The Paramify Podcast

Class A certifications are live. Mike and Kenny get into why it took this long.

The debate during 20x design was whether an existing SOC 2 or ISO could earn a FedRAMP certification outright. The answer was no. What they landed on instead was a path: show your SOC 2, show where it maps to the KSIs, show your commitment to reach Class B or C, and you can list on the marketplace and start selling.

That matters because the old barrier kept good software out. Startups were asked to gamble a few hundred thousand dollars and hope an agency would both buy the product and budget for the ATO process.

Kenny also traces where his whole framework came from, and it isn't the federal side. It's financial audit after Enron, then SAS 70, then SOC 2 at Adobe across hundreds of service teams. Risks, solutions, capabilities, validation.

Curious what Class A would look like for you? Book a demo! https://www.paramify.com/request-demo?utm_source=youtube&utm_medium=social&utm_campaign=makim

Chapters

0:00 Cold open

CMMC just hit pause again, and this time it might actually lead somewhere better. In this episode, Kenny and Isaac sit down with AJ Yawn, founder of the GRC Engineering Club, bestselling author of GRC Engineering for AWS, and GRC Engineering leader at Rippling, for a deep dive into CMMC's Phase 2 suspension, why FedRAMP 20x is a preview of where all compliance is headed, and what "GRC engineering" actually means in practice.

We cover AJ's path from Army captain to GRC (by way of Coalfire and PwC), why screenshot-based compliance is dead on arrival, the "painkiller, not vitamin" mindset that separates real value from busywork, and why treating your GRC program like a product instead of a once-a-year fire drill is the only way forward. We also get into risk-first thinking, the Kubernetes admission controller example that never showed up in an audit, and why this might be the best time in a decade to build a career in GRC.

Isaac Teuscher (Paramify's FDE Lead) joins for the science edition to get into the technical weeds.

Links:

Chapters: 

"If the community wins, America's going to win. If America wins, the world is going to win."

That's Tyler Sweatt's mindset as CEO of Second Front.

Tyler's a West Point grad and Army vet who's spent his career at the intersection of defense and tech. He's been with Second Front for six years, and in that time its Game Warden platform has powered around a hundred ISVs, from legacy primes to brand-new startups, getting mission-critical software authorized and deployed to government networks in a fraction of the usual time. Tyler joined Kenny and Mike on the Paramify Podcast to talk about it.

Key moments from the podcast: 

→ Why old FedRAMP® is dead, and why that's a good thing 

→ Why entrepreneurial naivety is actually an asset in defense tech 

→ Why Second Front bets on self-hosted models over frontier labs for mission-critical software 

→ Why more competitors in this space makes everyone better 

→ His take on building a company right now, when the frontier labs get all the attention

Learn more:

Chapters:

Justin Scott didn't set out to build a security program. But after Vasion's customers started asking hard questions about cloud security, he ended up leading the company through ISO 27001, SOC 2, FedRAMP Moderate, and all the way to FedRAMP High, with IL6 on the horizon. He breaks down what actually worked, what didn't, and why automation is non-negotiable.

Learn more about Vasion at https://vasion.com

Learn more about Paramify at https://www.paramify.com

Chapters:

Monthly vulnerability scans and POA&M spreadsheets aren't going to cut it anymore. Kenny and Isaac break down FedRAMP NTC-0014 and CISA BOD 26-04, the two mandates reshaping how cloud service providers approach vulnerability management, and what CSPs need to do before the December 7, 2026 deadline hits.

They cover why AI has fundamentally changed the threat landscape, how tools like Wiz are helping teams understand attack paths instead of just CVE lists, and what the FedRAMP VDR/VER standard actually requires in practice. Plus, why showing red in your trust center might be the best thing you can do for agency confidence.

Resources mentioned:

- FedRAMP NTC-0014 (VDR/VER Mandate): https://www.fedramp.gov/notices/0014/

Learn more about Paramify: https://www.paramify.com/

Chapters:

"For years defense contractors kept hearing CMMC's coming. And then it kept not coming. So they grew this boy who cried wolf mentality where once it finally really was coming, they were like, I've heard that before." - Matt Bruggeman

Kenny and Mike sit down with Matt Bruggeman, Director of Federal GTM at A-LIGN. Matt has done it all, he's a trained electrical engineer, improv comedian, and independent filmmaker. Matt's birthday was yesterday so this episode is basically his gift. Happy birthday Matt 🎂 

In this episode, they talk about where CMMC actually stands today, why the November 10th Phase 2 deadline changes everything, and what FedRAMP® 20x could mean for the future of CMMC.

Chapters:

Connect with our guest:

Matt Bruggeman: https://www.linkedin.com/in/matt-bruggeman/

A-LIGN: https://www.a-lign.com

Paramify:

Hosts:

Is legacy compliance actually dead? 

In this episode of the Paramify Podcast, we sit down with Bhanu Jagasia and Vincent Tham from BladeStack to talk about the massive shift happening in the GRC world. From the "dark matter of data" to the transition toward FedRAMP 20X, we’re moving away from 1,500-page "black box" documents and toward real-time, automated evidence.

We also dive deep into the AI hype: Will knowledge workers be automated by 2027? Why does "vibe coding" fail in high-stakes compliance? And how can lean teams punch above their weight class using deterministic automation?

Connect with BladeStack:

"Anytime someone says something is dead, that's exactly what I have to go learn." - Ethan Troy

Kenny and Isaac sit down with Ethan Troy, Senior GRC Engineer at TRM Labs, Head of AI Research at GRC Engineering Club, and Hacker at hackIDLE. One of the GOATs of GRC engineering. He's been shipping GRC tools, automations, and agents nonstop.

He's assessed FedRAMP packages from the 3PAO side at Coalfire and A-LIGN. He's pentested for the Department of the Treasury. He built a FedRAMP 20x assessment app before most people knew what 20x was.

His job interview at TRM Labs? They made him build an AI agent.

And yes, this is the first Paramify Podcast Isaac is on.

We got into:

→ Why now is the best time to learn something new 

→ Why 85% of a good GRC agent is deterministic code, not AI 

→ How to actually build agents (dog food your own stuff, stop one-shotting) 

→ Why the SSP is becoming the SSDR (System Security Decision Record) and what that means for FedRAMP® 20x 

→ Why domain expertise is what separates good AI output from great AI output

Learn more about Ethan Troy:

Learn more about TRM Labs: 

Learn more about Kenny Scott: 

Learn more about Isaac Teuscher: 

Learn more about Paramify:

Chapters:

00:58 - Introductions & GRC Engineering

02:12 - From Nursing to Cybersecurity

05:18 - The Problem with Legacy GRC Tools

12:13 - FedRAMP 2.0: The End of SSPs?

16:48 - The FedRAMP Marketplace Metaphor

24:38 - Outcome-Based vs. Hourly Consulting

31:51 - Automating Evidence Collection

37:16 - AI & Real-Time Incident Response

45:10 - Secure Configuration Guides

52:43 - Building an AI-First Culture

58:51 - Principles for AI Agents in GRC

01:05:03 - The 85/15 Rule for AI Logic

In this episode of The Paramify Podcast, Kenny sits down with Justin Merhoff to talk about what makes security actually work: usability, speed, adaptability, and real-world adoption.

Justin shares lessons from nearly three decades in cybersecurity, from his time in the U.S. Army to leading security and compliance programs in the private sector. The conversation covers FedRAMP 20x, trust centers, secure AI, accessibility in cybersecurity, and why security should support the business instead of slowing it down.

They also get into the real burden of FedRAMP and CMMC documentation, why better tooling can reduce burnout for lean security teams, and why “usable security” is often the difference between a control that works in practice and one that only looks good on paper.

Note: At the time this episode was recorded, Justin was with Rhymetec. He is now Director of Compliance at DTEX.ai.

Links:

In this episode, you’ll hear:

Chapters:

This episode is a great listen for anyone working in FedRAMP, CMMC, GRC, compliance, security leadership, or third-party trust.

Today's episode is An Apropos of Nothing.

This episode is optional, you can skip it if you want, but it's a pretty honest glimpse into what hanging out with us is actually like.