Why ICS Intel Matters

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode of The Bottom Line Up Front focuses on AI governance and ISO 42001, the first global auditable standard for AI management systems. We explain how ISO 42001 certifies an organization’s decision-making and governance processes around AI—not specific models or products—and emphasizes that auditors validate real-world behavior, evidence, and repeatable processes such as AI inventories, clear objectives, risk and impact assessments, assigned accountability, and oversight of third-party AI. A fair warning that “paper-only” governance fails audits, and stresses starting with mission objectives and risk rather than implementing controls blindly. The script notes overlap with ISO 27001, RMF, SOC 2, CMMC, and NIST AI RMF, outlines a typical 6–9 month implementation, and highlights growing contractual and legislative pressure for provable AI governance, offering ATPGov support to operationalize and audit-prepare these efforts.

00:00 Why AI Governance Now

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode of The BLUF explores agentic AI and how to secure autonomous AI systems before they become a major attack surface. Guests Jacqueline Biggio (Menlo Security) and Eric Avigdor (Chief Product Officer for Menlo Advanced Runtime Security, MARS) define a spectrum from AI assistants and coding tools to fully autonomous agents that can access systems like Salesforce or ServiceNow and execute tasks without human intervention. They describe customer concerns ranging from “shadow AI” data leakage by employees to mature deployments lacking guardrails against agents going rogue, goal hijacking, and data exfiltration. Menlo’s approach includes real-time inspection and sanitization to prevent poisoning and indirect prompt injection, plus Adaptive DLP for masking sensitive data, and warns that browser AI sidebars can access and send context from open tabs to LLMs. 

00:00 Agentic AI Stakes

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This special edition of The Bottom Line Up Front “Quantum Security: Where to Start and What to Do Now,” was  moderated by Jason Gustetic from Arrow, along with ATP's Joey Swartz. During the webinar they explain why quantum computing changes the encryption landscape, define Q-Day as the arrival of a cryptographically relevant quantum computer, and argue the threat is already present due to “harvest now, decrypt later” data theft by nation-state-linked actors. They emphasize agencies must start planning now because post-quantum cryptography (PQC) migration can take years, recommending an organized approach centered on cryptographic discovery, dynamic inventorying, CBOM creation, automation, and “crypto agility” to swap algorithms. They discuss using proxies for immediate protection, prioritizing persistent high-value data, integrating tooling with CI/CD and ticketing, and measuring progress through integrated, reportable posture and compliance.

00:00 Special Episode: Briefing Setup and Speakers

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode of the BLUF focuses on AI systems that work in federal environments by summarizing a technical session on how AI shifts government needs from storage capacity to real-time, secure, actionable data for RAG, streaming inference, and thousands of concurrent agents. It explains why legacy architectures fail on data movement, latency, and security, then outlines VAST Data’s DASE (Disaggregated And Shared Everything) architecture. We describe VAST’s expansion from storage to an “AI operating system” unifying file/object/structured data, SQL and vector databases, Kafka-native streams, triggers/functions, and agent/insight engines, emphasizing baked-in zero trust with RBAC/ABAC and a global namespace across clouds and on-prem. Use cases include cyber investigations, IRS-style chatbots, and multi-tenant agency platforms, and it closes by positioning integrators like ATPGov to operationalize these solutions.

00:00 Introduction

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.

This episode distills Delinea’s walkthrough on quantum computing risk, post-quantum cryptography, and the Quantum Lock feature in Secret Server. It explains how quantum computers and Shor’s algorithm threaten public-key cryptography like RSA and ECC, enabling “harvest now, decrypt later” against data requiring 20–50 years of confidentiality, while symmetric encryption like AES-256 is more resilient. It highlights NIST-aligned post-quantum approaches such as lattice-based CRYSTALIS-Kyber (Kyber 1024) for key encapsulation. Quantum Lock adds an extra layer: secrets are encrypted with AES-256, the AES key is wrapped with RSA 2048 or Kyber 1024, and decryption requires a human password even if Secret Server is compromised; it is intended for tier-zero, static, long-term high-impact secrets and disables rotation/heartbeat features.

00:00 Why Quantum Risk Matters

This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.