In this episode of The Paramify Podcast, Kenny sits down with Justin Merhoff to talk about what makes security actually work: usability, speed, adaptability, and real-world adoption.

Justin shares lessons from nearly three decades in cybersecurity, from his time in the U.S. Army to leading security and compliance programs in the private sector. The conversation covers FedRAMP 20x, trust centers, secure AI, accessibility in cybersecurity, and why security should support the business instead of slowing it down.

They also get into the real burden of FedRAMP and CMMC documentation, why better tooling can reduce burnout for lean security teams, and why “usable security” is often the difference between a control that works in practice and one that only looks good on paper.

Note: At the time this episode was recorded, Justin was with Rhymetec. He is now Director of Compliance at DTEX.ai.

Links:

In this episode, you’ll hear:

Chapters:

This episode is a great listen for anyone working in FedRAMP, CMMC, GRC, compliance, security leadership, or third-party trust.

Today's episode is An Apropos of Nothing.

This episode is optional, you can skip it if you want, but it's a pretty honest glimpse into what hanging out with us is actually like.

“There’s a 5% chance of a $5 million loss. Is it exactly right? No. But it’s way better than saying medium, because medium means nothing.”

Kenny sits down with Rob Black, Founder and CEO of Fractional CISO, to break down how to translate cyber risk into language executives actually act on: probability, dollars, tradeoffs, and clear acceptance instead of vague labels that disappear into a slide deck.

We also get into the “magic genie” myth of GRC tools, what vCISO looked like back in 2017, and the origin story behind Rob’s legendary wig videos.

Key takeaways:

Learn more about Rob Black here: 

Learn more about FractionalCISO:

Learn more about Kenny:

Learn more about Paramify:

Federal compliance is having a moment. FedRAMP, FedRAMP 20x, CMMC, the whole alphabet soup is going mainstream, fast.

In this episode of The Paramify Podcast, we sit down with Justin Rende, Founder and CEO of Rhymetec, to talk about what’s actually changing, what’s still painfully hard, and why “compliance automation” only works if you stay obsessed with real risk.

Justin also shares his origin story (tech ➝ film festivals ➝ tech), how Rhymetec grew from early penetration tests into full vCISO and compliance programs, and the most New York lead gen strategy ever: biking around the city delivering Google Homes and handwritten notes to prospects.

If you’ve ever been promised an “easy button” for SOC 2, ISO, or FedRAMP, this one’s for you.

In this episode:

Why federal compliance is exploding (and why it’s not slowing down)

FedRAMP 20x and the pace of government innovation (yes, really)

The risk of “checkbox compliance” in a world of automation

How to set expectations with customers when security is never just one toggle

Bootstrapping, building recurring revenue, and staying flexible

Customer experience as the real differentiator (care scales better than you think)

Where to find Justin and Rhymetec:

Learn more about Paramify: 

Chapters

0:00 Federal compliance is exploding (and getting mainstream)

“There’s this misconception in the marketplace that you need to be a coder to do GRC Engineering. You don’t. I don’t want people to be bogged down in scripting. I want them to be systems thinkers focusing on architecture and orchestration.”

Kenny and Mike sit down with the GOATed pioneer of GRC Engineering, Ayoub Fandi. In case you’ve been living under a rock, Ayoub is the Security Assurance Automation Team Lead at GitLab and the Founder of GRC Engineer.

This episode covers Ayoub’s wild pivot from middle school English teacher to sending 500 cold LinkedIn DMs to break into security. We dive into his first trip to Utah (discovery of "sugarcane fillets" and life-changing butter cake), why APIs are the “landlines” of the past, and how he sparked the movement behind the GRC Engineering Manifesto to give practitioners their own “Phoenix Project” moment for compliance.

Key Takeaways:

Learn more about Ayoub:

Learn more about Paramify:

Chapters

00:00 Intro — Utah, butter cake, and Ayoub's first time in the U.S.

Kenny and Mike sit down with Dixon Wright, Head of Delivery at Eden Data, for a grounded and insightful conversation on security, compliance, and building smarter systems.

They cover:

- Dixon’s journey from college football to leading security at Eden Data

- What it takes to actually deliver cybersecurity — not just sell it

- Why Eden Data joined the FedRAMP 20x pilot

- How compliance is evolving across commercial and federal sectors

- Why trust, transparency, and execution matter more than buzzwords

It’s one of the most real conversations we’ve had about what delivery actually looks like in the compliance world.

Chapters

Learn more about Eden Data: 

Learn more about Dixon Wright:

Learn more about Paramify: 

Learn more about Kenny:

"The AI age we're in is going to force startups to compete in the higher upper echelon of risk assurance."

Jack Rumsey Head of GRC at Swimlane explains why startups will no longer have the luxury of maturing later and how the AI era is pushing even early-stage teams into enterprise-grade security.

This episode covers why assurance needs to evolve, how 20X can level the playing field, why automation is changing everything about how companies prove trust, and Jack's brief era as "the richest fifth-year college student of all time."

Key Takeaways:

Chapters

Learn more about Jack Rumsey: 

Chapters

Learn more about Jack Rumsey: 

Security isn’t sexy. It’s laundry. You know you need to do it, but you’d rather have a tool do it for you.

Kenny Scott and Mike Schreiner from Paramify sit down with George Manuelian from RapidFort to talk about freeing the captives — the engineers buried in spreadsheets, patch tickets, and compliance chaos.

They cover:

Why security always seems at odds with progress

How automation can fix what boredom created

The giant washing machine for open source

Starting clean, staying clean, and why “7 million vulnerabilities” isn’t a vibe

FedRAMP, CMMC, and the art of not losing your mind in compliance

It’s the least boring conversation you’ll ever hear about vulnerabilities.

FedRAMP as we know it is changing. In this episode, Mike and Kenny sit down with Mike “Waffle” Craig, founder and CEO of Vanaheim Security and longtime cloud and cybersecurity leader, to unpack what FedRAMP 20x means for agencies and vendors across FedCiv and DoD. We get into compliance philosophy, how to define your boundary the right way, why sponsorship strategies matter, and where scalability will make or break 20x.

Mike Craig shares hard-won lessons from incident response, multi-cloud ATOs, and advising startups so they don’t burn six or seven figures chasing the wrong path.

What we cover:

  • Why FedRAMP 20x signals the future of federal compliance

  • Sponsorship realities, Ready pitfalls, and how small vendors survive

  • Boundary, data flows, and “if you can’t draw it, you can’t secure it”

  • Zero trust in practice and multi-zone risk profiles across stacks

  • AI and LLM/RAG inside a FedRAMP world and change approval at scale

  • JAB is gone, human variance is not, and how to navigate the psychology of yes

  • CSFC as a model for defined stacks and what that could mean for AI patterns

  • Practical diagramming tips and the surprising power of PowerPoint

  • The “Waffle” origin story and a DoD “Beta Blocks” style experiment

Guest:

Learn more about Paramify: 

Exploring FedRAMP 20x, GovRAMP, FISMA, or CMMC and want a faster path to audit-ready deliverables and ConMon at scale? Talk to Paramify. We help teams get compliant and stay compliant 90% faster at a quarter of the cost.

Timestamps / Chapters

“Once you’re in Hotel FedRAMP, you can’t leave.”

Jason Oksenhendler, Cybersecurity Director of FedRAMP®/GovRAMP at Baker Tilly x Moss Adams, sits down with Kenny and Isaac to talk about FedRAMP’s past, how 20x is shaping the future, and why nobody ever really checks out of Hotel FedRAMP.

👉  Key Takeaways:

• FedRAMP 20x was a “hand grenade” for everyone’s roadmap, and it’s already transforming compliance speed and evidence collection.

 • Risk-first programs survive change — smart architecture and design decisions matter more than chasing checklists.

 • Flexibility vs. rigor — 20X offers new freedom, but assessors must still enforce strong security.

 • Collaboration wins — assessors and CSPs working together can turn impossible timelines into success.

Learn more about Jason:

https://www.linkedin.com/in/jason-oksenhendler/

Learn more about Baker Tilly x Moss Adams:

https://www.bakertilly.com/

https://www.mossadams.com/

Learn more about Kenny:

https://www.linkedin.com/in/kenny-g-scott/

Learn more about Isaac:

https://www.linkedin.com/in/isaacteuscher/ 

Learn more about Paramify: 

https://www.paramify.com/

Timestamps:

00:00 – Moss Adams x Paramify team-up

01:00 – Less than two-week deadline

01:44 – Submitting against moving targets

02:24 – Nature of FedRAMP change

02:56 – Success despite chaos

03:07 – The reality check

03:13 – Official podcast kickoff

04:01 – Jason’s career origin story

05:40 – First FedRAMP assignment

11:43 – Co-creating the FedRAMP High Baseline

13:00 – Early FedRAMP pain

15:32 – “You could do a Seinfeld routine on this crap.”

17:30 – Culture shock of change

20:00 – Continuous monitoring reality

22:50 – FedRAMP rigor vs. other frameworks

25:00 – 20X blows up the roadmap

29:00 – Cross-team collaboration

34:00 – 20X flexibility vs. rigor

38:00 – Scaling 20X & future baselines

46:00 – Tools then vs. now

49:30 – Lifelong learning

55:00 – “Get over it. This is the future.”

59:02 – Career lesson from a mentor

1:02:04 – Closing