"This Is Fine" with Hunter Strategy

Unlock the future of cybersecurity in the Department of Defense with insights on the latest tools, frameworks, and strategies transforming network monitoring. Most agencies are still relying on outdated processes—are you prepared for the shift toward automated, real-time risk assessments? In this episode, Dan Beller, Director of Cloud Solutions at Hunter Strategy, and Chris Sowards, GRC expert, reveal how cutting-edge innovations like OSCAL, cloud-native integrations, and advanced vulnerability scanning are revolutionizing continuous monitoring for defense networks.

Episode Chapters:

00:00 Introduction to Continuous Monitoring and Risk Assessment

02:05 Continuous Monitoring and the ATO Process

03:23 Continuous Monitoring and System Modifications

06:15 Evolution of Continuous Monitoring

08:45 Assessment and Compliance in Continuous Monitoring

12:44 Tooling and Automation in Continuous Monitoring

16:04 Future Trends in Continuous Monitoring

19:04 Building Trust and Relationships

19:43 Challenges in Generating Artifacts

20:29 Automating ATO Process

22:48 GRC as a Gateway into Cybersecurity

24:00 The Value of GRC Professionals

24:29 The Importance of GRC in Software Development

25:51 The Need for Improved Tooling

27:08 The Role of OSCAL in Trusting Tooling

28:31 Tools for Managing Disparate Scanning Results

29:52 The Challenge of Limited Authorizations

30:51 Collaboration and Human Readability in OSCAL

34:07 The Need for Connected Governance

36:27 Measuring the Success of Continuous Monitoring

Most organizations overlook the secret ingredient to cybersecurity success: culture. In this eye-opening episode, cybersecurity veterans Russell Eubanks and AJ King reveal how building a strong security culture isn’t just good practice, it's essential. They share powerful stories demonstrating what a thriving security culture looks like and how it can prevent costly breaches. Discover why aligning mindsets and fostering collaboration across teams can transform security from a challenge into a strategic advantage. Perfect for leaders eager to embed security into their organization's DNA, this conversation offers proven strategies to transform your mindset—and your defenses.

00:00 Introduction to Security Culture

02:27 The Importance of Culture in Cybersecurity

05:19 Examples of Good and Bad Security Culture

11:01 Comparing Security Cultures Across Organizations

18:35 Common Pitfalls in Enhancing Security Culture

21:58 Integrating Security into Organizational Culture

23:45 The Role of Non-Security Management

26:35 Empowering All Employees in Security

29:28 Phishing Exercises: A Double-Edged Sword

38:25 Key Takeaways for Executives and Non-Executives

In this episode of "This is Fine," AJ King, Alex Sharpe, and Jake Williams delve into the complexities of the Zero Trust framework and its overlay against NIST 800-53 R5. They explore the philosophical and practical aspects of Zero Trust, emphasizing its role in modern cybersecurity. The discussion highlights the challenges and strategies for implementing Zero Trust, particularly in government and commercial sectors. The episode concludes with insights on how organizations can approach Zero Trust as an evolving mindset rather than a fixed goal.

Episode Chapters:

00:00 Introduction to Zero Trust and NIST 800-53
05:37 Challenges in Implementing Zero Trust
11:18 The Role of Identity in Zero Trust
17:11 The Evolution of Zero Trust
22:29 Final Thoughts on Zero Trust Implementation

In this episode of This is Fine, cybersecurity experts AJ King, Joshua Marpet, and Jake Williams dive into the complexities of pen testing. They explore why standardization is crucial for effective testing and how misconceptions can lead to security gaps. Discover the importance of proper scoping to focus on high-impact areas and why a pen test should simulate real attack scenarios. This discussion is essential for security leaders aiming to enhance their testing programs and communicate value across teams. Learn how to turn pen testing into a strategic security pillar and make smarter cybersecurity investments.00:00 Introduction to Pen Testing and Cybersecurity Experts

02:02 Common Misconceptions About Pen Testing

07:35 The Need for Standardization in Pen Testing

10:49 Defining Pen Testing: Dimensions and Attributes

16:51 The Role of Compliance in Pen Testing

21:57 The Impact of Breaches on Shareholder Value

23:15 The Impact of Cyber Insurance on Business Operations

25:59 Understanding the Role of CISOs in Cybersecurity

27:34 Challenges in Scoping Penetration Tests

30:38 The Importance of Standards in Cybersecurity

33:33 Regulatory Environment and Its Influence on Cybersecurity

36:23 The Role of Regulation in Cybersecurity Standards

39:14 Defining Objectives for Effective Penetration Testing

41:31 Maximizing Value from Penetration Testing Budgets

Most organizations dramatically underestimate how quickly offensive cyber techniques evolve—and how crucial stealth and rapid detection truly are. In this episode, Jake Williams, a cybersecurity veteran, joins Hunter Strategy’s AJ King and Jordan Lazo to expose the real tactics behind cyber warfare—and how your organization can keep pace. Discover why the myth of complex, Hollywood-style attacks is just that, and why most breaches happen through simple social engineering or widespread credential theft. Tune in now to master the art of cyber resilience in a hostile digital landscape—because in cyber warfare, the winners are those who adapt first.

Episode Chapters:
00:00 Introduction to Cybersecurity and Nation-State Threats
04:46 The Rise of Zero-Day Exploits
12:23 Common Misconceptions in Offensive Cyber Operations
18:15 The Reality of Cyber Attacks
25:33 Public-Private Collaboration in Cybersecurity
30:15 Staying Ahead in Offensive Operations

Most organizations overlook a simple truth that could save them millions: understanding when and how to choose between monolithic, modulithic, and microservices architectures. This episode reveals a practical framework to make those calls confidently, impacting security, scalability, and team throughput. Greg Vanore and Scott Hiland break down these concepts with relatable analogies, offering clarity and tactical guidance. Perfect for tech leaders and practitioners, it turns complex concepts into clear actions to transform your organization’s tech strategy today.

Episode Chapters:

00:00 Introduction to Software Architectures
02:23 Understanding Monolithic, Modulithic, and Microservices
05:15 Complexity and Scaling in Software Development
08:12 The Role of Data in Architecture Decisions
11:17 Bridging the Gap Between Business and Technical Teams
14:10 Maintenance and Security in Software Systems
17:09 Defining Monolithic vs. Modulithic Architectures
23:51 Building API Specifications for Business Needs
26:27 Microservices: When and Why?
28:04 The Role of Technical Debt in Architecture
30:32 Hype-Driven Development vs. Real Business Needs
32:34 The Evolution of DevOps Tooling
37:21 Testing Strategies in Modern Development
41:47 Aligning Technology with Business Goals
47:08 Sustainability of Technology Solutions

Unlock the secrets of securing government systems in the cloud and avoid costly pitfalls with guests Dan Beller and Michael Christopherson. Discover insider strategies for seamless, compliant, and secure cloud migration. Learn the subtle differences between commercial clouds and GovCloud environments, and why they matter for your project's security. Perfect for government IT leaders and cloud architects, this episode is your essential guide to a smarter, safer, and more compliant GovCloud journey.

Episode Chapters:

00:00 Introduction to GovCloud and Its Importance
00:55 Understanding GovCloud: Definition and Characteristics
03:17 The Need for GovCloud: Security and Compliance
06:12 Practical Differences Between GovCloud and Commercial Cloud
07:27 Challenges in Implementing GovCloud Solutions
09:07 Navigating the Complexities of GovCloud Services
12:23 Service Availability and Documentation in GovCloud
18:51 The Evolution of Cloud Migration Strategies
29:04 Best Practices for Transitioning to GovCloud

In this episode of "This is Fine," we dive into the complexities of time management in software, infrastructure, and security. We explore how time zones, political changes, and system synchronization impact software development and security operations. The discussion highlights the challenges of maintaining consistent time across distributed systems and the importance of using standardized time protocols like UTC. The episode also touches on historical and cultural aspects of timekeeping, illustrating the intricate relationship between time and technology.

Episode Chapters:

00:00 Introduction to Time in Software

04:30 The Importance of Synchronized Time

09:12 Challenges in Distributed Systems

15:34 Understanding Unix Time and Its Implications

24:04 Real-World Examples of Time Failures

27:33 Best Practices for Managing Time in Software

Welcome back to This is Fine - the podcast all about navigating the complex world of government technology and cybersecurity.

Today’s guest is a true pioneer in government software development: Bryon Kroger. As co-founder of Kessel Run, the Department of Defense’s first software factory, Bryon proved that government agencies can develop and deliver software with the speed and agility of Silicon Valley. Now, as CEO of Rise8, he’s applying those lessons to drive even greater innovation.

Bryon is the mastermind behind DoD’s first continuous Authority to Operate, turning a massive security bottleneck with debatable security impact into a value add daily practice. His work is all about dismantling the bureaucratic barriers that prevent agencies from delivering effective, user-focused software.

We’re excited to dive into what it really takes to transform government technology with someone who’s not only taken on the system but reshaped it for the better.

Episode Chapters:

00:00 Introduction to Government Technology Transformation
01:21 Brian Kroger's Journey: From Air Force to Kessel Run
03:29 Understanding the Acquisition Process in Government
07:09 Bureaucracy Hacking: Navigating Complex Systems
15:23 The Role of Culture in Bureaucracy Hacking
20:53 Pairing as a Tool for Cultural Change
25:41 Implementing Continuous ATOs: Challenges and Insights
27:20 Understanding Security Assessment Challenges
30:14 The Evolution of CATO and Its Implementation
34:39 Continuous Monitoring and Risk Management
39:35 Streamlining Processes for Efficiency
43:47 Scaling Agility in Large Organizations

In this episode of ‘This Is Fine’, Matt sits down with Harold Smith III, the CEO and Founder of Monkton, to discuss the complexities of the Small Business Innovation Research (SBIR) program. They cover the program's role in government acquisition and the challenges small businesses encounter in navigating the contracting world. Matt and Harold explore the advantages of SBIR for both small businesses and the government, emphasizing the power of collaboration and user-centered design. They also address criticisms of the program, such as 'SBIR mills', and advocate for reform to encourage true innovation. Tune in to learn more about SBIR Phase 3 and how it can help your small business thrive!

Chapters:

00:00 Introduction to SBIR and Its Importance

03:01 Understanding the SBIR Program

06:12 Benefits of SBIR for Government

08:56 Challenges in Government Contracting

11:59 The Role of User-Centered Design

14:57 Critiques of the SBIR Program

18:06 Navigating the Valley of Death

20:54 The Future of SBIR and Innovation

25:24 Innovation vs. Acquisition: Understanding the Landscape

26:50 Navigating the Challenges of COVID-19

29:29 The Transition from Air Force to Space Force

32:08 Understanding the SBIR Process and Its Challenges

35:20 Technical Barriers in Government Contracting

39:06 Best Practices for Compliance and Data Management

43:40 Advice for Companies Entering the SBIR Space

47:31 Future Conversations: Expanding the Discussion on SBIRs

Keywords:

SBIR, Small Business Innovation Research, government contracting, small business, Phase I, Phase 2, Phase 3, Space Force, compliance, data management, best practice