Behind the Shield

Behind the Shield is InfusionPoints’ podcast where we sit down with partners, customers, and industry leaders to talk about FedRAMP, compliance, and cybersecurity in today’s government landscape. Each episode offers laid-back, insightful conversations that blend expertise with real-world experiences.

Behind the Shield is a technology podcast hosted by InfusionPoints, with 45 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

InfusionPoints hosts Behind the Shield, a technology show with 45 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #45

  Zero Trust Is Not a Product: Building, Proving, and Automating the Architecture

  Aug 5, 202647 minS1

  Zero Trust is everywhere in cybersecurity conversations, but it is not a single product, tool, or technology. It is a fundamentally different way of designing, securing, and operating an entire system. In this episode of Behind the Shield, Gary Daemer welcomes Michael Schroeder back to the podcast for a practical conversation about what Zero Trust really means, how it evolved from an architectural concept into federal policy, and why implementation requires more than adding MFA or replacing a VPN. They explore the five pillars of Zero Trust, the maturity models and federal guidance shaping adoption, and the identity, access, architecture, and cultural challenges agencies and cloud service providers must overcome. They also examine one of the biggest remaining questions: How do organizations continuously prove that their Zero Trust architecture is actually working? The conversation covers assessment and validation, commercial applications, just-in-time access, least privilege, observability, logging, automation, and the technologies that may shape the next phase of Zero Trust adoption. This episode also marks a new chapter for Behind the Shield as the first release featuring our new branded introduction and refreshed thumbnail. What You’ll Learn • Why Zero Trust is an architecture, not a product • What it means to operate without inherited or implicit trust • The five pillars of the CISA Zero Trust Maturity Model • How visibility, automation, and governance support every pillar • How Zero Trust evolved from industry principles into federal policy • The roles of NIST, CISA, OMB, NSA, and federal Zero Trust guidance • Why identity, MFA, least privilege, and time-limited access are foundational • How human and non-human identities create different security challenges • Why legacy architecture and standing privileges complicate implementation • How organizational culture can become a bigger obstacle than technology • What Zero Trust validation could look like beyond checklists and self-attestation • Why cost, interoperability, motivation, and assessment remain barriers to adoption • How Zero Trust principles can reduce risk for commercial organizations • How automation, logging, observability, and just-in-time access support implementation • What may come next as federal agencies and technology providers continue to mature Chapters 0:00 - Zero Trust Foundations 5:38 - Maturity Models and Federal Guidance 11:26 - How Zero Trust Became Federal Policy 15:57 - Identity, MFA, and Access Control 22:59 - Architecture and Cultural Challenges 26:58 - Validating Zero Trust Compliance 31:05 - Barriers to Adoption and Commercial Impact 36:05 - Practical Implementation and Automation 42:35 - What’s Next for Zero Trust Guest Links: https://www.linkedin.com/in/mjschroeder1/ https://www.linkedin.com/company/excentium/ https://excentium.com/ Connect with InfusionPoints: Gary Daemer: https://www.linkedin.com/in/infusionpoints/ InfusionPoints: https://www.infusionpoints.com InfusionPoints LinkedIn: https://www.linkedin.com/company/infusionpoints/ InfusionPoints & AWS: InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments. About Us: InfusionPoints helps organizations Build, Operate, Prove, and Defend secure, mission-ready environments in highly regulated markets. We combine cybersecurity, cloud engineering, compliance, and real-world operations expertise across FedRAMP, FedRAMP 20x, DoD, and enterprise frameworks. Through our Continuous Trust approach, we help customers move faster, maintain compliance, and strengthen security from authorization through ongoing operations.

  ListenShow Notes
• 

  Episode #44

  Beyond the Digital Perimeter: Drones, Radar, and the Future of Physical Security

  Aug 3, 202651 minS1

  Behind the Shield is taking a slight detour. Most episodes focus on cloud security, cybersecurity compliance, and mission systems inside the data center. This time, Gary steps outside the digital perimeter with Logan Harris, CEO of Spotter Global, to explore threats surrounding critical infrastructure, military sites, airports, utilities, and data centers. Logan shares how his work evolved from traffic-monitoring radar into lightweight surveillance systems for military missions. Technology that once required hundreds of pounds of equipment was reduced to only a few pounds, creating new possibilities for drones, operations, and perimeter monitoring. The conversation then turns to a fast-growing security concern: drones. Gary and Logan discuss how inexpensive commercial drones, fiber-optic-guided systems, autonomous navigation, and coordinated swarms are changing the threat landscape. They explain why GPS and communication jamming may no longer be enough when drones can operate without emitting a detectable signal. They also examine how radar, remote identification, cameras, AI analysis, and common operating pictures can identify aircraft, locate operators, reduce false positives, and help teams respond. Although this episode ventures beyond our usual topics, the parallels are clear. Physical security teams face many of the same challenges as cybersecurity operations centers: collecting sensor data, identifying threats, reducing noise, maintaining human oversight, and moving from detection to response. It is a different kind of perimeter, but the question remains the same: once you detect a threat, what can you actually do about it? Chapters 00:00 - Introduction 00:12 - Welcome to Behind the Shield 00:58 - Logan Harris and Spotter Global’s origin story 02:38 - From airborne radar to ground surveillance 04:08 - Supporting special operations and village stability missions 06:48 - The Metcalf substation attack and pivot to critical infrastructure 09:01 - Miniaturizing radar with modern wireless and DSP tech 13:08 - The new threat: FPV and fiber-optic drones 16:51 - Detection, remote ID, and operator location tracking 23:21 - What drone mitigation looks like today 27:26 - The Critical Infrastructure Airspace Defense Act 29:57 - AI, autonomous drones, and the future battlefield 32:39 - Holographic 3D radar and swarm detection 33:56 - How the system distinguishes drones from birds and clutter 37:25 - Biggest adoption challenges: education and regulation 41:28 - Funding model and commercial vs. military customers 43:29 - Books, documentaries, and personal recommendations 46:07 - Compliance, integration, and future follow-up topics 50:19 - Closing thoughts on drone threats and infrastructure risk What You’ll Learn • How military radar technology evolved into commercial perimeter security • Why drones are creating new risks for critical infrastructure and data centers • How radar, remote ID, cameras, and AI work together to identify threats • Why fiber-optic and autonomous drones are difficult to detect or disrupt • The similarities between physical security operations and a cybersecurity SOC • How legal restrictions affect drone detection, mitigation, and response Connect with Logan Harris and Spotter Global: Logan Harris: https://www.linkedin.com/in/lh1937/ Spotter Global: https://www.spotterglobal.com/ Spotter Global LinkedIn: https://www.linkedin.com/company/spotterglobal/ Links Reference: https://www.congress.gov/bill/119th-congress/senate-bill/4380/all-actions-without-amendments https://www.cotton.senate.gov/news/press-releases/cotton-introduces-bill-to-protect-critical-infrastructure-from-drones https://www.spotterglobal.com/blog/spotter-blog-3/spotter-global-s-gax500-3d-radar-wins-prestigious-sia-award-delivering-unprecedented-security-against-drone-swarms-88 Connect with InfusionPoints: Gary Daemer: https://www.linkedin.com/in/infusionpoints/ InfusionPoints: https://www.infusionpoints.com InfusionPoints LinkedIn: https://www.linkedin.com/company/infusionpoints/ InfusionPoints & AWS: InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments. About Us: InfusionPoints helps organizations Build, Operate, Prove, and Defend secure, mission-ready environments in highly regulated markets. We combine cybersecurity, cloud engineering, compliance, and real-world operations expertise across FedRAMP, FedRAMP 20x, DoD, and enterprise frameworks. Through our Continuous Trust approach, we help customers move faster, maintain compliance, and strengthen security from authorization through ongoing operations.

  ListenShow Notes
• 

  Episode #43

  Meet “Vader”: FedRAMP VDR & VER, PAIN Scores, and the New Era of Vulnerability Response

  Jul 21, 202637 minS1

  Yes, this episode starts with Jason playing the Darth Vader sound. Around here, we pronounce VDR like “Vader,” so naturally, he had to commit to the bit. Once the Imperial March ends, Jason and Mike break down two of the most important pieces of the evolving FedRAMP vulnerability management model: Vulnerability Detection and Response, or VDR, and Vulnerability Evaluation and Reporting, or VER. These requirements represent a major shift away from monthly vulnerability snapshots, blanket CVSS-based remediation timelines, and compliance processes built around spreadsheets and static reporting. Instead, CSPs will need to continuously identify vulnerabilities, evaluate them within the actual context of their environments, prioritize them based on real agency risk, and share actionable information with federal customers. The conversation explores how the new PAIN scoring model changes vulnerability prioritization by considering factors such as exploitability, internet reachability, system architecture, federal data impact, and the likelihood that a vulnerability could actually be used against a specific environment. Jason and Mike also discuss why scanners alone cannot provide all the context CSPs will need. Security, engineering, architecture, DevSecOps, and SOC teams will have to work together to understand how resources connect, what vulnerabilities truly affect, and which mitigations can immediately reduce risk while permanent remediation moves through the engineering process. For some of the highest-risk vulnerabilities, remediation or risk reduction timelines may be measured in hours rather than weeks. That means vulnerability management must begin operating more like incident response, with continuous visibility, automated analysis, real-time alerting, and teams prepared to respond outside of a traditional monthly reporting cycle. The episode also examines what these changes mean for existing FedRAMP Rev. 5 CSPs, agency reporting, POA&M processes, CI/CD pipelines, 3PAO assessments, automation, AI-assisted analysis, and communication between CSPs and their agency sponsors. Ultimately, VDR and VER are about moving beyond checking the box. The goal is to give agencies better visibility into their actual risk while allowing CSPs to focus their time and resources on the vulnerabilities that matter most. What You’ll Learn • The key differences between VDR and VER • Why vulnerability management is moving beyond monthly scans and CVSS scores • How PAIN scores add real-world risk and agency context • What continuous monitoring and faster remediation timelines mean for CSPs • Why security, engineering, SOC, and DevSecOps teams must work together • How automation and AI can support vulnerability analysis at scale • What CSPs should discuss with agency sponsors and prepare for now Chapters 0:00: Understanding VDR and VER: The Basics 2:52: Vulnerability Detection Response (VDR) Explained 5:34: Vulnerability Evaluation and Reporting (VER) Insights 8:25: The Importance of VDR and VER for CSPs 11:27: Challenges and Transitioning to New Standards 14:08: Contextualizing Vulnerabilities in Modern Environments 15:49: Challenges in Vulnerability Management 20:42: The Role of AI in Vulnerability Analysis 26:23: Understanding Remediation Timeframes 32:02: Accountability and Flexibility in Vulnerability Management 34:13: Key Questions for CSP Success Links: Blog- https://infusionpoints.com/blogs/fedramp-vdr-and-ver-monthly-scans-continuous-trust Jason Shropshire- https://www.linkedin.com/in/shrop/ Mike Strohecker- https://www.linkedin.com/in/michael-strohecker-238326172/ Https://www.InfusionPoints.com LinkedIn: https://www.linkedin.com/company/infusionpoints/ InfusionPoints & AWS: InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments. About Us: InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets. We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement. Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

  ListenShow Notes
• 

  Episode #42

  Identity, AI, and the Future of FedRAMP 20x with Matt Topper

  Jul 8, 202649 minS1

  In this episode of Behind the Shield, Gary Daemer sits down with Matt Topper, President of UberEther, to discuss identity, FedRAMP, FedRAMP 20x, DoD cloud authorization, AI, and what it takes to build secure platforms for highly regulated environments. Matt shares UberEther’s approach to helping agencies and SaaS providers solve identity and access management challenges while accelerating authorization through inherited controls, private tenant environments, and secure platform design. Gary and Matt dig into the realities of FedRAMP, FedRAMP 20x, and DoD Impact Level 5, including the “easier button” approach to authorization, the ongoing complexity of audit logging, FIPS validation, cryptography, access control, POA&Ms, and application-level security. The conversation also explores how AI is being used in compliance and security workflows, from crypto discovery and audit control review to POA&M analysis, vulnerability noise reduction, log correlation, and security operations. They also discuss change management, sponsor requirements, SCNs, agency expectations, and how FedRAMP 20x is shifting the conversation around certification, authorization, inherited controls, automation, and faster paths to assurance. Later in the episode, Matt shares the story behind UberEther, his approach to company culture, growing without outside funding, and building a people-first business focused on long-term value. What You'll Learn: • How identity and access management shape FedRAMP and DoD cloud security • Why DoD IL5 and FedRAMP 20x require both technical depth and process discipline • How inherited controls can help accelerate authorization • Why audit logging, FIPS, crypto, POA&Ms, and access controls remain major challenges • How AI agents are being used to support compliance and security workflows • Why change management can slow innovation in regulated environments • How sponsorship impacts the federal authorization process • Why non-person identities and AI-connected systems create new governance challenges • How Matt thinks about company culture, long-term growth, and building without outside funding Chapters: 00:09 Intro 01:19 Platform overview 02:58 Building for government needs 08:27 AI, audit, and FIPS 20:28 FedRAMP 20x and sponsor blocking points 20:56 Virtual ISO services 32:25 Future of the company 46:37 Big services company Books & Podcasts Referenced: • Traction by Gino Wickman • Another Way by Dave Whorton • The Ideal Team Player by Patrick Lencioni • Multipliers by Liz Wiseman • The Identity Jedi Podcast with David Lee Guest Links: Matt Topper: https://www.linkedin.com/in/matttopper/ UberEther: https://www.linkedin.com/company/uberether/ https://uberether.com/ Learn more about InfusionPoints: https://www.linkedin.com/company/infusionpoints/ Gary Daemer: https://www.linkedin.com/in/infusionpoints/ Request a Demo: https://xbu40.com/ FedRAMP 20x Quick Look Assessment: https://xbu40.com/assessment InfusionPoints & AWS: InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments. About Us: InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets. We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement. Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

  ListenShow Notes
• 

  Episode #41

  FedRAMP CR26 Explained: What the 2026 Consolidated Rules Mean for CSPs

  Jul 8, 202623 minS1

  In this bonus episode of Behind the Shield, we’re breaking down one of the biggest FedRAMP updates of the year: the release of the FedRAMP Consolidated Rules for 2026, also known as CR26. FedRAMP has been moving quickly, and for cloud service providers, agencies, assessors, advisors, and anyone working in the federal cloud ecosystem, CR26 marks an important shift toward a more unified, structured, and transparent approach to FedRAMP certification. Instead of navigating scattered updates, public notices, RFCs, legacy documentation, and evolving pilot language, the Consolidated Rules for 2026 are designed to bring the program’s expectations together into one clearer reference point. In this timely bonus conversation, the InfusionPoints team walks through what CR26 means in practical terms, why it matters now, and how organizations should begin thinking about the transition. The discussion covers how the rules impact FedRAMP 20x, Rev5, certification classes, the Marketplace, machine-readable requirements, and the broader move away from static, narrative-heavy compliance toward structured, automation-friendly security evidence. This episode is especially relevant for cloud service providers evaluating their FedRAMP strategy, teams preparing for Class A, B, C, or D certification paths, organizations currently working through Rev5, and stakeholders trying to understand where FedRAMP 20x fits into the future of the program. Chapters: 00:00 — Consolidated Rules Overview 01:08 — Rule Automation and Management 05:46 — Initial Implementation Phase 08:09 — Key Dates and Deadlines 14:10 — Certification Paths and Timelines 19:48 — AI, Documentation, and Resources What You’ll Learn: • What the FedRAMP Consolidated Rules for 2026 are and why they matter • Why CR26 is more than just another policy update • How FedRAMP is organizing rules, definitions, timelines, and responsibilities • What the shift to FedRAMP Certification language means for CSPs and agencies • How certification classes are changing the way stakeholders talk about FedRAMP baselines • What CR26 signals about the future of FedRAMP 20x and Rev5 • Why machine-readable requirements and structured evidence are becoming increasingly important • How cloud service providers should think about transition planning • Key dates and milestones organizations need to keep on their radar • The importance of understanding applicability, responsibilities, and timing before making major program decisions Resources: Consolidated Rules- https://www.fedramp.gov/2026/ Important Dates Table- https://preview.fedramp.gov/2026/timeline/ https://infusionpoints.com/blogs/fedramp-consolidated-rules-2026-cr26-released Learn more about InfusionPoints: https://www.linkedin.com/company/infusionpoints/ Jason Shropshire: https://www.linkedin.com/in/shrop/ Chad Spears: https://www.linkedin.com/in/chad-spears007/ Tanner Bailey: https://www.linkedin.com/in/tanner-b-37a50a132/ Request a Demo: https://xbu40.com/ FedRAMP 20x Quick Look Assessment: https://xbu40.com/assessment InfusionPoints & AWS: InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments. About Us: InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets. We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement. Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

  ListenShow Notes

Recent guests on Behind the Shield. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.