Welcome & Program Framing
(3:46 - 3:56)
Test, test, test, testing. Can you guys hear me all right? We're gonna get started in a couple minutes. We have an update from the Pentagon.
(4:04 - 4:22)
Everybody start taking a seat, we're gonna get started. Please have a seat. Before we get started, I want to thank everybody for coming to the event.
(4:23 - 4:37)
The DOW CISO EA just sent me a message. He would not be attending today for an emergency, but it's okay, we have a lot of great panelists and discussions that we're gonna continue. I'm a good friend of Aaron's, so do not worry.
(4:37 - 4:45)
All your stuff is gonna go right to him anyways. He's gonna get his reports. But the CIO, Davis, pulled him into a meeting about an hour ago.
(4:46 - 4:59)
So it went from him going from keynote and panelists to just keynote to this emergency call. So if this happens, it's okay. We have an incredible group.
(5:00 - 5:06)
We've got Major General Von Kammen for second panel. We have Chuck Brooks and so many other great technologies. And we have a lot of government that's coming.
(5:07 - 5:17)
So do not let this discourage you. I will one day introduce you to him inside that E-ring. My name is Nino Marcantonio.
(5:17 - 5:24)
We're gonna go ahead and kick off before I introduce myself. We're gonna go ahead and launch the video. And then we're gonna just continue with the panel.
(5:24 - 5:35)
We have the great Dr. Wanda Heath-Jones here from the Air Force in the first panel. So we'll fill in and ask all the right questions with the first panel. And then we'll do the run of the show.
(5:36 - 6:00)
And I wanna thank everybody, all the sponsors, all the panelists, all the government stakeholders, and especially Carahsoft, there's an incredible team. The last time we did one of these was during the urgent invasion of Ukraine, if you wanna call it that. We helped Ukraine out in partnership with the joint rapid acquisition.
(6:00 - 6:12)
So that was a great event. So this one is just gonna get better and better. At this point in time, I would like to have our AV play the kickoff.
ICAM Summit 2026 Kickoff Video
(6:12 - 6:25)
Today, we gather with purpose. Welcome to the ICAM Summit 2026. We honor the war fighters who stand the watch and the civil servants who keep the Department of War moving forward.
(6:26 - 6:55)
Zero trust identity, continuous authority to operate, artificial intelligence and quantum at mission speed. Marcantonio Global exists for one purpose, to advance the national defense strategy by scouting, assessing, identifying, and presenting potentially revolutionary technologies to Pentagon senior leaders. Our vision, an America that leads the global AI race, securing technological dominance and national security.
(6:56 - 7:07)
We stand on faith, boldness, humility, legacy, coalition, and impact. Integrity, honesty, and security in all we do. Vaini.
(7:08 - 7:12)
Vidi Innavavi. Vici. Let's begin.
(7:13 - 7:43)
Identity has become the foundation of modern cybersecurity. As agencies prepare for emerging quantum threats and evolving mission requirements, strengthening identity, credential, and access management strategies has never been more critical. Join Carahsoft and Marcantonio Global for the ICAM Summit 2026, an exclusive executive forum bringing together federal cybersecurity leaders, defense innovators, and industry experts to examine the future of identity security across government.
(7:45 - 7:54)
Policy sets the stack. Execution is the spine. Panel one begins with the Chief Information Security Officer of the Department of War.
(8:17 - 8:23)
Just some of the examples. We turned their language into ciphers. The enemy never broke.
(8:23 - 8:31)
800 messages at Iwo Jima, zero errors. Four domains. Intensive care nurse.
(8:31 - 9:00)
I served on the identity ecosystem steering group for NIST in the development of standards involving privacy and security on the internet, primarily focused on the networking. Panel two. Identity and trust at the speed of the mission.
(9:12 - 9:31)
Panel three with Major General, retired, Edward Vaughn, United States Air Force. Carahsoft and Marcantonio Global bring government, industry, and allies into one room. This is ICAM.
Opening Remarks
(9:52 - 9:59)
Clap, clap. Hi, my name is Nino Marcantonio, CEO of Marcantonio Global. Give you a little bit of background that I didn't give you before.
(10:00 - 10:33)
Since 2017, I entered the building on a mission to innovate, literally. And we built two programs where we convinced the Defense Threat Reduction Agency and Office of the Secretary of Defense Policy to help lead a national defense strategy by scouting, assessing, identifying revolutionary technologies. And we did so fairly well with a network of 1,300-plus SES and FLAG officers that I brag online about.
(10:35 - 11:16)
And some of them come, some of them don't come, but they're always there when you have real disruptive technology, whether it's ICAM or advanced propulsion or advanced material science, advanced AI, remote viewing, all sorts of crazy stuff that is actually becoming real. So my world is in an intersection of disruptive innovation, but most importantly is bringing people together to innovate, collaborate, because we need to move at the speed of AI. In fact, a lot of this stuff that we've done today has been with the help of AI.
(11:20 - 11:49)
In 2019, my first summit in the Pentagon before the first 50 that nobody saw was an advanced general intelligence by a man by the name of Dr. Taylor. And Dr. Taylor claimed that Google had stolen his patents. So those are the kind of innovators that I like to work with, the small, disruptive, agile innovators that need to have an opportunity to be seen.
(11:53 - 13:04)
So 2017, 2019, we started building a network inside the building, and I started working with Dr. Wanda Jones, Ram Moselby, at the time, General Shice, he wasn't Lieutenant General yet, but Shice, and these senior leaders across the board started coming to these forums because they showed a technology that could help us advance our national strategy if we would invest in that. So we kind of played the disruptor role really well, and we engaged, we had a really nice setup where the Office of the Interior Defense would allow us to do these forums every month. But what's really important was the scouting, assessment, understanding how fast we needed to start moving because the status quo was just not working, and it's not that the status quo doesn't work, it's that we need to go ahead and help the Department of War, federal, and IC, and allied community move faster, collaborate better, and it goes from policy all the way down to urgent operational needs.
(13:05 - 13:41)
So that's kind of like where we put ourselves into helping draw the national defense strategy under the Policy Executive Secretariat, Dr. Henson, and we ran forums, and we started giving the Pentagon, not that we were the only ones doing it, but we became part of an agility campaign to see that when you gather the right people around the table, you can make some really important things happen. And we have accelerated about over 300 technologies, and 150 of them are inside different programs. And if you guys want a list of that, I can share that.
(13:42 - 13:48)
But you have to sign a really big, deep NDA. Just kidding, but I will share that. That's very important.
(13:48 - 14:47)
Now we find ourselves in 2026 in a world where we have a nuclear power competition, and we need to really figure out how to get things right with moving at the speed of relevance, and we're here. So I'm gonna call this panel because when I got a signal from the Honorable Aaron Bishop to do this event, I don't move if one of the senior leaders that I work with doesn't tell me, call the signal, and that signal becomes action, and then we do these events. Whether if it's a surgical forum to S9, or whether if it's pushing technology into Ukraine through the Pearl, these are the things that we have to do, and we have to gather the right people around the table to collaborate and disrupt and move faster because China has risen.
Panel 1: Multi-Perspective Defense & Innovation Views on ICAM
(14:48 - 15:02)
I would like to now call our first panelist. Let's go ahead and start with Dr. Wanda Jones. Hey, Principal Cyber Advisor, Department of Air Force, applause please.
(15:02 - 15:31)
Hello, hello, here you go. This one is for you, thank you for coming. You got the handshake? I got you, I got you.
(15:33 - 15:43)
Okay, good, so we got one SES in the room. Sorry, I couldn't get 1,300 to come today, but at least a couple will show up. Some of them are retired, it's okay.
(15:44 - 16:00)
Okay, next, I wanna call our virtual panelist from Space Force. He is a friend, we've worked together for the last three years. I wanna welcome Carl Yunus, okay, highly qualified expert system integrator, Space Systems Command, Space Force.
(16:01 - 16:09)
Go ahead, Carl, say hello. There he is. Carl's very important to this discussion.
(16:09 - 16:32)
You'll find out in a second why. Next, David Beck, are you online, sir? David did not make it? Okay, that's okay, we lost another one virtually. I would like to introduce Matt Kelly, Senior Vice President, GM, U.S. Public Sector, Craxel, they should come up.
(16:37 - 17:06)
Remotely, the great Dan Hock. He's the CTO, he's the CTO of Galax, Galaxy, sorry, I'm, Galaxy, L-L-C, if I said it right, or I apologize, U.S. Navy Nuclear Submarine Operator, Fast Attack and Army National Guard Corps, Officer of the Artillery, NIST, I-D-E-S-T. He's basically like a really special person.
(17:07 - 17:25)
Welcome to the panel. And I also welcome, absolutely, sir, thank you, and I also would like to welcome Mrs. Hock, okay? She is the CEO of the company, the wife. They are two of the most disruptive people I've ever met in my life, and welcome.
(17:29 - 17:42)
And Jose Bolanos, please come up, CEO of Nimbus. Bravo, Jose. And finally, Jordan Cancer Scott.
(17:43 - 17:55)
He is the Chief of Code Talkers Engineering. Please come up. Now we're ready to rock.
(18:02 - 18:49)
Okay, so we have some, we all have our mics on, and we're ready to ask some questions, okay? Let's begin. Is that the first question you, where are your questions? Yeah, I'm looking for my questions, so just give me one second. So you know what, let's just go ahead and start asking some questions.
(18:49 - 19:13)
We're gonna start off with talking about why is identity so important in the grand scheme of things that are happening with our network, with all the reforming and how fast we wanna move inside the cybersecurity landscape. Dr. Wanda, tell us a little bit about what the mission is looking like for the Air Force. Tell us a little bit about how we're dealing with all the changes that's coming with the reform.
(19:13 - 19:20)
Okay, great, so thank you. I just got the chair that does not want to stay still. I hope.
(19:20 - 19:44)
So I appreciate that, but thank you so much for the opportunity to talk about what the Department of Air Force is working on as it relates to identity management. Of course, everybody's familiar with Zero Trust. You cannot have a conference without throwing that one on the table, right? And so one of the things that we recognize is Zero Trust is a long journey.
(19:45 - 20:02)
I will tell you, when I was in the CISO seat, we started talking about Zero Trust, and that was over five years ago. If you are within a company now that have truly, fully implemented Zero Trust, please raise your hand. Correct.
(20:03 - 20:37)
So within the department, that really shows that Zero Trust, and specifically identity, is the cornerstone of Zero Trust. If you don't have a strong identity approach, then you will not be able to truly implement Zero Trust. Some of the things that we're looking at is how do we ensure that we minimize our tax services? We're downrange, and we need to make sure that our operators can still access, and we have to pass their identity.
(20:37 - 21:43)
And so we don't want to pass all of their identities, so we're trying to figure out, and this is where industry comes in, how do you do that in a technical environment where you still need to authenticate, but you don't wanna pass all of the credentials that you would normally pass when you're just in your office environment? And so how do we do that without compromising the network, and then making sure that we know who's on the network even when they're downrange? Another area that we're looking at is making sure they actually have access when they are disconnected. We do believe that if we go to war, we will have airmen and guardians, specifically airmen, that will require to operate in a disconnected environment. How do they do that, get that access, still maintain their operational readiness and activities without being connected to the entire enterprise? And then lastly, making sure that it is a federated approach.
(21:44 - 22:03)
We do know that we're not going to fight by ourself. There's a DAF ICAM solution, and then there's a DOW ICAM solution. How do all of those particular solutions work together? We cannot, within the DAF enterprise, have a range of solutions.
(22:04 - 22:17)
That is not what we need to do. Making sure that we, I keep turning around. Making sure, I'm gonna fall out the chair next, but making sure that we are able to federate back to the big DOW ICAM solution.
(22:18 - 22:35)
I will tell you that within the department, we're having some trouble, right? I was just talking to someone about our ICAM solution and being able to meet the FIAR requirements. So that is from a business perspective. And then you have the ICAM solutions for networks.
(22:36 - 23:01)
And then you have ICAM solutions possibly for different classifications of networks. How is that gonna work when we are trying to prosecute a war and everybody needs identity to manage their networks and then put on top of that the joint perspective? And so you have every service, every fourth estate. You have the DOW solution that is being brokered by DISA.
(23:02 - 23:25)
And so we have to think about, from a federated perspective, how would this really work? We do not have the answer to that yet. So if you are in industry and start thinking about all the three areas I've talked about, that will be very helpful when we start looking at the various solutions that we're gonna need right now and in the future. Thank you.
(23:25 - 23:38)
So again, now we're gonna go into the capabilities that are actually gonna solve that. But first of all, since we're the Air Force, and I love my Air Force, we're gonna call, someone is the Space Force right now. And we're gonna talk to that problem.
(23:38 - 23:57)
And it's gonna be Carl Yunus to go actually into solving those problems on the operational side and a little bit more. So go ahead, Carl. I'm gonna call on you to basically tell us how are you solving those problems in Space Force, which is probably the hardest things to solve in space, which we're also gonna be doing next month for the MASSEN.
(23:57 - 25:26)
But let's go ahead and talk to that in peeling the onions and actually how to get this stuff done. So thank you, Nino, and thanks for having me. So just to wanna make things very convenient for all of us, but frankly, we've never got this, because AI is right, AI is largely unfit for our engineering.
(25:30 - 25:52)
So it's such a rapid rate, it's a policy that needs to be taken very seriously now. So that's part of our challenge. And I'm not sure if we can do it financially or socially.
(25:52 - 25:57)
Not necessarily, but very important. Thank you for that. I have something to add to that.
(25:57 - 26:08)
Yeah, absolutely, go ahead, Dr. Wanda. So Carl, you are spot on. When we think about the amount of technical debt that we already have from our legacy systems, we cannot start over.
(26:08 - 26:41)
There's no greenfield opportunity. So that is something that when we think about, not just ICAM and the Zero Trust journey, but as we modernize a lot of our inventory, we are struggling with, how do we do that without starting over? And so if you are an industry partner, again, I would ask, understand how we are architected before bringing solutions, because we cannot start over. We have to incorporate new technology as best we can with what we have.
(26:42 - 27:00)
Absolutely, thank you for that. And so now the Air Force, Powerhouse, Space Force, if we can solve things in the air or space, that's where we're gonna really kind of, this is where I like to try to solve the hardest problems. I'm gonna go ahead and actually go into the how with Mr. Greg Hayward.
(27:00 - 27:09)
I'm gonna call you on to just talk about, Greg, a little bit about what you're doing as a sole source capability that's solving exactly that problem for the Air Force. Go ahead, Greg. I'm gonna call you up.
(27:10 - 27:51)
Very, very good. Thank you. I'm going to go into the activities that we have this year for the Air Force.
(27:52 - 28:03)
Awesome, thank you. And we need to actually, as you see, it's gonna be a tier of thinking about the bigger picture of a policy. I'm gonna go into actually a program to see what we're doing about it.
(28:03 - 28:52)
So we're gonna have this flow. And next, we're gonna go to, I ask, Dan, would you go ahead and talk about, a little bit about your mastery and how you're looking at the problem on the edge at absolutely solving the toughest problems and how you're doing it, whichever way you wanna explain it in relevance of some of your work and some of your projects. Please turn up a little bit.
(28:52 - 29:15)
Thank you. Thank you. The policy issue is, we've had a lot to cover.
(29:15 - 30:34)
So, these particular, previous years before, it was C-CARE, and we've been talking about these kinds of attacks on our VMS and systems just before we start. So, going forward, right? So, when we talk about, Greg, we need these new equipment and systems before we are well-fitted in. We have to ensure that we have dedicated software and hardware kits that presents, or in this case, breaks the advantage point-to-point, such as with blocking, and we have to make sure that both, we know who, if I assume you have to have C-CARE, I assume you have to support that.
(30:35 - 31:04)
So, the importance of knowing who has this particular equipment and on the opposite side, you also have to have the upper identity and access. Thank you. Some of the people working on this really need to ensure that the hardware and software match going forward, so that they can use our access control.
(31:04 - 31:09)
Absolutely. So, again, it goes back to the identity at the core. It's the new perimeter, we know that.
(31:09 - 31:30)
So, we need to really protect everything, get identities across the board for hardware and software, with AIs coming at us. Let's go ahead now, go into another gear, with a retired SCS from CISA, Mr. Matt Kelly. I want him to talk about his perspective, the work that he's doing at Craxel, which is so important.
(31:31 - 32:00)
And Matt, go ahead and tell us a little bit what you're working on and how it's relevant to the iCAM and much more. Yeah, so Craxel has made a breakthrough when it comes to managing massive amounts of data and accessing that data in constant time. I'm not gonna go too much into what that is right now, but it's probably best put in the context of things like continuous monitoring, right? So, we've been talking about continuous monitoring since 2014, when FISMA mandated it.
(32:01 - 32:26)
But are we really doing it? Are we really accessing all that data, all those devices, understanding what's happening on our networks in real time? And I would argue today that we're not. And to me, part of that is a data problem, how that data is organized. Can we find what we're looking for? Can we correlate it against indicators and threats and certain types of signatures that we're looking for in constant time? We can't.
(32:27 - 32:51)
And why is that important? That may not have been important a couple of years ago, but it's becoming important now. And it's becoming important now because agentic AI is actually starting to become a thing. And so, as these agents are able to search and find and exploit vulnerabilities faster than we're able to patch them, that machine speed, that fighting AI with AI is actually becoming more and more critical.
(32:52 - 33:12)
So, what are the barriers to us being able to do that today? So, number one is the speed, how the data is organized, how we access it. But to have speed, you have to many times have that data on running servers. And so, you run into cost issues, right? Why a lot of big organizations only keep 90 days worth of data instantly accessible.
(33:12 - 33:35)
It's just not affordable to keep more. Well, what's the problem with keeping 90 days of data? We've got adversaries with long standing, low and slow campaigns like Bolt Typhoon, like Salt Typhoon, that are waiting to disrupt us at some point in time. We can't, if we don't have the history of more than 90 days worth of data, we're gonna have a hard time finding them.
(33:35 - 33:46)
So, we need to be able to resolve all those issues. We need to be able to keep data longer. We need to make it cost effective to be able to search and keep it hot.
(33:47 - 33:57)
And those are foundational things that we are going to need here very, very soon. Thank you very much for that. Dynamic, very dynamic.
(33:57 - 34:23)
We're looking across all of the sectors that we need to think about because we need to really step back and look at, we need to start getting out of our own way as far as looking at things in one lane in this Pentagon, stay in your lane thing. Now, you gotta learn other people's lanes because if you don't learn them, you don't understand a bigger picture. Let's go ahead and now look at Nimbus-T Global and how they're protecting the front door, so to speak.
(34:23 - 34:31)
Jose, I'd like you to go ahead and talk a little bit about that, how your solution at Nimbus is protecting. Over to you, Jose. Nice to be here.
(34:32 - 34:52)
Yeah, this is really fantastic. So we're talking about identity, right? And the importance of identity. Authentication, is that enough? Is that token that actually is in your browser, is that what's saying that it's you logging into the system? Do we need verification? Okay, so we've been working on this for some time now.
(34:52 - 35:08)
Again, I graduated from Stanford as an OPG-1 physician, created my own electronic medical record. And one of the problems we encountered was, how many of you know more than one person with the same name? I met somebody today, actually. I've never met another, you know.
(35:10 - 35:23)
Yeah, no, so one of the problems we encountered is, as you get older, you have medical information in multiple locations. And in a hospital system, for example, you have multiple layers. You have the main login ID, and then 15 subsystems that have different IDs.
(35:24 - 35:48)
And then you have medical information in five locations. How do you do proper patient record matching? That's really a problem. And when you think about the military, and you have these boys that are actually sitting in control panels that actually are then controlling massive AI agents that are drone planes, that are then the master, that actually then is controlling 250,000 of other small drone planes.
(35:49 - 36:00)
The criminals get into that, and then they have control of that. So right now, when you think about authentication, single-factor username and password, two-factor, add a six-digit PIN. The government calls two-factor multi-factor, and that's an error.
(36:01 - 36:13)
Multi-factor adds a biometric. Apple's done that. Those three layers of authentication, the problem, they're not secure, because they issue a token on your browser, and it says it's you.
(36:14 - 36:23)
So the criminals aren't staying in passwords anymore. And 80 to 90% of the intrusions are through the front door. They're actually stealing these tokens, and they're actually getting in.
(36:23 - 36:34)
And this actually has happened in such a way that you get phishing, you get mega-phishing, and you have AI agents now doing some crazy things. So the first layer is authentication. The second layer is authorization.
(36:35 - 36:54)
So when you have an AI agent that's actually doing things like transferring money, $30 million, and this has actually happened, criminals got in with the OAuth token or the token of a CFO, and told the AI agent to transfer $30 million. And that's happened in San Francisco. Steal it back, steal it back.
(36:54 - 37:03)
Pardon? I was just kidding. Just go steal it back. No, so I am the founder of Nimbus-T Global, Nimbus Key ID.
(37:04 - 37:32)
It's a patented solution in which we do a true user, verification of a user on the mobile phone, KYC, AI, biometric, true user registration of the user, in which we're connecting everything and verifying truly who you are. So it protects the user as well as the enterprise. So the ability to then issue a new login sequence, not passwords, is D-E-M-F-A.
(37:32 - 37:39)
It goes beyond MFA. Dynamically encrypted multi-factor authentication. It's a dynamically encrypted QR code and PIN that changes every five minutes.
(37:40 - 37:52)
So criminals can't steal them and decrypt them and reuse them. So we're looking at some things that are really, really important here in the protection of the enterprise. Some of the attacks that are happening right now, they're not just getting in once.
(37:53 - 37:59)
They get in once with single sign-on. They have access to the entire network. And then a supply chain and API keys.
(37:59 - 38:17)
An API key is static. How come we don't have something else in addition, that one token that says it's you or you have access to that system? In healthcare, we'll be talking about this later, but we've got some major problems. In the entire digital world right now, we are under major attack in a very big way.
(38:18 - 38:30)
And it starts with protecting and verifying that it's really you. Okay, thank you, Jose. Phenomenal, now we're gonna go back towards my special operations days with co-talkers.
(38:31 - 38:53)
I'm gonna go ahead and have, he was actually a president candidate one time, Mr. Scott. So can you tell us a little bit of how you see identity within the world of special operations? Because I think we wanna open up the eyes and ears of the group where we're getting away just from the normal IT, what we're doing for the normal systems. Let's go into special operations a little bit.
(38:54 - 39:12)
So to give you a heads up, I've done stand-up comedy on cybersecurity twice. So we don't have to take this too seriously. But there are two disruptive things that I think I'd like to throw out and kind of stir the pot a little, right? One being zero trust isn't how we operate.
(39:12 - 39:38)
We operate as humans and the relationships that we have is built off of variables and that trust goes up and down based on facts and interaction. So the computer systems that we use also could be using variable trust. And this is an interesting concept but it changes things because information warfare is not IT services.
(39:39 - 40:11)
And so the second thing is very disruptive here is combat operations don't care how many factors you want to authenticate. The combat operation has its own tempo and that tempo defines the time that you have to respond to things. So if you gotta log into your computer, put your thumb on the fingerprint reader, do a blood drop to get into it, do the facial recognition, oh but your nose is broken so now it's not reading and then you finally get in.
(40:11 - 40:46)
Now you have to reboot because it's gotta do the Windows updates. You are losing the combat, right? So there's two different dynamic poles there and what really happens is when you throw all this into the washing machine to kind of see what comes out, it's not what we're talking about. It changes the game entirely to where now how do you build a system that can dynamically change the conditions of the environment while maintaining identity but identity isn't you.
(40:46 - 41:02)
Identity is the tasks that you're trying to do and the reason behind them. And all of that data is there, we just don't use it for identity management. Yeah, that'll take you to the next level but I got even more for you.
(41:03 - 41:26)
I'm gonna call in Dr. Robin Hawk to go into some of those even more revolutionary systems thinking, advanced capabilities that they're building so she can talk to that because we really want to hear her on this topic. Over to you, Dr. Robin. Yes, we can hear you.
(41:26 - 43:06)
Thank you so much, everybody on the panel for a great day and a great time, but I would like to say that the process of making things part of the network, the process of seeing it as a single operator, let me see if I can, and anything that you can do to let you do is absolutely critical to doing a real-time operation in yourself. What we're really talking about is how do you make a change, make a change in your own identity and how do you try that identity with time to lift operations and with identity AI coming into an identity. So separating out the human identity and human identity and human identity is critical.
(43:07 - 43:37)
And back to my reference point, the code B is the electrical build-up of the device long before software has anything to do with it. And this is very, very important for everyone to realize that every chip has an identity already on every device that we build a bot and use in the United States, both as people and as military networks. And the code B to these devices happens long before the computer wakes up or there's any software involved.
(43:37 - 43:45)
So we have to deal with the hard data. We have to deal with the hard data. These softwares are gonna be very important to me.
(43:45 - 44:03)
There are fixes now, it seems to me. Dr. Robin, absolutely, no, this is actually perfect. So bringing the audience into the mind of everyone here is the disruption and discussions they need to have.
(44:04 - 44:25)
It's exactly what I've been doing at these forums. Imagine you get all these right people around the table. You got the acquisition, the program manager, the SME, the revolutionary mind, and then you can start moving at speed that matters, moving at our own way, because if we don't, other people, other countries don't have the bureaucracy.
(44:26 - 44:41)
So this adaptive acquisition framework that we're building is exactly here, and technically here, if we had all the right people around the room, we could make that decision on identity, on technologies, on, it's really the processes that we're trying to change. So thank you very much. This panel is incredible.
Panel 1 Audience Q&A
(44:41 - 44:51)
Now I'm gonna go actually see in the room who has some questions and for who. Raise your hand and just speak up. I don't know if I have an extra mic, but you guys can go ahead and ask a question.
(44:52 - 45:05)
Maybe I'll borrow a mic from Carahsoft somewhere. Anybody have any questions for this phenomenal first panel? Sorry, we're missing Aaron, and he just couldn't make it. Yes, please.
(45:42 - 46:12)
Oh, sorry. So commercial cloud SaaS vendors often get written off when it comes to the edge. Do you see an opportunity for the services, the systems integrators in this room to maybe help us solve that problem by building the integration between technologies that are purpose-built for the edge and then technologies that are purpose-built for the cloud? Or is the Air Force leaning towards, we want one solution that works everywhere.
(46:12 - 46:25)
You have to be able to peanut butter it everywhere. In a perfect world, we would want one solution. However, comma, that does not seem to be possible in today's environment.
(46:25 - 46:50)
What I would suggest is when there are opportunities for industry to respond to RFIs, I know that DOW CIO and OSW Cyber Policy are holding industry days. I've been to at least three in the last two or three months. So those are opportunities as well.
(46:50 - 47:00)
And come in with a partner. Don't make the department choose if it's gonna be just strictly hardware, software. We need a combination.
(47:01 - 47:18)
Come in the door with your solution already discussed with a partner who has the hardware. If you prove that technology together, then I think there's more opportunities for success and implementation across the department. Great question.
(47:18 - 47:40)
So on that, we've essentially, when you're trying to do these events, team up, we try to do as many integrated solutions as we possibly can with the groups that were here. So this is a great time to mingle, team up the partner and accelerate. So when you're presenting, we can actually accelerate your capabilities integrated into the problem sets which are all the urgent operational needs.
(47:41 - 48:11)
Does anybody have any other questions? That's it. Thank you. If somebody had the solutions for all your problems, how fast could we get it implemented? Probably, in today's environment? We are, well, the administration is really looking at acquisition reform again.
(48:11 - 48:37)
And you hear that in every administration, reform, reform, reform. But I will tell you that the idea is to provide the cyber operators in my world the solutions immediately. Try to do, if we're gonna do a pilot of some sort, the end goal of that is to take that into the inventory without going through the full scale ATO.
(48:37 - 49:12)
But we still need to understand the security of applications, right? And so being able to combine all of those requirements in a pilot to allow us to make those choices quicker, I think that will be the best and most expeditious way to get things in inventory. I know there's pie in the sky, right? And I've been in the government for 36 and a half years. And we talk about reform all the time, but I've yet to see reform work as designed out the gate.
(49:13 - 49:37)
So the, as someone who's worked as an acquisition reform from the top bottom, look at all the opportunities that come in, it's called CSO, CSOs and OTAs. You just gotta put it in your AI and you can pop in all that stuff, you can go run it's industry days. And if you have the capability, depending on what capability you have, sir, whether if it's a license, it's all about partnering with the right people to accelerate that.
(49:37 - 49:48)
And you can move pretty quickly, actually. I've had technologies seen in three weeks being acquired, but they're ready, meaning they're ready. And being ready means CMMC compliant.
(49:48 - 49:55)
DRL level. Exactly, all the eight, nine levels. Minimum valid product right now is a thing.
(49:55 - 50:09)
So you can get away with a six to seven, but you need the right partners that are gonna integrate it. So you can get a pilot actually pretty quickly if you know what you're doing with the right people around you. I'll jump in on that just from being on the private sector side now, but previously government and doing some acquisition.
(50:09 - 50:38)
So it comes down to trust, right? You might have a revolutionary product, but if you're not well known, you're not proven in other areas, getting over that first hump of proving it is key. So the government's not gonna bite off a big chunk of money to go give you a big production contract. You gotta go in, I think, with an integrator, with a hardware provider, and with your product in there, and go try to get through the CBER programs or go do a proof of value for the government for a little bit of money.
(50:38 - 50:50)
And then once you prove it, and that takes time, then you can line yourselves up for the production opportunities. But it's not gonna be a one-shot wonder. That takes a little bit of time and it takes trust.
(50:51 - 51:06)
Thank you for that. And I would also add that one of the questions I always ask, is it scalable? Is it multi-purpose, meaning can I fix multiple problems with that solution? We have a tool management problem. We have tools all over the place.
(51:06 - 51:20)
We have capabilities all over the place, but we don't maximize them enough. And so if you bring me one more thing, then it makes it even harder to accept the new capability, unless we wipe out something else. And we're not good at that either.
(51:21 - 51:57)
What comes off the table if we're able to bring in new capabilities fast, can it wipe out four or five of the things that we're using so that my operators don't have to continually battle every day to make sure they understand every tool and capability we have? Also, I wanna bring in Carl to answer that, since he's, even though he's pled the fifth on here. Carl, how would you answer that question in your domain, in space, when you're evaluating some technology, let's say that you would do that. Yeah, I plead the fifth too, so go ahead.
(51:58 - 53:27)
So, thanks. So, Dr. Wanda and Keith make some very interesting points here, I think having a focus that is, as Dr. Wanda has stated, is a global change, is a global shift of innovation and transformation. With our staff departments, through systems, we have a mandate, as it were, to do new things, through acquisition of forms, through integration of systems, but understanding the changes as opposed to things that we do, as it were, are absolutely critical and pertinent, but if we don't have the ability to characterize what that looks like from a technical perspective, who are the teams, who are the team members, it's absolutely, it's gonna be difficult in terms of innovation.
(53:27 - 54:08)
So, I would offer that we have a unique opportunity now, as we are moving through what this looks like to be able to bring the engineers and operators to all of our mission partners to recognize what the need is, how we need to be about and do these things, and have the folks that have faculty and institutional knowledge, have the skills to be able to bring some of these conversations to bear. The policy and governance is only gonna be able to understand part of these questions, engineering, population, business, and business integration, and just in general, it's gonna be absolutely critical and pertinent. Thank you for that.
(54:09 - 54:32)
By the way, next month, we've proposed, I sent a paper from the great Carl Yunus to Lieutenant General Scheiss and another SCS, and he's gonna be trying to lead the way on exactly that discussion. Everything is related, and especially if you can figure out space, you can just figure out about anything else. So, we're gonna be doing that in November.
(54:33 - 54:43)
Thank you, Carl. And I wanna thank the panel, and a big round of applause. Do you wanna say something? Wait, wait, Dr. Wanda wanted to say something else.
(54:43 - 54:55)
Hang on, I wanna say one, you sure? Okay, keep going, applause, oh. Okay, great. Oh, well, sorry, we're out of time for this panel.
Transition & Veteran Recognition
(54:56 - 55:10)
We're gonna move to the next one. We're gonna go ahead and do a transition right now, and we're gonna go ahead and honor a very special veteran at this time. So, I also like to thank all the other panelists virtually.
(55:10 - 55:35)
Bye, guys. We're gonna go ahead and have a little bit of time where we're gonna honor Corporal William T. Kelly. I've been very, very fortunate to have met the Kelly family, not only as spiritual advisors, but also potential partners that I bring in to my Marcantonio Global Alliance, which is comprised of about 20 to 30 really important, small, disruptive minds like you're hearing here.
(55:36 - 56:00)
And I met Joe last year in advising one company, and Joe was amazing, and he beat cancer, and we prayed together, and he prays for me, and we are very spiritual human beings. We like to help each other. So now, we brought him here with Matt, who is his nephew, who's got this incredible technology, but they have a very special family.
(56:01 - 57:06)
Corporal William Kelly was also part of the Manhattan Project, and I would like to call Joe Kelly up here to say a few words. Nino, thank you very much for inviting me to the IPAM Summit 26, and also, I'd like to, again, recognize my nephew, who's better looking than me, Matt Kelly, who's the Senior Vice President of Craxel, and this all came about a few days ago, because, as Nino's nickname is Typhoon, he calls me the night before, I need something on your dad, and you gotta do it now, because it's gonna be presented the next day. So, I tried to put this together, and he used his magic touch with his MGAI to talk about my dad, and I have to say, he's a very good looking man, okay? Now, he got into this business as a draftee in 1942.
(57:07 - 57:23)
He was born in Lockport, New York. He took a battery of tests, like anybody would take a test, find out where you fit in the Army. Well, when he got done taking the test, they realized, we can't use this guy to go to North Africa, he's too smart.
(57:23 - 57:37)
So, they said, we're gonna send him to the Corps of Engineers, Manhattan District, Manhattan Project. My father said, I've got, I won the lotto. I'm going from Lockport, New York to Manhattan, New York.
(57:38 - 57:57)
Well, that's not the case. He got in counterintelligence, a good, he got in the field that he, I don't know how he got into it, but he did, but he was noted for being very good at what he's doing. His first two initials, WT, he picked up a nickname called Watertight.
(57:59 - 58:23)
My dad would not leak a syllable, a word, or anything that's not permissible to outside. However, during, being a civilian in the Army, because he was an Army sergeant, but he actually had three IDs. He was an Army sergeant, he was a civilian, and a Navy lieutenant.
(58:24 - 58:45)
Depending on the mission he'd go on, he would be that, take that alias and do it. He was in counterintelligence. His job was to safeguard the project, safeguard the people involved with the project, make sure that the radio stations and the newspapers in the state of Washington did not print something like 50 words, or say 50 words.
(58:46 - 58:59)
They didn't. Now, if you did that today with a paper, don't print 50 words, it'd be on the front page. However, everything he did, and I'll make this quick, Nina.
(58:59 - 59:14)
Everything he did, it came with a price. I was talking to Dr. Wanda. My mother had no idea what my father was doing most of the time.
(59:16 - 59:24)
He would tell Mel, I've gotta leave. She didn't know when he'd come back. It could be a week, it could be a month.
(59:25 - 59:43)
That really took a toil on my mother. The reason why, my father didn't wear a uniform, and neighbors would look at my mother and say, well, obviously your husband is a slacker. They couldn't say a word, but they paid a price for that.
(59:44 - 59:51)
When they moved, they moved always at night. She couldn't say goodbye to her friends, her neighbors. It was very secret.
(59:52 - 1:00:05)
I was born in Richland, Washington, and at times I do glow at night. And it was a remarkable time. My father was well-known.
(1:00:05 - 1:00:17)
He knew Einstein, Oppenheimer, Groves, Berni, wait a minute. Well, thank you very much. I hope it's a halo.
(1:00:19 - 1:00:27)
But I just wanna tell you that I love my father. He passed in 2004. He served this country.
(1:00:28 - 1:00:49)
He didn't go overseas, but he made sure that the project was held and safeguarded and got the gadget turned into a weapon and landed in World War II. I can take one question. Yeah, you can take one question.
(1:00:49 - 1:00:58)
Go ahead. Does anybody wanna ask anything about the Manhattan Project? I think they built something special there. Yeah, I met, yeah.
(1:00:58 - 1:01:14)
Also, this lapel pin right here represents the Manhattan Project. I met Dr. Einstein at the lodge up in Los Alamos when I was five years old. But my father said, hey, kids, you wanna meet Dr. Einstein? Oh, sure, why not? He was having breakfast right next to us.
(1:01:15 - 1:01:30)
He comes over. I still can remember, even to this day, his voice and his handshake and his white hair and everything, very soft. So that gives you an idea of the circle, the sphere my father was involved with.
(1:01:32 - 1:01:39)
But, yeah, again, Corporal Kelly. Thank you for your service. Thank you for your family.
(1:01:39 - 1:01:43)
God bless you, sir. Big applause. Thank you, Joe.
Panel 2: Healthcare & Critical Infrastructure
(1:01:44 - 1:01:55)
Okay. Okay, we're gonna go ahead and do transition. We're gonna go into the critical healthcare space now.
(1:01:56 - 1:02:13)
By the way, in 2021, there was something called the Urgent Pandemic Response. My program was asked by the Undersecretary of the Navy to start supporting Warp Speed. So we became like PPE experts and advanced technologies to combat COVID.
(1:02:13 - 1:02:30)
And I ran the Whiskey SIG that accelerated not just one technology a month, it became like two technologies every week. So I ran a pretty awesome capability integration group at the Pentagon. So I'm a little familiar with healthcare.
(1:02:32 - 1:02:48)
And it's very important to me that we get it right. In fact, at the last minute, another Undersecretary at the Council, at the HHS, Mr. Cariello, he couldn't make it here. But you know what? We have the great Chuck Brooks, okay, who's gonna be doing a keynote.
(1:02:49 - 1:03:00)
World leader in cybersecurity, Brook Consulting, Georgetown, a professor, a great friend of mine. I would like to welcome him with a round of applause. He's one of the best in the world.
(1:03:01 - 1:03:23)
Come up. Chuck, over to you, Chuck. So yeah, but after the presentation, we'll have the panelists come up, okay? So this is gonna be a presentation and then panelists come up.
(1:03:24 - 1:03:37)
Panelists can actually come up already if you guys wanna stand up here doing a presentation, but probably, is that a good idea? Yeah, let's get the panelists up here. Let's get Jose. Okay, let's get, you know, let's get, let's get Trey.
(1:03:38 - 1:03:48)
And let's get, well, Chuck is already up here. And then we'll go ahead and have the virtual Dr. Hawk. And I think we have somebody else coming online.
Keynote: Chuck Brooks
(1:03:48 - 1:03:53)
So go ahead, Chuck. Thank you, Nino. And thank you for Carahsoft, too.
(1:03:54 - 1:04:13)
Pleasure to be here in a really important topic right now. A really important topic, I think, with AI basically changing the whole identity space and healthcare already being one of the biggest target areas in cybersecurity. The confluence is a really important issue.
(1:04:14 - 1:04:34)
And so today, I wanna speak about identity as the mission perimeter and how healthcare and critical infrastructure, the age of autonomous AI and quantum threat horizon has become really the front line. So what this speech is about is really three things. One is to set the threat.
(1:04:36 - 1:04:56)
Healthcare, obviously, has been a top-reached target. It really was exacerbated during COVID where attacks went up 800%, particularly ransomware attacks. And the attackers found that the healthcare arena was a very easy target because it was hardly defended at all, very little money spent on security.
(1:04:56 - 1:05:12)
Almost none. It was second thought, more focus on procuring the right medical equipment and taking care of patients. So primarily, the attackers knew this, went for big ransomware attacks, and still going to this day.
(1:05:14 - 1:05:40)
The control plane, ICAM, what this is all about is deciding who, what human device or agent can touch PHI clinical systems, mission systems, and under what conditions. This is being defined in a lot of the NIST operations right now, but it's still a very new area. And of course, the hand-in-the-room test, which is the five-word questions.
(1:05:40 - 1:06:03)
If a hospital agency or a D1B prime cannot answer them, then zero trust is just a slogan. We've heard a little bit about zero trust right now, but really, this fits in the whole discussion of what zero trust is because it's another element of it. So we're in really what is the most consequential period in technological convergence in history.
(1:06:04 - 1:06:41)
We've had a lot of industrial eras, but none of them are at the speed and pace and the disruption right now that we're seeing, particularly with quantum, particularly with AI. So we're seeing exponential innovation, which is a capability that compounds faster than our ability to govern it, and predictive precision now, models that can anticipate what our next move is and theirs, and it's become an intelligence adversarial issue too. And then we're seeing this transformative efficiency, sometimes inefficiency that happens with workflows that take teams that now run as agents rather than as people.
(1:06:41 - 1:07:11)
So AI is already inside the model-based systems, the autonomous platforms, IOT infrastructure, and quantum programs, and every leap in capability expands vulnerability. So technology is a two-sided coin, as we know, there's the good and bad, and unfortunately, it's asymmetric because in the cybersecurity world, attackers have advantage. They have the whole ecosystem to attack, and most of it is vulnerable, and most of the companies out there, particularly, don't have any adequate defenses.
(1:07:11 - 1:07:26)
So the gap is really not invention. The gap is identity, authority, and revocation at machine speed. So this has been another banner year for healthcare breaches.
(1:07:27 - 1:07:42)
2025 opened the file, but 2026 has changed the map. There's already been 124 million healthcare records exposed, and most of this has been through ransomware. You've seen the biggest one, of course, change healthcare that happened a couple years ago.
(1:07:43 - 1:08:00)
It's still going on. Kaiser, the regional network, supply chain, and claims and imaging. Basically, every week, there's another breach and another ransomware attack, and unfortunately, most of these, basically, healthcare facilities and hospitals still are paying the ransomware.
(1:08:00 - 1:08:27)
Whether they admit it or not, they're still doing it because they have liability issues, and unfortunately, we don't have the capabilities and the deep pockets to understand that we're encouraging the attackers to just basically sell the information and give it to other threat actors. So a breach is no longer a privacy event. It's really become a clinical event because it impacts every aspect of the healthcare ecosystem.
(1:08:27 - 1:08:45)
The first clinical is ambulance diversions, delayed surgeries, diagnostic outage, EHR darkening. You've also got the financial aspects now, of course, with the ransomware, but insurers also absorb the cost of it. The downtime for patients and equipment.
(1:08:46 - 1:09:05)
Notificational recovery is already on the margins. There are a lot of variety of networks that could be affected in one breach, including the patient, the administrators, the people that are working in facilitating equipment, the nurses, the doctors. So healthcare is a really great target for a lot of these adversaries.
(1:09:06 - 1:09:19)
And of course, you have the regulatory, which has always been complex in healthcare. There's always pressure compounding with privacy. NIST, CISA, and HH-405B identity is now really an object of audits.
(1:09:20 - 1:09:38)
It always has been, but even so more so. So there's really, in terms of healthcare, there's really six vectors in really one control plane. The first is agentic AI, autonomous recon vulnerability, chaining, hyper real phishing, and deepfakes into clinicians.
(1:09:39 - 1:09:50)
It's increased in capabilities every year over. Actually, the deepfakes now, with tools on the dark web, are very simple. You don't have to be a cyber expert on this.
(1:09:50 - 1:10:12)
Anyone could do it, and it's becoming much more of a way of doing business. You don't get the, basically, the phishing hacks anymore, saying you've won a lottery, or you have a lost relative, and you have a million dollars. You have, basically, phishing with your doctor's brand on it or your hospital brand on your company or Amazon brand on it, and it's very sophisticated.
(1:10:12 - 1:10:36)
They use social media to do social identification of where your weaknesses are, where your strengths are, and so agentic AI has really become a differentiator for adversaries. Of course, ransomware, which I mentioned. Nearly half of the healthcare breaches are still ransomware, and they've been hitting everything from diagnostics to EHR and the care pathway, so it's really a problematic issue that has not gone away.
(1:10:37 - 1:10:48)
It's just really been hitting. And then, the biggest issue, I think, in terms of any cybersecurity issue, has always been supply chain, because you have a lot of different vendors in a supply chain. All of them don't have the same capabilities.
(1:10:49 - 1:11:08)
All of them are not operating on the same security, so with billing, imaging, telehealth, EHR vendors, there are a lot of entries in the supply chain in a cascade, and one is breached. And usually, they'll find the easiest entry. Hackers now use AI, basically, to discover those entry points, too.
(1:11:08 - 1:11:16)
And of course, when you're talking about entry points, you have devices in IoT. We're everywhere now. Most of them don't have security.
(1:11:16 - 1:11:31)
People leave the same default passwords on them. You have unpatched pumps, imaging, monitors, legacy gear with no encryption and no authentication. So these devices are an easy way in, and they have been used in numerous attacks.
(1:11:32 - 1:11:49)
And then, of course, you have the other problem, which is either the intentional insider or the inattentional insider threat, which happens all the time. Malicious insiders will have a vendetta, or they wanna misuse their credentials, et cetera. There's a lot of problems in the health area.
(1:11:49 - 1:11:58)
It always has been, and there's also a lot of other things. It's just misconfiguring. People doing it accidentally or leaving something open, a backdoor open for an attacker to come in.
(1:11:58 - 1:12:20)
So all those insider threats are often difficult to discover, but AI, in that sense, is helping to discover it. And then, we have the biggest thing, which is interesting, because I mentioned Aaron Bishop about almost a little less than a decade ago. I formed an organization with him called Climate Security Alliance with him and Dr. Merrick Watchhorn.
(1:12:20 - 1:12:45)
And we were looking at the climate threats to national security. And it was going pretty well, until they got called into duty, and Aaron became CISO of the Air Force, and Merrick went with him. But this issue is really now basically bubbling to a new level, which we're calling the quantum harvest, where nation states are really collecting, harvest now and decrypt later, and primarily China.
(1:12:46 - 1:13:00)
China has been basically nonstop instilling our credentials information. It started a long time ago with OPM, but it's not let up. And recently, they also were able to break into Pentagon files and FAA files.
(1:13:00 - 1:13:18)
So it's a real issue, and I'll get into that a little bit more about quantum when we get to it. But the bottom line now is that what was par for the course, the passwords no longer define identity, and nodes do. It used to be you had to rely on a password and use it over and over until that changed pretty rapidly.
(1:13:19 - 1:13:56)
But every node has to be tracked continuously. Modern threats live in the space between the workloads, and behavioral analysis is no longer optional. So what we're looking at is the human profiles, the employees, the clinicians, the privilege administrators, external users and partners, and machine profiles, right? Because in a zero-trust environment, everything is a threat, right? So you have the workloads, the containers, the APIs, the microservices, edge IoT, and the OT fabrics, and also now you have the agentic agents too, which are multiplying in capacity at exponential rates.
(1:13:57 - 1:14:13)
So the identity sprawl across cloud, legacy, and third parties is really the systematic risk we're facing nowadays. And now with agents particularly, it's become much more of a higher risk. So ICAM has really become the trust layer, and that's why we're all here today.
(1:14:13 - 1:14:40)
It decides who can access what, when, and under what considerations, what conditions. So the aspects of our, of course, the clinical dependence, EHRs, devices, telehealth, function safely on verified identity, the zero-trust control plane, the continuous authentication, adoptive access, wrangler privilege, identity as a switch, patient safety. ICAM is no longer just an IT function, as I mentioned on an earlier panel.
(1:14:41 - 1:14:47)
It's an operational resilience imperative. And that's one of the things I would like to stress right now. That phrase right there really says it all.
(1:14:47 - 1:15:05)
It's all about resiliency now in today's environment with AI and quantum soon. And compliance, of course, the compliance issues in healthcare have always been very sophisticated in terms of that. HIPAA, HHS directives, federal zero-trust mandates, and they all terminate the aspect of identity.
(1:15:06 - 1:15:25)
So that's where we're going to, identity is the focal point. So the first domain to modernize needs to be identity. So now we're looking at priority, which I think is in three years now, you have to have quantum-safe credentials if you're going to be doing business with the government, post-quantum proof, resistant algorithms.
(1:15:26 - 1:15:55)
So there are many identity anchors along with keys on post-quantum protections before the record set was harvested. And people have been debating when this will happen. There are a lot of people that say that, well, it's just an issue, that they're not going to be able to decrypt a lot of our standard encryption in the EDC or RSA, or 556, but there's others in the intelligence community that said, they've already done some of that with AI alone.
(1:15:55 - 1:16:13)
And now with the quantum devices, not needing to be a gateway computer, but really being something that's running on a minimal or a hybrid commercial classical computer with a computer device. Some are saying that this could be done almost immediately, even a D-Wave computer could do that. We're at a risk area, definitely with quantum safe credential.
(1:16:14 - 1:16:27)
And looking at the behavioral analytics again, that's all watch identity in real time. We need that anomalous condition device, API and agent activity. You have to look at the analytics to be able to see patterns.
(1:16:28 - 1:16:37)
You have to understand the credential lifestyle. The conditions, devices and APIs cannot carry immortal credentials. You have to look at them and rotate them, bind them and know when they expire.
(1:16:38 - 1:16:53)
And of course, the governance anticipates all that, needs to be implemented. You have identity policy written for the autonomous that we now face and the cryptological disruption that we're potentially facing soon. And so not rely on last year's policies or technologies.
(1:16:53 - 1:17:04)
It's really not a static issue, it's a continuous issue. So if it can act, it must be identifiable, authorized and revocable. And this is really what we're talking about with agents.
(1:17:05 - 1:17:14)
They're now being able to plan and reason independently. They can execute remote programmatic workflows. They can write dynamic code, bad coding and query production databases.
(1:17:15 - 1:17:23)
They can coordinate with other autonomous sub-agents. And so this changes the whole system of requirements. You have to require unique cryptologically signed identity.
(1:17:24 - 1:17:37)
You have to have low bound authority, bringing these privates in there. You can make sure that the right people could only operate as administrators. You have to continuous behavioral checks and session validation, always being observing.
(1:17:37 - 1:17:54)
And you have to have immutable audit of every execution step. So this is a good thing with AI because that enables a lot of this. So again, as I mentioned, AI has pros and cons, but in this area, certainly with ICAMP, it's definitely an asset.
(1:17:55 - 1:18:11)
So the legacy model of assumed trust, that model is now retired. It was the castle in the moat, the firewall, VPN, cloud, identity, zero trust, AI augmented defenses are now really what are necessary. It's really a multidimensional aspect.
(1:18:11 - 1:18:24)
The first, and going back to really what NIST says, is never trust, always verify. Continuous validation of identity and state. Least privilege, again, access bound to the role, retarded right now.
(1:18:24 - 1:18:37)
Continuous monitoring, posture and telemetry, not a login event. Microsegmentation, workloads isolated so that lateral movement dies. Really important and still one of the most effective ways of ensuring cyber security.
(1:18:38 - 1:18:52)
And assume breaching. Designed as a perimeter has already failed. And in most cases, it will have failed at one point because the technology is advancing so quickly that you continually have to rely on upgrades and understanding whether there might be a vulnerability.
(1:18:53 - 1:19:06)
And no one's totally not vulnerable. So the pipeline trust framework is identity ingestion. And this is important as companies and governments and any organization looks at what they have to do to prepare for the future.
(1:19:07 - 1:19:24)
Identity ingestion, baseline verification of every entity before a session exists. You have to have context evaluation, location behavioral template, the hardware footprint of the device house. And the authorization broker, the session bounds, how it's set dynamically, it's not from a static role.
(1:19:25 - 1:19:38)
You have to have the policy decisions built in, risk models that score the request, not a yes from the year 2019 or 2020. You need enforcement. Microsegmented controls isolate the path at the moment.
(1:19:38 - 1:19:51)
And you need the telemetry loop, which is a live signal that returns to the analytics engine if trust is re-computed. So again, it's a system. So this is, again, we're talking about quantum again.
(1:19:51 - 1:19:57)
And again, it is not science fiction anymore. Quantum computing exists. It already is in a platonic state.
(1:19:58 - 1:20:08)
We're dealing with light. Some of what are known as the big quantum gateway computers are maybe a few years off. And a lot of the biggies are working on that, of course, with Google and Microsoft out there.
(1:20:09 - 1:20:25)
But a lot of quantum technologies and algorithms and sensing already are here. So it doesn't take a lot of qubits in a parent lab system to actually have something that's commercially viable. And again, D-Wave has proved that, and a few others have done that.
(1:20:25 - 1:20:37)
And we're largely getting, if you follow quantum, and I have to, because I teach a course called Disruptive Technologies at Georgetown, it changes every month. And there's always a breakthrough. It's a global issue.
(1:20:37 - 1:20:47)
And Japan just made a breakthrough on qubits. So I mean, a lot of this, and the stability of it, and the error recognition. But it's getting, the timeline is really basically condensing.
(1:20:48 - 1:21:03)
So quantum computing's on the horizon. As I mentioned before, the big issue now being discussed, and it's not premature in my view, it's a few days where George's algorithm will be broken with classical public-grade crypto. The Harvest Node, the Cryptolator, is already underway.
(1:21:03 - 1:21:11)
And so it's really an imperative. You know, it can't be like cybersecurity was. Initially, it was NORT, looking at it as a cost item.
(1:21:12 - 1:21:33)
Quantum, and when it's basically fused with AI, will be a superpower. And again, this new super artificial intelligence, so TESS was created this week at DOW in the White House, you know, sort of acknowledging that. And if you look at a lot of the innovation coming in quantum and AI in the last years, we're realizing that we're not alone in this quest.
(1:21:33 - 1:21:39)
China is very advanced. They've already demonstrated quantum entanglement with satellites. And there's a lot of competition here.
(1:21:40 - 1:22:04)
And so, you know, we cannot, not to have to say there's one big differential between past innovations and industrial evolution, is that this one is happening so much quicker. And that the rapid reaction time is much slower. And that means that other nations that are investing a huge amount of money and effort and people into these efforts is no longer the case where we can sit back and say that, well, you know, we have it, you know, our private sector will catch up, we'll do whatever.
(1:22:05 - 1:22:18)
We really take the public-private sector effort in quantum computing and in AI to really keep pace with the threats out there. And thankfully, I think the government is realizing that. But it's not an easy issue, it's a process.
(1:22:18 - 1:22:34)
And we haven't ever been in this position since the Manhattan Project, I think, in terms of really having to develop this kind of capability. And I would add space into the third element of that, too, because we're now becoming much more capable in terms of our communications and monitoring. And that's really important, too.
(1:22:34 - 1:23:09)
Really, the next frontier is now the high frontier. So, really, basically, the takeaway for quantum and healthcare is that the same physics that accelerates care is gonna retire this current encryption we have now. And so, you know, it's gonna affect everything, the discovery, the molecular simulation, classical machines cannot run, genomics for thin folding, personalized medicine will be changed, sensing, biomarkers will have new sensitivity, earlier signal or neurological diseases and cancer, metabolic disorders, sharper imaging, all that's already happening right now.
(1:23:10 - 1:23:33)
Protection will need quantum-safe crypto for long-lived records, genomics sets in research archives, HIPAA-aligned zero-trust depends on it. And so, agencies that really prepare now for the breakthrough and the threat are really an imperative in waiting as a collection strategy for someone else. So, the message here is urgency and full speed ahead.
(1:23:34 - 1:24:13)
And so, the five questions I said to basically put this all in perspective for a board or a company, if the answer is no, the architecture's not ready. And one is, can we uniquely identify every agent, device, and person in the network? Can we continuously authenticate every layer of artificial intelligence? Do we govern the training sets of our models that we actually use? Can we explain the decision in an autonomous asset execution? Can we revoke model access at the moment of an incident? Because if you don't do it at the moment of incident, it's too late. And I would say that probably nine out of 10 companies will fail that question.
(1:24:14 - 1:24:23)
So, the bottom line is that trust is no longer a destination. It's a continuous process. It's about identity and the runtime security perimeter.
(1:24:24 - 1:24:36)
Continuous validation replaces one-time authentication. AI is the attack vector and the defense scale. Zero-trust is the operating bedrock, not an edge feature and required.
(1:24:36 - 1:24:49)
So, even though most companies haven't gone that way, it is really what we need to do. And zero-trust, again, is a mission changing. So, in the age of AI, trust is no longer a static destination.
(1:24:50 - 1:24:56)
Continuous relentless process. And now it's over to the panel. Yes, thank you very much and applause.
(1:24:58 - 1:25:17)
Well, everything that we're doing for identity, as we've seen, healthcare, financials across the board, it's really, thank you very much for one of the world leaders. Fortunately, as a tech scout over the years, we have to be on top of it. Everything is changing, moving daily, exponentially.
(1:25:18 - 1:25:28)
So, we're preparing for this quantum leap and we talk about it all the time. Let's have some questions real quick. We have five minutes before we switch it over to Trey.
(1:25:28 - 1:25:56)
Any questions directly to Chuck as a world leader in his field? Any questions? Too bad, right? We were talking about Q-Day. I know some things are already pre-harvested and there's a lot of scenarios for what could happen with Q-Day, whether, you know, we discover, the adversary discovers it. But let's just say, you know, Q-Day happens tomorrow and there's an adversary that discovers it.
(1:25:56 - 1:26:08)
What is the protocol? What exactly happens? Well, we don't know exactly what happens. I mean, in government, they do have a process for it, right? You know, we did that with Y2K too. I've prepared for it.
(1:26:08 - 1:26:13)
And there is some incident response issues right there. And a lot of stuff is already being segmented. The key stuff.
(1:26:13 - 1:26:19)
But I think the real problem is critical infrastructure. And a lot of that is vulnerable. Most of it's in the private sector.
(1:26:20 - 1:26:25)
You're talking about the financial institutions. You're talking about healthcare. You're talking about transportation.
(1:26:25 - 1:26:37)
It could be a calamitous situation, depending upon who does it. I think the Chinese have already been probing a lot of this critical infrastructure over and over. And we've underestimated them vastly with the hypersonic issues.
(1:26:38 - 1:26:45)
And basically, they've been able to steal a lot of our IP. They've gone to Silicon Valley, to universities. They're everywhere.
(1:26:46 - 1:26:56)
And they have a mission and they have basically a strategy. And we're in the lack in reacting to it. So I think it could be much more devastating than people realize.
(1:26:57 - 1:27:10)
The other, to add to that, that's why we have zero trust and we have federated systems where not everybody gets affected at the same time. So we're trying to protect all these systems in real time with all the capabilities. And actually, I'm thinking offensively.
(1:27:10 - 1:27:38)
So that's just me. Yeah, do you think insider threat is more relevant than the quantum threat? If you look at basically the statistics, insider threat has always been the number two threat behind phishing in terms of cybersecurity. It is easier now to discover because of AI because it can recognize behavioral anomalies much quicker than before.
(1:27:39 - 1:27:55)
And you can look at stuff that's just not supposed to be done in the network. The problem is that, again, that takes strategy and a framework and most companies don't do it. So in a practical term, right now, insider threat's more of a threat to current operations in companies than quantum.
(1:27:55 - 1:28:14)
But I think in the near term, in a few years from now, that quantum will eclipse that. Any other questions? Okay, let's switch it over to the moderator. I'm gonna welcome Trey Rutlisch, who is the president of Brilliancy Quantum and Health.
(1:28:15 - 1:28:29)
He is a world leader in quantum and AI. They're doing phenomenal work over the last couple years, building some incredible systems, specifically dealing with this threat that we're talking about. Over to you, Trey.
(1:28:30 - 1:28:34)
And I'm gonna join the panel. Thank you, Nino. And thank you, Chuck.
(1:28:36 - 1:28:53)
I guess a few of our panel are gonna stay with us. We also have joining us Greg Hayward and Robin Kopp will also be with us. Greg and Robin, you can hear us, I take it? Yes.
(1:28:53 - 1:29:02)
Okay. So I'm gonna do reintroductions of our panel guests just to kind of reiterate their prowess. We've got Jose Villanos, MD.
(1:29:03 - 1:29:20)
Jose is founder and CEO of Nimbus Global and also the inventor of Nimbus PID, a passwordless biometric identity and authentication platform. He's a physician by training, but he bridges healthcare and cybersecurity. Robin Hock joining us virtually.
(1:29:21 - 1:29:30)
Robin leads Galaxies LLC. They are developing quantum photonics, optical networks, and power system. We also have Greg Hayward.
(1:29:30 - 1:29:47)
He's also joining us virtually. Greg is the founder and CEO of Trackable Health AI, a real-time readiness platform that turns wearable data into health insights for service members, first responders, and high-performance teams. You know, Marc Antonio, CEO of Marc Antonio Global.
(1:29:48 - 1:30:01)
And you just heard from Chuck Brooks, president of Brooks Consulting International. So the rules for the panel, the first round of questions will be two minutes. For each answer, the second round will be 90 seconds.
(1:30:02 - 1:30:11)
And the third round will be a lightening of 30 seconds. So Chuck just gave us the frame. You know, identity is the control plane.
(1:30:11 - 1:30:18)
Authorization has to be continuous. And crypto agility starts now. Let's run the chain from the point of care out.
(1:30:19 - 1:30:36)
So I'll start with you, Jose, Dr. Villanos. As an OBGYN, you obviously understand the workflow inside the clinic probably better than most. So the patient data moves from EMS to the hospital, then to the clinic, then to revenue.
(1:30:36 - 1:30:58)
From the point of care, how do you prove who and what touched it at each step? And where does the chain break most often? Well, that's a really very specific question. When we're dealing with healthcare, there's some major problems. You have a hospital system that has the internal ID of a user at the hospital, then subsystems that have IDs.
(1:30:59 - 1:31:28)
So when you actually process and take care of somebody, you create a bill called a HIPAA 1500 form that actually has primary insurance, secondary insurance, NPI number, this is a critical one, CPT code, diagnosis code, and then that information gets submitted in order to be processed by a third-party administrator who now tells you you're not getting paid what you billed at getting paid 30%. And that's what's crazy in healthcare. It's like they're screwing the whole system.
(1:31:29 - 1:31:42)
So right now in healthcare, let's think about identity. Social Security number, NPI number is the tax ID number for the doctor. The government says do not share your Social Security number because criminals are then creating credit cards.
(1:31:43 - 1:31:56)
CMS actually has published a five gigabyte file with every NPI number. And what they've done is given criminals half the equation for submitting fraudulent claims. $5 trillion a year, 20% of its criminal activity.
(1:31:56 - 1:32:23)
What happened in Minneapolis and Los Angeles, they have access to submit claims under your tax ID number. And there was a doctor out of Los Angeles who's like 80 years old, moved to Arizona, and they were using his tax ID number billing like $25 million in one year that would go under your tax ID that you'd have to pay taxes on. So to look at the logistics of this, we're talking about identity, voter citizenship ID.
(1:32:23 - 1:32:40)
What is it, your driver's license ID? Your passport? No. So there has, identity is a very critical factor from the top down. So when you think about your mobile phone has every microprocessor has a UUID, a universal unique ID.
(1:32:40 - 1:32:56)
The API system for that issues a million UUIDs per second for 100 years before you get a duplicate. Nimbus is using that to create an HUID, a human unique ID. So every human, every plant, every animal, every insect could potentially have a UUID.
(1:32:57 - 1:33:14)
So this would actually make sure that when you're talking about IDs across systems, your bank and things along those lines, we're actually able to make sure that it's really you that's connecting at the highest level to those other identities across the system. Thank you. Greg, this one's for you.
(1:33:15 - 1:33:33)
Chuck said point in time authorization can't keep up with systems that change. Policy on paper is not performance. When wearable data feeds a readiness picture, what do you capture at runtime so a commander or a clinician can trust the data and verify the control actually works? Thank you.
(1:33:33 - 1:34:07)
We are utilizing flip-through devices so the data that's transmitted from the device to the vendor, then we use an open breadboard to pull that data down and we put it in a AWS DevTox S3 bucket. So it is IL4 and IL5 compliant. And right now we are pursuing our APR or FedRAMP compliant that need to be done to make it as hyper secure as possible.
(1:34:07 - 1:34:43)
So the problem would be if we had a bad actor in the system, they could make it look like people were unready to be deployed at scale. And obviously, if a commander comes in and sees that 90% of their personnel is not ready or fit to be deployed, that really seems an ugly picture. So all the inverses to where people that are not ready to be deployed are expecting help, feeling healthy and ready.
(1:34:43 - 1:35:07)
So we really need to be accountable to make sure that the data is accurate and how we do that on a daily basis is the human in the room. Our engineers wear these devices and they check their scores against what they are seeing on their devices to make sure that we're alive. Excellent.
(1:35:08 - 1:35:17)
So Nino, this next one's for you. You opened this panel and you also lived the surge. Chuck said one compromised dependency reaches patients nationwide.
(1:35:17 - 1:35:49)
In 2020, you pivoted from your Navy work with groups and focused on OSD, PV, TIP on the COVID-19 response and Operation Warp Speed. As the world went dark for a year, under that kind of surge, what breaks first in identity and trust and how did you deal with the PPE fraud? Yeah, so I lived through it and we all did. We saw that, however you wanna look at the urgent pandemic that took place within those years, there's a lot of fraud attached to it.
(1:35:49 - 1:36:21)
So people became really clever on tapping into PPE fraud and I saw it in real time happening and you can't really protect against it because China or some of our other adversaries internal or external, they were using exactly the identity and this is exactly the problem that we saw. So we're preparing for another wave of that but we gotta be able to look at the lessons learned. As you saw millions of dollars being given out, now they're kind of looking at it in a, looking back and you're like, wow, these are like billions of dollars.
(1:36:21 - 1:36:47)
In fact, if you look at this administration talking about it, they're like, they're highlighting that. And it's not like something that's like, this is, it's not about like the other party, it's about money that was actually stole because of this problem. If we can go ahead and ask, maybe I'm gonna go ahead and have XSCS from CISA talk about this exact problem to strengthen my comment.
(1:36:50 - 1:37:15)
Yeah, no, thanks Dino. I think, yeah, I mean, obviously the amount of fraud that's going on right now is really hurting us as a country. I think the ability to manage identities, to prove who you are, I'm really interested in some of the tech that Jose is talking about, as well as some of the tech that Ted is talking about when it comes down to proving he's a human and not.
(1:37:16 - 1:37:43)
I think a lot of times, especially now, algorithms are gonna get very good at kind of mimicking identities, digital identities. How do we start to think beyond that and get 10 years ahead of where the tech is now? So we start thinking about things like, how do we start proving that people are human and not actually agents impersonating us? Thank you. Robin, this question is for you.
(1:37:44 - 1:38:18)
Chuck's zero trust model verifies every access, including device and critical infrastructure where no, where do identity and access control be to live at the physical layer, devices, sensors, network nodes, not just user logging? Okay, so hardware. We don't need to discuss how hardware works in the network, especially in the medical environment. So the identity is on the chip itself.
(1:38:19 - 1:38:38)
The chips are operated by the battery. If you're tied to the grid, access doesn't happen and drop down doesn't happen. And so what we need to do is be autonomous in part, so it's not just time, but the identity nodes on the device itself.
(1:38:38 - 1:38:58)
And it is accessed in a whole piece prior to it becoming software. Software identity is obviously the most standard human intelligence could be out in the office. There are two things, which all of the identities are based in transposing from one identity to the other, or at least the current identity.
(1:38:58 - 1:39:25)
So the transposing is one standard identity. It rests with the differentiation of identities, such as people's identified identities. Some of the access controls are used for interviewing and teaching at a college in the United States.
(1:39:25 - 1:39:42)
This includes medical, industry, the use of real-time science and other kinds of tools. It's not about control systems, it's about the changes themselves. So the S-nodes have been tested pretty much through the lab.
(1:39:42 - 1:39:55)
It's been done with AI, as you said. And as far as human logging, here we have two new factors available. At the same time, there is a process that can happen.
(1:39:55 - 1:40:17)
I don't know if you all have heard of EMAS, but I've just been interviewed and talked about brain-to-brain interfacing, and brain-to-brain relationship, because I've been trying to sort of have a very clean view. Hi. Brain-to-brain? Brain-machine interfacing.
(1:40:18 - 1:40:26)
Yeah, no more, but, yeah. Go ahead, go ahead. So, Chuck, this one's for you.
(1:40:27 - 1:40:58)
You landed on crypto-agility. Which identity and protection mechanism are hardest to swap out without breaking clinical workflow, and what's a small security team's first need next year? Well, I'll start with the latter part, because that's really risk management, right? You have to know what's in your inventory, and that's what crypto-agility is required. So you have to look what type of encryption, what type of other sources you're using to protect your data, and then you have to inventory and see if they're actually applicable to the new era, and look what your gaps are.
(1:40:59 - 1:41:15)
The second thing you'd have to probably do is understand what data you wanna prioritize protecting, because not all data's the same. And with medical records, there's certain things that may last a lifetime and more, and those are the ones you really wanna look at. And so I'd have to go back to say that the first really step is risk management.
(1:41:16 - 1:41:33)
You have to have a policy in place and understand it, and you have to learn before you do anything, and I think that's an imperative for anyone looking at any kind of security, but particularly with healthcare. So we're gonna move to the cross panel now. We'll have two answers for each question.
(1:41:33 - 1:41:55)
First question, when an AI agent requests a patient record on a provider's behalf, how do we establish who authorized it, whether it was permitted, and who is accountable when it causes harm? Dr. Jose? Boy, that's a really good question. The way we're looking at it is the following, like I said. Everything has an ID number.
(1:41:55 - 1:42:25)
We're talking about devices and, as we were saying, software, but we would start with a logistics in which we're calling the Nimbus Key TID, transaction ID, in which you have a company ID, a admin ID, a user ID, an AI agent ID, an AI agent permission. So you have a list of permissions. You can only do X, Y, and Z, not the others, right? So a permission, a subject ID, and then a digital signature and a date and timestamp.
(1:42:25 - 1:42:41)
So you can put that on the blockchain or you can actually put it on a data system, but you could actually actually encrypt this into something totally different. When you think about a QR code, a QR code just has text in it. So if you have a URL to a menu, the rest are not a big deal.
(1:42:42 - 1:42:50)
But encrypting it, you have an ID number that's 16 digits long. When you encrypt it, it turns into 250 characters. You put the ID of that database system.
(1:42:51 - 1:42:56)
Every file has an internal ID number. You encrypt it. You put it into the data system's URL and into a QR code.
(1:42:56 - 1:43:16)
When you scan it, it takes you back to the data system. It decrypts it and shows you the invoice. I was on X9.org, the cybersecurity team to banking, and we actually created a document called X9.148, X9.140, where we're mandating globally that bank-to-bank transaction with the QR codes actually use our patent on encrypting an ID number from a database file.
(1:43:16 - 1:43:34)
And we're looking at the supply chain, SAP, and some of these big players in which you'll be able to prevent fraudulent manufacturing. If you have a barcode on a $25,000 pacemaker, guess what? The Chinese will make a million over the same barcode and you'd never know it's real fraudulent. Ours, you'd have an encrypted ID that when you scan it goes back to the data system.
(1:43:34 - 1:43:41)
They decrypt it. You press the button, it was delivered. If you get a second one, it does the same thing, goes back and says, that one was already delivered three months ago.
(1:43:41 - 1:44:07)
So we're doing some really cool things in that regard in which we're talking about major problems in finances, in payments, in healthcare, and now the world's going AI, the world's going cryptocurrency, which is a good thing but a bad thing. We're not ready for these things, and we need to be ready. Nino, do you wanna weigh in here? I'll just unplug it.
(1:44:10 - 1:44:40)
Go ahead, next, that's my answer. All right, so continuous ATO only works if security is built in, not bolted on after going live. Which identity and access decisions must be settled before go live? And with CMMC raising the bar, what should healthcare and critical infrastructure suppliers be held to? Well, the CMMC is actually a good starting place because it's now required of a lot of companies of most vendors doing the business of the Department of War.
(1:44:40 - 1:44:57)
It's in its different iteration right now. But the bottom line, it really goes back to the basics of understanding what cybersecurity is. And that requires every small business or every medium business and every prime to have the right qualifications to understand where the gaps are, what needs to be done, et cetera.
(1:44:58 - 1:45:10)
And so that is really the starting point for everything. It gives a framework and a programmatic way to do it. But then you're looking at, of course, different agencies and different industries require different kinds of security.
(1:45:10 - 1:45:17)
So there's no one size that fits all. And same with encryption, too. There's symmetric, there's asymmetric, there's polymorphic, there's lattice.
(1:45:18 - 1:45:34)
So I think what I wouldn't say that there's one type of identity protection. I think there's a lot of them. But depending upon the scale of what you're doing, depending on the sensitivity of what agency records you're protecting, and also what type of industry, if you're in intelligence, there's other ways of doing it, too.
(1:45:34 - 1:45:48)
So I would think that the priority, though, is understanding that it's needed, and to then go out and explore what options you have available. I'll take, I'll add on to that. So since my previous was very short.
(1:45:48 - 1:46:08)
CMFC reform, artificial intelligence, you can literally have a system that will absolutely control every single node of your security. Throw a quantum in there, you can really build systems that are, you don't need all that nonsense of spending six months to try to get across all of the requirements. With AI, everything changes.
(1:46:08 - 1:46:25)
I got 12 agencies working right now that are rebuilding my computers, putting cybersecurity at levels that are, at the highest level that are not even known to any sort of standard that's out here. You just tell the AI what to do. Make sure that it's trusted, make sure that it's built the right way.
(1:46:25 - 1:46:47)
Make sure that you've built your agents correctly, and you have, you know, you can always unplug it. Make sure that it's federated, all that good stuff. CMFC reform is moving faster at the speed that we need to move, because if we don't, we're losing, we're beating ourselves with the bureaucracy that we built for ourselves to keep status quo.
(1:46:47 - 1:46:56)
We gotta move faster. So we can actually leverage artificial intelligence for good, but we also need to be extremely secure, and we can go down to the basics. We can do the basics a lot better.
(1:46:56 - 1:47:07)
Did you tell them that CMFC was, no, they basically took apart, the second cask that they removed, but it's not on hold. I'm still going through the business. So Chuck is gonna tell us a little bit about that hold.
(1:47:07 - 1:47:17)
What does that mean? There's a whole CMFC, the CPTOs, that they're kind of bypassing. You still have to secure your system. So Chuck, do you wanna talk to that? Yeah, no, pretty much exactly what you said.
(1:47:17 - 1:47:26)
I think that it was moving so fast that most of the vendors are not equipped. They don't have the expertise. A lot of them are hiring outside managed security to basically do that, CMC applications.
(1:47:27 - 1:48:33)
And the second part was they weren't ready for it. So they basically decided rather than just wait for everything, let's remove that for now and address the critical issues, basically the basics with every company should be understanding and employing. Greg, you want to weigh in here? Yeah, the model needs to change to the speed of how things are moving with AI.
(1:48:33 - 1:48:47)
The model was a good, you know, I had a conversation with Katie Harrington. I was supposed to be here with IronQ. And, you know, Katie does not agree with removing some of those things that she's done.
(1:48:47 - 1:49:01)
Unfortunately, it's counterproductive when you have a model that people have to go ahead and, instead of going faster, you go slower. So that it's just a model change. And this is what Aaron was going to talk about, or Sisso, today.
(1:49:03 - 1:49:21)
So, next question. Stopping access is the control that matters in an incident. How fast can you cut off a person, a service account, or a device, or an agent, and what usually survives the first revocation? Robin? You're on mute.
(1:49:23 - 1:49:29)
Unmute yourself, Robin. There you go. Yes, completely.
(1:49:37 - 1:50:14)
There are 560 nanobits in the observable, and we took those from the identity. And then we took those out again. So, the worst of all access is when someone needs to get a new device.
(1:50:14 - 1:50:43)
And I think that this kind of technology, So, it would be very helpful, also, to address the medical issues with less priority. And this primary access control system needs to move out of what types of networks to where we let people know. So, we're really talking about optical technology.
(1:50:43 - 1:50:55)
We're talking about device identities. And we're talking about making sure that you don't stop a person's access when he's gone. It's different for all kinds of different types of network issues.
(1:50:55 - 1:51:00)
But the idea is, get rid of the device. We always want to get rid of it. And this is how we do it at the city.
(1:51:01 - 1:51:16)
When you stop something in the middle of a task, you don't have to prevent the task from happening. You don't have to prevent it by, you know, you're just issuing a request to the device for a fee. You need to close the task.
(1:51:18 - 1:51:38)
New devices have a very fast and hardware system. I think that what we're trying to fix in terms of the legacy system, we're going to be dealing with very fast, many times, long-range capabilities is not going to be produced any more time. That's why I asked this question.
(1:51:46 - 1:52:03)
And I think it starts with space. And it needs to include the actual physical devices, especially those that we plan to use for our bodies, and also all these recyclable fibers. So, the influences, it could be anything.
(1:52:04 - 1:52:36)
It can be something like mobile phones, the mobile phone situation now, where it could be one attack from the 3,000 people in China to the massive number of people are in every day. So, we need to talk about mobile phones, mobile phone, and talk about how you have that layer, all of it, and say, ah, that's what happens. And we need to make it to the device now.
(1:52:37 - 1:52:48)
That's the way it is. And we have to deal with that. Great insights, Gabby.
(1:52:49 - 1:53:32)
We'll now open up the panel to the audience for questions. Any questions? Chuck, do you want to take this brain-machine interfacing question? I think it depends what type of wearable you're using. I mean, certainly, even smartphones affect our attention span, our dopamine, right? So, everything affects it.
(1:53:33 - 1:53:42)
And then, you know, auditory can affect your brainwaves. So, yes, they are. It's a question of to what degree, and you're the doctor, so I will get you to that aspect.
(1:53:42 - 1:53:52)
You're exactly right. Actually, there's a big concern of having your children actually playing with phones and, you know, putting it in their pockets and things like that. So, I shouldn't have my phone in my pocket, actually.
(1:54:01 - 1:54:10)
I don't have an answer to that. But, you know, we are concerned about some of these things that are happening. In fact, the phone system is going from 5G to 6G.
(1:54:12 - 1:54:48)
Let's go ahead and ask Robin about this. So, it is very challenging. It's not – there is no way to protect yourself from that.
(1:54:49 - 1:55:14)
So, we have to work on that. Magneto helmet? No, excuse me. I think it was called Havana syndrome you're talking about, too.
(1:55:15 - 1:55:41)
And, allegedly, the former director of the CIA, Jim Woolsey, who just recently passed away, said he was affected by that, that no radio waves were aimed at him, and the embassies, too, experienced that. You know, I don't – I probably do have ways of now putting – they're doing it through the windows of the embassies. So, I think there's ways probably to protect that.
(1:55:42 - 1:55:56)
But, with an individual, you can't really – you know, you can't wear armor. So, I'm not aware of any specifically, but I'm sure there is. I know there's sensors.
(1:55:56 - 1:56:10)
So, if you have sensor data, even an R-ring is a sensor. So, you could see how your brain waves are affected in certain situations. Well, the embassy, the employees of that embassy that were under that attack, and they really did have some serious, serious effects.
(1:56:10 - 1:56:25)
But we still haven't been able to figure out where they came from, where these waves came from. So, that's a frightening thing. For the panel discussion, so we're working with the cover depot.
(1:56:25 - 1:56:55)
So, this industrial Internet of Things, Internet of Things, this connected factory. Can you talk me through what the hospitals are doing in terms of the 5G networks and how they're protecting assets, the devices that are connected to those networks in terms of security protocols? Well, again, I'm not sure on that end because this is being advanced independently in each hospital system. The problem is we're dealing with Epic and Cerner as the main systems.
(1:56:55 - 1:57:12)
Epic is like in 80% to 90% of the hospitals. So, the doctors are doing the same thing, same thing over and over again. And the log-in to these systems, the question you're asking, I think they're still using the existing architecture.
(1:57:12 - 1:57:32)
There's nothing really more advanced. And like he was saying, that some of the devices, like you're in the ICU and they have an oximeter or any device, they don't have protection. So, the difficulty here is that you have a single sign-on process that connects to many things when you're going into the system.
(1:57:32 - 1:57:57)
Then you have a supply chain because what happened with Stryker, Stryker just got a cyber attack and they erased all of their computers of 45,000 employees across the planet. And all of a sudden, the hospital started to cut them off from their supply chain because the malware was going to get into those systems. So, that's the depth of what I understand with regards to Wi-Fi and some of the things that just seems like they're using similar technologies.
(1:57:57 - 1:58:27)
What we need to be able to do is protect their systems from the cyber attacks. Can I get the opinion of Robin Hawk on this? Well, once again, I want to get back to the hardware. We have to make sure that the hard drives are there and they're there as long as the devices are there.
(1:58:27 - 1:58:50)
So, we have to have a very accurate time tracking. We have to be able to let them use absolutely to the point where we want as close as humanly possible. We also now have to worry about the fact that 80% of all the attacks are around the world.
(1:58:51 - 1:59:13)
It's pretty much everywhere in the United States. We've stopped linking the Wi-Fi, which is a malware-type system, and started training our CTIs and our VCs in the United States. So, we've stopped linking it.
(1:59:14 - 1:59:29)
We're not really talking about a hospital or a facility. We're talking about individual devices on the street. We have to end talks with individual devices or with their friends and their partners out there.
(1:59:31 - 1:59:44)
So, these talks are meant to be trained, or they won't work that way. So, we've been thinking about all these talks around the world is number one for securing all the networks. It's number one.
(1:59:44 - 2:00:08)
And it's used by many, many folks. Our goal is to use software, processors, and drones, and mobile devices. And so, it's going to be a point where we might need a lot of AI to operate these networks because there's too much happening all at once and we don't have time.
(2:00:10 - 2:00:16)
I agree. I mean, really what we're talking about is security by design now. And I think we're in an era where we need to re-look at everything.
(2:00:16 - 2:00:38)
We're relying on legacy systems that are really obsolete and vulnerable, and I know that's a big push, but I think it's necessary. Yeah, so we also, over the last couple of years, working closely looking at the non-GPS capabilities across the board, we need to be less reliant on that. And exactly, AI and quantum come in.
(2:00:38 - 2:00:43)
Everything has kind of changed, and this is a really big, big problem. We're actually facing it. But, you know, we're working on it.
(2:00:46 - 2:00:58)
Any other questions from the audience? I've got a couple extra here. I wrote down as a backup. HL7FHIR makes it easier to share data across organizations.
(2:00:58 - 2:01:17)
How do we share more data without widening the attack surface? That's a really good question. The FHIR network is essentially an API connectivity in which it is the security still within the infrastructure, the responsibility of the infrastructure. And so they've added safe on FHIR.
(2:01:18 - 2:01:34)
Well, it's going to be on FHIR. You know the cyber attacks are actually a big one. So the critical component with regards to being able to understand the security connectivity, and what's happened right now is your medical information is in multiple locations.
(2:01:34 - 2:01:53)
And through the FHIR network, you'll be able to, through an API connection, be able to say, please connect me to my medical information at these different locations. But the security layer has not been placed on that, so it's independent. Apple says that they've already connected to, what is it, 80% of the hospitals in the country.
(2:01:53 - 2:02:17)
But you have to go into the hospital, set up a username and password, set up an account. So what we need right now is if you have medical information in five locations, you have a different ID number at each location. And you need to know that Tom Johnson, when there's 100 million Tom Johnsons or people with the same name, Mary Jones, you need to make sure that's the right person at that facility.
(2:02:17 - 2:02:28)
And the patient record matching is a nightmare right now. So that's where we've been focused on. A HUID, a human unique ID, for each individual, will then verify that it's me connecting to these systems.
(2:02:28 - 2:02:38)
And I want my AI system to pull all the data from those systems into a master record that I own. It's removed all the duplicates. So when I go to the doctor's office, I show them a QR code.
(2:02:38 - 2:02:45)
They scan it. I give them permission. Here's my past medical history, my illnesses, my surgeries, my medications, primary insurance, secondary insurance.
(2:02:45 - 2:02:51)
These are all my providers. And you'd have that in your hand. Because right now what's happening, these systems are not integrated.
(2:02:52 - 2:02:58)
They make money off the information. And you just had an MRI at one location. You had an emergency.
(2:02:58 - 2:03:15)
You had to go here, and they want you to repeat your MRI because they don't have access at the other place. So the duplication of effects and labs and the data is not being available. And the delivery of care is bad.
(2:03:15 - 2:03:29)
We're 56th in the world in perinatal mortality and morbidity. And as you know, we're spending a massive amount of money, $5 trillion a year, and our people are really unhealthy. And thank God they're changing the stuff that's in our food.
(2:03:30 - 2:03:36)
Kennedy's doing an incredible job. That's all I have to say. Let's make America healthy again.
(2:03:37 - 2:03:51)
Yeah, so HHS financial secretary wanted to come in, and he just couldn't because I caught him on a typhoon timeline. It was like 72 hours kind of thing. It didn't work out, but it's okay.
(2:03:51 - 2:04:06)
So he was talking about, again, how important HHS is and the DHA. Again, it all comes down to solving these problems. And I really think now I need to be quiet for a second.
(2:04:10 - 2:04:57)
Sure, go ahead. Retired Major General Vaughn, do you want to talk about the PI for a second, the kind of things you were working on? He's asking a question on some of the things you were working on, on detecting frequencies on human beings and how they affect the brain. Hi, Robin.
(2:04:57 - 2:05:01)
How are you doing? You can't see me on the camera, but I can see you. Good. You look wonderful.
(2:05:01 - 2:05:11)
Hey, really nice to be here, everybody. I'm going to talk later. But that was an important issue for several reasons and it's becoming more important now.
(2:05:12 - 2:05:30)
We don't know what we don't know. We had a rash of physiological episodes with fighter jets back in the 2017-18 timeframe, episodes of action scenes. We actually went to the Formula One race team to look at how they instrument their drivers.
(2:05:31 - 2:05:43)
And if you look at the suits they were in, the helmets and the whole cockpit, you know, they monitor the engine, they monitor the tire. We don't do that. We think we do.
(2:05:43 - 2:05:47)
We talk about it. We have physiologists. We do the SEND drive, which is the center feed.
(2:05:47 - 2:05:59)
I did that a few times. We don't truly put sensors on humans and monitor those frequencies. And so from a warfighting standpoint, there's a lot for us to learn.
(2:05:59 - 2:06:24)
Our adversaries are way ahead of us in understanding that. Now, I think they're doing it in a transactional way. How do we understand the frequencies within the human body, not just heartbeat, but all the frequencies? How do we understand that to increase performance for a certain purpose? But I think on our side there's an opportunity to understand it to increase longevity, to increase health, to increase people's quality of life, and then for us, things with warfighting as well.
(2:06:24 - 2:06:38)
So I don't have the answers, but I do know there's some folks. Dominic Galleo, is he here by chance? He's in DARPA right now. They brought him out of Silicon Valley to work in DARPA because he can tie in those kind of sandbox AQs.
(2:06:38 - 2:07:02)
Anybody familiar with them? Now, they're doing like the non-GPS navigation using magnetic waves on the Earth. They are, while they're using AI, to determine how do you navigate when you're completely RF-denied, how do you configure to do that, they are discovering things about humans at the same time. It's like, oh, my goodness, look at all the waves that are coming across us at every possible frequency.
(2:07:02 - 2:07:09)
So that's a long way of saying, I don't know. I have a question. We're talking somewhere.
(2:07:09 - 2:07:11)
Yeah, one second. Let me add. Yeah, go ahead.
(2:07:11 - 2:07:53)
If you could alter inside each atom, then make up the molecule, so that you'd be able to analyze the different frequencies that are taking place inside the atom. So the Nobel Prize for the neutrino is closer to everything. You can't stop them.
(2:07:55 - 2:08:08)
The adjacent work to the neutrino work is exactly precisely what you're talking about. Subatomic level, quantum level, what do the frequencies mean, what type of particles, energy, waves, maybe both. And now I'm getting into Robin's territory.
(2:08:08 - 2:08:18)
So let me defer to Robin because she actually knows this stuff. Some of it she won't disclose because it's proprietary, and I appreciate that. But this is one of the smartest couples that I've ever worked with.
(2:08:18 - 2:08:21)
They're way out in front of us. Go ahead. Hi, Robin.
(2:08:22 - 2:08:50)
Hi. So it's helpful if you can stop them. When you can stop these things, that's a matter of, and there are a lot of ways in which they're associated with things.
(2:08:51 - 2:09:06)
So you can't, I mean, there's a different sort of answer that you have to say to say why you should do it. So there's a lot of things that are happening. Is that what you're saying? Okay.
(2:09:07 - 2:09:12)
Anything you want to add to that? You don't know what I'm talking about. So that's another way. It's like a parallelism.
(2:09:13 - 2:09:18)
It's a quantum type of thing. So there's lots and lots of things. I have a question.
(2:09:18 - 2:09:35)
I'm just trying to figure out exactly what you're saying. So there's a difference between the classes you study, all the way up to the university, and then you want to know what you need to rely on. So there's a difference between quantum and quantum.
(2:09:38 - 2:10:08)
There's a lot of things that are happening. But one of the things you do know is that it is possible to attract a human brain and body with communication technology. And you know that AI is going to be faster than humans, and that if you have a very high chance that you will be able to find that person, it's going to stop.
(2:10:09 - 2:10:26)
It seems to me, I think, that if anything goes, it's probably going to go. There's a vector at the top that is called the electron. And this contains a number of devices.
(2:10:26 - 2:11:00)
And those are devices that use nuclear, or they're operating on an electron, or they're operating on the energy that you have in your body itself, which is good, and it helps in attracting data. So you can't just go and look at a vector electron with a heart rate meter, and you're never going to have a problem. But the person, the identity, that needs to be spotted in that image, what is the implant really? The implant is a human organ, which is a brain, a heart.
(2:11:09 - 2:11:20)
So that's part of the question. So a lot of people say, you don't know what you want to believe, and a lot of people don't know what they mean. I'm of the belief that privacy and security are the same.
(2:11:20 - 2:12:31)
So we need to know what security is. We can re-couple the identity from the system, and re-couple that on the other side, because it's very fast. So we're getting there, but I think the top thing is, can we speak to the idea of community, and the military is going now, and on this right now, are going to be able to sit on this line, and we will be able to access the system in a way that will allow us to transfer them across the human sample.
(2:12:32 - 2:12:55)
We have to talk to the FDA, but I think that our time, instead of going to the FDA, we're talking about the need to have a constant continuum, in order to never, and knowingly, have it happen. Thank you very much. Yeah, this is phenomenal.
(2:12:56 - 2:13:27)
Again, we're getting this knowledge from the world-leading voices, not only in thought, but in actual production of these systems. I want to thank this panel to go into the deep dives here. We're going to go ahead and... Can I please get a hand of applause? And going on to the next one, we're going to play a little bit of a video to show you actually what Trackable Health and AI is doing, because it's really relevant to this thing.
(2:13:27 - 2:13:43)
We're going to play that out. We're going to take a little bit of a break here, mingle a little bit, and then we're going to pick up again. We have Major General, Major General Vaughn, from the Air Force, as a civilian today, who's going to come and pick up whenever he wants to start, probably around about 4.15. We're running a little ahead of schedule, which is phenomenal.
(2:13:45 - 2:14:02)
These discussions are very, very important to be really engaging. Great questions, great answers for the future of all this stuff. Oh, absolutely.
(2:14:03 - 2:14:15)
This is the other thing. Great question, Major General Vaughn, retired. We have an integrated system where everybody who's plugged into the CARES office is going to get all the information from everybody who's here.
(2:14:15 - 2:14:27)
I've got really powerful GROK agents running all this stuff. It's one of my least woke AIs. I'm going to give you guys a fun fact.
(2:14:29 - 2:14:41)
In 2018, one of my forums that I was invited to was run by a colonel at the time. His name was Colonel Edward Pertz Vaughn. He invited me.
(2:14:41 - 2:14:51)
He saw the typhoon running around the Pentagon and said, what the hell are you guys doing? He liked it. He said, Nino, come. Come and lead one of my forums to help because he saw what I was doing.
(2:14:52 - 2:15:07)
He actually presented Google Mind, who created the transformer. I remember it was yesterday. Anything that we're doing with LMMs, you've got to also thank, at least in the Department of Defense, you've got to thank that man for bringing those guys in through a disruptive process that he created.
(2:15:08 - 2:15:25)
I want to thank you for being here, sir. Now, I'm going to go ahead and if you guys have any more questions, let's take a little bit of a break, reset, and then we'll get back to the party around 4.15 with Major General Vaughn retired to talk about supply chains. Thank you, panels.
Break & Transition
(2:15:27 - 2:15:33)
Thank you, virtual attendees. You guys are absolutely ridiculous. I'm going to play the video right now of trackable health.
(2:15:33 - 2:41:59)
You guys can watch it in the background. It's about a five-minute video. Hello.
(2:41:59 - 2:42:20)
Hello. Hello. Yes, we're coming back.
Everybody, get back to your seats. We're going to start off panel three in the next couple of minutes. Grab your seats, and we'll see you in two minutes with our supply chain manufacturing segment.
Panel 3 Introduction
(2:42:22 - 2:44:20)
I'm going to call Elmer Roman to sit on the panel. Is that okay? Okay, we're going to go ahead and kick off this panel. I'm going to make an introduction.
Keynote: Major General Edward “Hertz” Vaughan, USAF (Ret.)
(2:44:22 - 2:45:06)
We are going to welcome the keynote speaker. Guys, please, can you just I want to welcome I would like to welcome my good friend, retired Major General Vaughn. When I got into the Pentagon, I was very fortunate that somebody was doing something disruptive.
He's been leading out a couple of different places as of late. He just retired, too. I'm not going to be talking about too much of all those titles, but those are not important.
(2:45:06 - 2:45:47)
It's the actions that he took over the years that true leaders do. He came to do the keynote. He's going to talk about everything in the wartime production, supply chain, related to ICAM, of course, because as you guys probably learned by now, everything is tied into that.
I want to go ahead and hand it off. Then we're going to have the moderator, which is Dr. Hartman, take over. We're going to have the panelists, which we're going to have Steve Moretto, Navy retired PEO that ran one of my programs called the DILA for two years.
We did really, really well. Steve is going to be on the panel. Then we're going to have our guest of honor that showed up today.
(2:45:48 - 2:46:05)
Another Senior Executive Service Elder Roman, who is the Undersecretary of War, R&E. What is the title exactly, sir? Current one? Deputy Assistant Secretary of War for Acquisition, Integration, and Interoperability. I forgot it because I work with so many of them.
(2:46:06 - 2:46:11)
He's really special. We're going to have him join the panel. It will be an honor to have Dr. Hartman.
(2:46:11 - 2:46:45)
We can also add a couple questions for him. He'll be able to answer. Over to Major General Retired Ron.
Thank you. You know why he's called Typhoon. Let me tell you something about what I've been doing for the last few years.
I retired in July from active duty. Forty years in uniform, about 28 on active duty. The balance of that was reserve status, various Air Force reserves, New York Guard, etc.
(2:46:46 - 2:46:56)
Where I worked in manufacturing as an engineer. I built everything from wheelchairs to rototillers to turbochargers to locomotives. Then I went on active duty.
(2:46:57 - 2:47:26)
Manufacturing and production is always in my route. It was a great honor for me after a career in operations and command. I mentioned briefly about Antarctica.
It was a great pleasure for me and a great honor for me to command the 156th Puerto Rico Air National Guard in San Juan for two years. So we got to talk a little bit about our favorite island on Earth. Then I went into some executive roles.
(2:47:27 - 2:47:40)
We can skip that if you want an opportunity. If you're on LinkedIn, you can see some of that on there. The last three years particularly, I was selected to lead an organization called the Joint Rapid Acquisition Cell, JRAC.
(2:47:41 - 2:48:04)
What JRAC was designed for about 20 years ago, you remember MRAP? It's a frustration for the Secretary of Defense who's trying to get the capability that warfighters needed and the acquisition process wasn't fast enough. He went to Congress and he was able to secure rapid acquisition authorities. Around that time, it wasn't directly related, but around that same time, they created JRAC to manage those authorities.
(2:48:05 - 2:48:14)
In that role, what I asked for, I said, we're going to start talking to small companies. I forgot who I was mentioning. We were talking about some of the small companies out there.
(2:48:15 - 2:48:22)
We would not turn away a single pitch. By the way, from a legal standpoint, once you take one, you've got to take them all anyway. We said, we're not going to turn away.
(2:48:22 - 2:48:31)
Most offices, small companies call and say, hey, go talk to SBA. They're better now, but still, that's generally what you get. JRAC, we're going to take them all.
(2:48:31 - 2:48:37)
My team, by the way, didn't like that. Not because they didn't like the small companies. They didn't like what America was doing.
(2:48:38 - 2:48:55)
They were very uncomfortable. They didn't know how to interact or what questions to ask. We saw over the period of about three years, more than 300 companies.
We did five to ten per week. We lost track at just over 300. It could have been close to 500 total companies.
(2:48:55 - 2:49:04)
Usually, it's a 30-minute virtual, but some people would come in the building, and others, we would meet them in a box. I'm not afraid to meet somebody for a coffee or another brown liquid. It's all good.
(2:49:07 - 2:49:19)
What happens after about 100 companies, when you're on the receiving end of a pitch, and we're not shark tanks. We don't actually have any checks to write and do. We work directly for the COCOMs on the requirements.
(2:49:19 - 2:49:35)
We want to be aware of the technology, and we're very clear up front. When you pitch us, we just want to know what you're doing and be aware of what the agency is doing out there. Then maybe we can help connect us with BARPA and DIU, maybe an app set, the servers, and the pack-buys and stuff, the whole process.
(2:49:35 - 2:49:46)
Those folks will occasionally call us and say, you know what I'm about. We're going to be that kind of tech scout. After several hundred companies, I started to see signal in the noise.
(2:49:47 - 2:50:05)
Briefs would come in, and I could almost predict on paper what they were going to say and what they were going to do. I'll walk you through a little bit, and I'm going to frame this as customers, capital, and production. If you go to my LinkedIn, it says right under my name, customers, capital, and production, so it's kind of what I know now.
(2:50:05 - 2:50:27)
If I don't know, I have people to call who know better like Mr. Lamont and Dad's Walk AIT. First thing, most small, not all of them, most small companies come in, and they are telling you all about their tech. They are gushing about their great technology, their IT, their breakthrough, and they should be proud of it.
(2:50:27 - 2:50:50)
In many cases, it's absolutely eye-watering and amazing. They will come in on the 30-minute block, and we'll start by introducing, they'll know who's in the room, and we'll get to know each other, and they'll go, what do you got? They will spend almost all their time telling you about their tech. Very few ask, what problems are we trying to solve? It becomes a crapshoot.
(2:50:51 - 2:51:06)
Their tech might actually solve a problem we're trying to solve. Some of them, they'd hire recent veterans, and they kind of had a good idea, but two things have to happen. First of all, they have to magically align to the problem they're trying to solve without asking us.
(2:51:07 - 2:51:22)
Sometimes, they get it. But then, they had to convince this crowd they were solving that very problem, and the crowd being whoever's in the room, and we didn't let them know who it was. Sometimes, they were actually solving the problem we needed to solve, but we couldn't understand what they were saying.
(2:51:22 - 2:51:41)
They didn't convey that to us. The communication was lost. I'll give you one example.
Anybody here involved with recharging batteries remotely across the air? Anybody? You're doing that? Recently. We had a company come in. By the way, the tech is amazing.
(2:51:42 - 2:51:55)
They're like, you have the drone flying around, and the battery's low. We have the device that you can actually project the energy through the air. We've been talking about frequencies and waves before.
(2:51:55 - 2:52:02)
We can recharge the battery at range while it's still flying. You don't have to land and plug it in. We can recharge it.
(2:52:03 - 2:52:13)
These are some Caltech guys. I asked the same question, how are you doing that? They spent the next 20 minutes going through the formulas and explaining it to me. Now, I'm an engineer, but I'm not a scientist.
(2:52:15 - 2:53:11)
After 20 minutes, I had no closer idea of how they did it. Again, these are very credible guys. They've been through DARPA.
My good friend over at Dominic Galeo called and said, yeah, this stuff is, as you know, the technology is there. The question is, can they do it in real-world ops, and can we scale it, and how far can you do it? We really wanted to entertain this technology, even though that was not on our list of GEONs or GEONs. We did not have a requirement to solve that anywhere.
No warfighter was asking for that. We're trying to help them out, and we're saying, what if we put sensors on the top of a wall, like, say, the southern border wall? We put sensors there, and those things were on batteries because you didn't want wires. Maybe you could recharge that at range, and then you could have a large device, and it's more predictable.
Maybe that's the way to do it. That avoids cables. It involves having people get up on ladders and that sort of thing.
And they don't want to talk about that. No, we just want to do drones. In fact, we designed a drone.
(2:53:13 - 2:53:50)
We basically got about 10 minutes left in the brief. Well, it's totally all about your drone. We actually don't need a drone right now.
We have lots of drones. You're going to be one of 500 companies doing drones, but so far, you're the only company doing batteries at range. No, we're going to talk to you about our drone.
So, instead of closing the loop with us, and it's just one example, right? Instead of closing the loop with how we might be able to take this really cool technology, and we're trying to help them find a problem to solve, so it's a solution in search of a problem. Again, amazing tech. No question with the tech, but does it help us? At the end of all that, I referred them back to DARPA and DIU, and I had no path to take.
(2:53:51 - 2:53:56)
And that's pretty typical of a lot of companies that would come in. Amazing tech. They own their IT.
(2:53:57 - 2:54:22)
Now, then there's a smaller group of companies that had already done their homework. Maybe they met the Army or the Navy or whomever, and they knew the problems that needed to be solved. And so, they could come in and say, we talked to Army G3, who says, these are the problems we're trying to solve down range right now.
And then we'd look at our list and go, yep, indeed, those are problems that we understand the Army's trying to solve. Well, here's how we're going to solve those problems. So, the customer part says, what do you think they got right now? We're on the capital.
(2:54:23 - 2:54:29)
I'm like, okay. How are you guys capitalized? Well, we're bootstrapping right now. Okay, that's fair.
(2:54:31 - 2:55:12)
Walk me the path of, if you get a government contract of some kind, how is that going to enable you to go to the next level and actually solve the problem for the Army? Because your prototypes right now demonstrate that you may be able to solve the Army's problem, but until you can get to LRIP and start doing some scale production, how are you going to do that? And I said, what is your capital plan? That now, and it's funny, we were asking that for the last couple years as the Honorable Mr. Feinberg came into the building as Deputy Secretary of War and brought with him a whole bunch of folks from Wall Street, private equity guys. Many of you may know George Koloketus. He runs the Economic Warfare Unit.
He does the equity. OSC does the debt. Bottom line is they're doing some pretty big deals.
(2:55:12 - 2:55:21)
You can read about them in the paper. Some of them get criticism, but underneath it all are very well-structured capital deals. And so this is what we convey back to the small companies.
(2:55:22 - 2:56:01)
What this department wants to see right now is some skin in the game. Most of the founders would cash in their life savings and have friends and family, and then they'd give a seed round. So they had skin in the game.
That part was met. We want to see how you're going to bring some private capital to the table, and that way when the government puts in a contract or maybe an IBAS or an EPA Title III or whatever is required, or even a CIBRS, those two are going to match together and enable you to scale or get to that next step, whatever that next milestone is. And we just wanted to hear a plan.
And so even the first group of folks didn't even connect to the customer. Really hard to help them. The few that got through that gate, we talked about capital.
(2:56:02 - 2:56:11)
If you get a contract or if you get some money out of the department, how are you going to use that capital? Most of them didn't have an answer. They didn't have a plan. They knew how much they wanted.
(2:56:11 - 2:56:37)
Almost everybody to a person knew exactly how much money. Well, we need $75 million and we'll get there. I don't doubt you.
I believe $75 million will help you. What are you going to do with the $75 million? Just high level. You know, $25 million for labor, you're going to lease a factory, you're going to buy some equipment.
What are you going to do with it? And they couldn't tell us they had no plan. But a few of them did. So a few of them got through both those gates.
(2:56:37 - 2:56:47)
And the last ones, I talk about customer capital and production. The last one is on production. And the ones that got through all those, now everybody is very interested and usually they would get more time.
(2:56:48 - 2:57:06)
Okay, you guys are now in the rare era of a handful of companies that actually did your homework and came in ready because they all went to Small Business Academy for Defense, right? You guys all graduated from that course, right? It's offered every six weeks? No. There's actually no class, right? Be nice if there were. SBA does some things but they don't teach you all this kind of thing.
(2:57:06 - 2:57:25)
And so the last ones that come in and talk about production. And anybody familiar with the term DFM? Design for Manufacturing. DFA, Design for Assembly.
You ever heard of DFS, Design for Scale? We're starting to socialize that. We like to think we coined the term and JRAC maybe we didn't, you know, who knows. We steal a lot of things and say we coined it.
(2:57:26 - 2:57:36)
But we use that term and we asked them, we said, alright, tell me how you're going to make a hundred of these things. And sometimes they would come in with prototypes. If they could get through the security of the building, we would allow them to have it in the office.
(2:57:37 - 2:57:45)
Sometimes security wouldn't let it in. But a lot of them brought their thing in, they figured it out, and they would show us, you know, here's what we made. A lot of folks are making drones, by the way.
(2:57:46 - 2:58:13)
I mean, everybody is making drones. And so we would say, okay, that is a cool design. Walk me through your supply chain constraints on this.
Where do you have long lead time items in this? So if you go from, you know, a handful to a hundred to a thousand, and what we really need is probably a hundred thousand to a million. If you're talking drones, if you're talking other weapons, it's probably in the thousands at least. How are you going to get their production line? And they've already laid out the customer.
(2:58:13 - 2:58:17)
So they're matched to the customer. They're solving a problem we need solved. They've already laid out their capital plan.
(2:58:18 - 2:58:46)
And so if they get capital, and they have a, here's where we're getting private capital, here's where we need some public help, and here's the stack. And if you guys are familiar with Anduril, anybody work for Anduril in here? I don't know if we have any Anduril folks. Palmer Luckey, and I don't know if you know the story, they were on their last leg, all these companies were always, you know, these founders, they were always on their last leg, but they were truly on their last leg, and they went into the Navy, and I don't know if you were at the Navy at the time, they went into the Navy to pitch for a Sibbers.
(2:58:46 - 2:59:03)
And I think it was like really low numbers, comparatively, 50k, 100k, something like that. But they just knew the Sibbers. And he went in, and Dr. Sunshine Smith-Farrell, who I think you know, she was one of our fellow acting DASWAs in the ANS.
(2:59:04 - 2:59:50)
She was in the Navy at the time, and she was part of a team that wrote that first Sibbers for Anduril. Now, Palmer Luckey had exited and had plenty of his own cash, but he was running this company, you know, as a guy that didn't necessarily have the cash. That was sort of the backstop.
So there may be a little bit of unfairness. He could really go out on a limb. But he did go out on a limb, got the Sibbers, and instead of just spinning that down and filling out the Sibbers paperwork and just trying to do another Sibbers after Sibbers after Sibbers, some companies live that way, he said, I'm going to take that government money, and I'm going to use that to attract private capital, and I'm going to build to the next level, and then I'm going to go to the next level, StratPy, TacPy, maybe a Sibbers pastry.
I forgot what was next. It was a larger dollar. And then from there they went to, I think it was the predecessor to AppFit.
(2:59:50 - 3:00:09)
It may have been early AppFit, but they got that next one, which were procurement dollars to help them scale, to get past LRIP, and next thing you know, now it's Anduril, and they're called a neoprime. I'm not sure exactly what that means, but I can tell you right now they're getting a lot of contracts out there. So that's an example of a company that was able to do that.
(3:00:09 - 3:00:36)
And he did it because he had a really good game plan and could talk a good game, even though early on, and even now you would argue they haven't scaled necessarily in certain things. So back to the companies that are coming to see us, the handful that have met the first two gates, their plan to scale the DFS, the design for scale part, would pretty much wipe out everybody else. And we would send this out in the prep, by the way, probably after about a year.
(3:00:36 - 3:00:41)
The first year people just came in cold because we were new at it. We didn't know what we were. We ended up with score sheets.
(3:00:42 - 3:00:52)
We would kind of score the companies. And at the end of it, and when they were done, it was never thanks, have a good life. It was always a referral to something.
(3:00:53 - 3:01:32)
If you're very low TRL, we're going to refer you to our friend Dominic at DARPA, more than likely, or one of the labs. If you're kind of intermediate TRL, you may have a prototype, we're going to try to help you tag up with one of the works, app works, you know, soft works, or at least companies, organizations. Some are 501c3, some are part of the military, but we would kind of connect them up.
Some would go to DIU if they had a commercial product that was going to scale over to military, and so on and so forth. So we did that over the last three years, and that's where we got some of these observations. So number one is the founders would come in, and really the bulk of the problem is folks not asking what problem are we trying to solve.
(3:01:32 - 3:01:45)
And it could very well be that every one of them could probably solve a problem somewhere in the department. And particularly with JRAC, we're focused on war fighting, not so much the logistics and the back end. But we knew about the logistics and back end and could refer them out.
(3:01:45 - 3:02:25)
So that was the big one there. The companies that got invited back were the ones that showed some willingness to be coachable. Now, you don't get to be a founder of a company that does very well unless you've got some confidence and some moxie, right? And you've got to be able to stand up, and probably everybody you know has told you it's not going to work, yet you powered through.
So I understand if people come in with a little bit of a swagger, that's fine. I've got no problem with that. But when somebody who has seen hundreds of these like our team had, is trying to give you some constructive feedback, you guys will do a lot better in these meetings if you just reorient your conversation to this.
(3:02:25 - 3:02:53)
Or if you came in with some of this prepared. Or at least come in and say, these are gaps, we don't know the answer to it, but we want to provide it to you, can you help us with it? I said just that little bit of, and it's not even humility, it's just a willingness to listen and then take some action on it. So anyway, I'll throw all that out there.
Now let me jump ahead and go back to the macro level. So I did that for about a, I did that for the whole time until I retired. I got another job added in the summer of 25, so a little over a year ago.
(3:02:54 - 3:03:41)
And I was asked to take on as Executive Director of Joint Production Accelerator Cell. And I'm convinced that the Undersecretary for ANS, at the time it was Mr. Moretti who was acting, Steve Moretti, I'm convinced that he said he's running JRAC, JPAC needs a leader, they kind of rhyme, so we're going to give them both. Really, the missions have not a lot to do with each other.
Joint Production Accelerator Cell, anybody familiar with that one, JPAC? So JPAC was formed probably three years ago, before that it was called MIDS, Manufacturing Industrial Base Development kind of thing. Really what they're doing is they're out there helping industries scale. They're getting involved in companies that already have big contracts and one of their big claims to fame was the 155 millimeter scale up probably about two or three years ago.
(3:03:42 - 3:04:02)
I know the Mesquite, Texas thing is a different story but there were other facilities that did very well and we went from, you know, single digit thousands per year, over a million a year and so that was one of the success stories. That became JPAC Joint Production Accelerator, so I took that over. That organization was, Mr. Feinberg said, I want you to stand up the Munitions Acceleration Council, the MAC.
(3:04:03 - 3:04:30)
MAC is go out and accelerate 12 specific munitions for America, figure out how to get those things scaled and then we'll come back to the building and we'll cut some deals. That's been kind of absorbing Mr. Feinberg and his team for the last, I'd say year and a half, doing that kind of work. And then towards the end I had the honor to, really just a placeholder of the acting DAS well for AI2, so they could hire a real executive to go in and take it and I'm very happy that Mr. Roman is doing that.
(3:04:30 - 3:04:50)
So those are, and then I wore one hat that involved the intelligence community, can't talk about it here, but special programs hat and we'll just stop there. I'll give you all that context because let me, and I'll end on this and we can go to some questions when we get to the panel. What you have at the macro level applies down to small companies as well.
(3:04:51 - 3:05:24)
It doesn't necessarily help the small companies get across the valley of that, that's what AI2 can help with in a lot of cases. But the macro level, especially with the Lockheeds and the Raytheons and all the big munitions, I was in a room with Mr. Feinberg when he brought in the CEOs, so Chris Calio from Raytheon, Jim Taycliff from Lockheed, a bunch of the others, QBasic when he was running out there, brought all these folks in and he said, look, the days of you guys getting just EPA Title III, facilitation money, obsolescence money, those are done. You're investing in your own capital from now on.
(3:05:25 - 3:05:32)
And they're like, come on. One year contracts, one year budget. You tie my hands, I can't close that deal with my board.
(3:05:32 - 3:05:48)
And my first legal responsibility as a CEO is to my shareholders and my board. As a fiduciary, legal responsibility, I can go to jail if I don't do that right. Feinberg goes, you trying to out-business me? Right? And he goes, he didn't say hold my beer, but he kind of said, hold my beer.
(3:05:49 - 3:06:02)
And when he says, look, what you need in return, if you do that, we will give you a sustained demand and say no. What does that mean? It's starting to look like these multi-year procurements. Have you noticed that? The NYPs? Some of them up to seven years.
(3:06:04 - 3:06:20)
That's where we had to really, over time, engage with Congress, because that's Congress's authority to make a multi-year procurement. Congress doesn't like to do those, generally, because you tie the hands of the people that will come after them. The next president, the next Congress, the next two, three Congresses.
(3:06:20 - 3:06:25)
And so that became a big contest in the building. But at the end of the day, we got some of those through. You see the shift occurring.
(3:06:26 - 3:06:56)
Congress is obviously, they own the purse. They're a big partner in these deals. And the deals that are closing are the ones where if you look at the company's internal rate of return, what that is, they're trying to get that to beat their cost of capital, whatever their cost of capital is, and if it beats it, the deal closes.
And usually it's around that five-year point for the bigger meetings. And for the building to do that five, six, seven-year multi-year procurement, they ask the company to invest them in their facilities and what not. Here's what fell through the cracks.
(3:06:58 - 3:07:22)
Second tier down, eh, okay, they're sometimes in on that multi-year. Third, fourth, fifth, sixth, seventh tier down, the smaller companies. Raytheon, Lockheed, they may get a seven-year multi-year procurement.
They only offer one-year to a job in a large business, because that's what they've always done. The CMCC we talked about, right? That's driving a lot of companies into the ground. And we got the big reprieve.
(3:07:22 - 3:07:39)
Guess what? The law still allows the primes to enforce that on their sub. And a lot of small companies making whatever part, bends and cogs, still can't get to that level. They can't afford to pay somebody to do it, and they don't have the bandwidth and the expertise in-house to meet the CMCC.
(3:07:39 - 3:08:18)
And so a lot of these policies that you're seeing come in, even the relief on the policies, aren't trickling down the supply chain. And so I'll finish on that. I think that's where a lot of opportunity lives for the department.
You and I talked about some opportunities there. I know Mr. Lamont and his team that's their mission, is to get after that. But it's really across the United States.
The smaller companies, they're not just mom and pop, some of them are sizable companies, but they're two or three or more levels down the supply chain, are not seeing those benefits trickle down. And I can tell you, Mr. Feinberg and the team are aware of this, and so they're trying to figure out some incentives to get after consortia and other stuff. So let me just finish up.
(3:08:18 - 3:08:32)
Customer's capital production. Because we have government members of the crowd, and I mentioned this earlier, I'm in a one-year cooling off with certain organizations, so I will not mention the companies that I'm working with right now. But that's what I'm doing post-retirement.
(3:08:32 - 3:08:41)
Basically pitching back into the same fight, trying to help solve those problems so that we can get our industrial base back up. But anyway, that concludes my remarks. Thank you very much for your time.
Panel 3 Discussion & Q&A
(3:08:41 - 3:10:34)
I'll open it up to Q&A or panel, however you want to do it. Thank you very much. This is, um, we're very lucky to have a senior leader who just retired to talk about these problems, and you saw the difference.
When I got pulled in to support the Ukrainian efforts, I didn't know how that happened, but all the work that we've done inside these groups, Major General Vaughn would pull you in to these whiskey sinks to execute on things that were working with small, disruptive innovation. Now, of course, you know, I got to also help some bigger companies, but it's the smaller companies that really make the difference. And what Major General Vaughn really hit on is that you really need to understand where your value proposition is and what problem you're solving in that office.
Right now, I have systems that are mapping out everything to every acquisition from the urgent acquisition, which was something that they used for Ukraine, right, and all the way down to the normal process. But these processes can go a lot faster for companies that know how to study how those BAs are won, the RFIs, the CSOs now. So, these are all very important, and when we're talking about this next level, think about the Pentagon operating like a venture capital arm.
So you can bring in the money, just like the Lucky Palmer example, use what you won for that SBR 1, 2, or 3 to go to these venture capital. And that's where you have to learn the laws of the trade-off. You're going to trade off some equity, some figure it out, maybe hire the right person.
You can help again, talk about relationships. So you've got to really think about what you need to do to get to that $10 million. And then, once you get $10, you turn that into $100.
It's easy. If you're Palmer-Lucky, it helps to have $500 million. Exactly.
Panel 3: Defense Industrial Base, Wartime Production & Venture Capital
(3:10:35 - 3:11:19)
Absolutely. By the way, we're doing great with time, so we're going to have right now RGBSI CEO Dr. Hartman to start, and I'm going to also invite our great SCS Dr. Rahman, Elmer, come please up and join the panel. And I'm going to hand this off to RGBSI CEO, one of our sponsors, who has a supply chain contract supporting supply chains and who's going to be leading out the modern nation.
Okay? So here you go. We're going to hand you off. Welcome to the show, sir.
Thank you. No, this is great. We've got a set of slides we're going to run through just by way of an introduction.
(3:11:20 - 3:11:32)
I actually look forward to the follow-up here. When you see what we're doing, we're tied in, and you're six, and you know it. And I think that there's some synergies here that we're going to be able to really pull on to make all this work.
(3:11:32 - 3:12:31)
I'm Paul Hartman. I'm the president of RGBSI Aerospace and Defense. Thank you, sir.
And I have the good fortune of being here with my colleague Dr. Shweta Kumar. And between Shweta and I, we have built what is referred to as the Department of Defense or now Department of War Digital Manufacturing Exchange. I'm just going to spend a few minutes talking about the Digital Manufacturing Exchange, why we built it, kind of how we built it, where we sit today with almost 20,000 subscriptions on the platform.
We're still over on Third Street. We're still trying to break this thing in as many ways as possible to ensure that by the time we push it out to the COCOMs, they have everything that they need to know that this fight is real, and we're ready to support the sustainment strategy associated with that. So, can I get my slides, if someone's driving back there, if we could put my slide up on the screen? If not, I can narrate without it.
I can get it started. So, we built under our own funding. This is an important part of this discussion that you're having here, sir.
(3:12:31 - 3:13:52)
We used our own funding to build what we call the Digital Sustainment Platform. So, we come out of automotive. We did not grow up in aerospace.
We come out of automotive. We own engineering, manufacturing, product quality, supply chain, risk management for Ford, General Motors, Chrysler, Honda, Detroit, Diesel, all five of the electric motor vehicle companies, and we were asked to write a white paper in response to a broad agency announcement about what would we do if we were going to try to move the entire Department of Defense forward with respect to digital engineering, model-based engineering, model-based manufacturing, what would that look like? And so, we did that, and that has now, we picked it up from the white paper after we demonstrated the capability, and we put it onto an SBIR Phase I, a $97,000 piece of paper, and now we have six SBIR Phase IIIs to include a $50 million IDIQ that was specifically put in place to use the platform along with our engineering services capabilities to solve what is now one million weapon system coded part numbers that are in DMSMS, rebuild the defense industrial base, organize and modernize the organic industrial base, do the same thing for our allies and coalition partners, and then address any policies that are impeding our ability to do number one through four above. Those are the five task areas that are associated with that $50 million SBIR Phase III IDIQ contract, which is doing exactly what you're talking about.
(3:13:53 - 3:15:31)
We went and we understood the problem, and we knew how to solve the problem. We solved the problem, and now we're scaling the solution to what is a global problem. I have to acknowledge the great work of my friend now, Steve Marani, when he was the Principal Deputy Assistant Secretary for Sustainment, and he and now Pat Kelleher is the DASW for Material Readiness, and now Jeff Carter was Lisa Smith, the DASW for Product Support.
But those are our sponsors and the ones that are paying the way for us to go get this done at scale. If they don't bring this slide up, that's okay. I'll send the slides out to everyone.
There's three slides in the deck. The first one is what I just said. We built the platform first in Azure GovCloud.
We were asking the spring of 2024 to refactor the entire platform into an AWS West Coast and East Coast GovCloud environment. We have a full DoD level ATO behind the secure and classified network that allows us to go and deploy the capabilities anywhere in the world in support of our COCOM objectives. That includes bringing allies and coalition partners onto the platform so that we can identify and qualify manufacturing sources of supply in theater at point of need to be able to pull assets out of the fight, repair them, push them back into the fight, and do that at the speed of relevance, speed of right now.
So that platform is there. We just got a $60 million contract on Thursday to go refactor the entire platform once again, now into a Google Cloud platform. So we are truly cloud agnostic in terms of Azure, AWS, Google, and SunNet, and the entire platform is now going in behind the DLA-J6 firewall with full TSSCR SAPSAR NATO clearances so that we can execute at the speed of now any full any warfighting support objective for sustaining our major weapons system program.
(3:15:32 - 3:16:06)
The last slide that would have been in the deck is the one that I think is most relevant to this conversation, and we're talking about rebuilding the small to medium manufacturers. So it used to be that Steve and Ronnie told me that we would brief that we had lost about 50% of our small to medium manufacturers within our defense industrial base. He said that that's not even true now.
He said, I think it's closer to about 75%. Some of that's through consolidation, some of them is simply this thing called CMMC Audited Level 2 with a full C3PAO certification. So just full disclosure, we just got our full CMMC Audited Level 2 outcome on 6 August.
(3:16:07 - 3:16:22)
$500,000 is what it costs us. So when you're talking about small to medium manufacturers, listen to this. I can speak volumes on this 800-171-172 compliance, and I can talk about CMMC and what it took to get here all day long, and I can tell you, I thank God for Lee Method.
(3:16:23 - 3:16:42)
When I called Lee and I said, Lee, you've got to understand, if Steve's saying that we've lost 50% of our small to medium manufacturers, you have no idea what's about to happen to the rest of your supply chain. You own this supply chain for sustainment. I can tell you right now, they're going to walk away by the growth because they simply don't have $500,000 when they're operating on net 2-3% margins on the manufacturing operations.
(3:16:43 - 3:17:10)
And they are not IT people. These are manufacturing people just like us who grew up with the smell of cutting food in the morning, and it smells a whole lot like coffee. But my point is that we built a platform with intentionality to solve a very specific set of problems called global sustainment, and when we looked at it, we covered down, without doing anything different with the platform, we covered down on 100 of the 110 controls that are required for you to get through a C3PO audited outcome.
(3:17:10 - 3:19:15)
100 of them. And because it's fully integrated with the Microsoft product suite, it also provides all of the administrative documentation that you need, all under configuration, under control, inside the platform to meet the remaining 10. So 110 of the controls necessary to get these manufacturers qualified to be CM&C audited level 2 through a C3PO is built into the platform.
That's how you know you're doing things right, because we did not set out to do that. That was a serendipitous outcome of the platform. So I appreciate the opportunity to spend time with the panel to talk about cybersecurity, because I am not a cybersecurity guy, although I've got a new friend, Matt Kelly, I think he's going to spend some time around the bar and he's going to educate me a little bit on what all that means.
But I think what we're looking at in terms of the platform is that we have gone through great lengths through these things called STIGs. There is 600 something different controls that we have had to meet to ensure that we have the highest level of cybersecurity protocols behind the secure and classified network, behind the AWS network, behind the Google network, which we'll be done with here in just a couple of months. But I can tell you it is a very painful process.
But what I was telling Matt earlier is at the bottom of that slide down there, when we're asking these questions about where we are with true cybersecurity, this zero trust, we should just write not. I am concerned about everything that we're doing. As much duct tape and bail on the wire and everything that we put around this platform and around all the security protocols working with these architecture environments, we still don't have this thing buttoned up.
So I look forward to the questions with you guys. I think what I'll do is I'll start right over here on the insert from the Navy PEO perspective, if we can do that. I think it would be interesting to see just from your perspective, your ideas about where we sit right now and what are we going to do to get after what you might consider the most important pressing issue of the day concerning cybersecurity? Cybersecurity? Well, my son over there is an expert on cyber penetration testing.
(3:19:16 - 3:19:33)
And so we've had so many conferences over the last 10 years on cybersecurity. You've probably heard it all. But the new thing is AI security, AI penetration testing.
(3:19:33 - 3:19:52)
So I think that is the biggest emerging issue. One of my mentors, he was sort of a code breaker. He came up with the solution to make OTV, off-track vetting, secure.
(3:19:53 - 3:20:14)
It was an analog solution. Now with AI and all the emerging AI things, I think that's one of the biggest things that we need to pay attention to. I know one of the questions that Nino asked me to ask you was how are we going to drive these requirements that are in industry and bring those back inside the building and back inside the military services.
(3:20:15 - 3:20:57)
But I don't see where we can talk about requirements for anything that matters in terms of our warfighting capabilities that aren't going to have a stick tied to it that's called cyber security, system security, data security, and all that comes with that. Yeah. Okay.
So sir, welcome to the front row here. I think rather than me ask questions, let's open it up. It's rare that you have an opportunity to have a Deputy Assistant Secretary of War present for one of your panels.
I think this is a great opportunity. So from your perspective, can you just share with the audience the things that are working in your organization, the things that are keeping you awake at night? Yeah. Absolutely.
Thank you. Thank you for the opportunity. I found out about this event about two or three days ago, right? And I'm here in a panel now, right? So absolutely.
(3:20:57 - 3:21:39)
But I really truly appreciate being here. One is the opportunity of getting out of the Pentagon and come and see, meet people, right? I was just impressed with one General Vaughn. He actually was my predecessor.
Like I said, he was holding the seat there for a couple months until I got on the job. Prior to that, I was in the Navy as the Assistant Secretary performing the duty for energy installations and bombing. But prior to that, I was a Mission Engineer for the Bombing Army, right? So I went from doing research engineering down to help the Navy with their contested locks and as well the installations and everything that goes along with that, right? But all this, you know, the narrative of what I'm here today, it kind of gets to one key point.
(3:21:39 - 3:21:55)
And Paul, I definitely got to follow up with you because I learned a lot while you were talking about, you know, we're in a real period of transformation, right? Whether it's requirements or it's acquisition. And this is real. And I think probably the most disruptive that I've seen in decades.
(3:21:55 - 3:25:37)
I mean, I've been in the Department for 36 years, right? So I'm not new to this, although I took a hiatus from the state government just to get to realize that the Pentagon might not be so bad, right? When you go and start dealing with the local challenges that you see at the state and municipal level, right? Which at the end of the day, all crises are local, right? So we need to start thinking that the problem we're trying to solve here are beyond just the federal and the Department of War, really. It translates down to that municipality, that individual, right? That citizen. So we cannot think in terms of how we, if we think about identity management, the digital citizen approach, right? And we're thinking from that collective view of America as a whole, then we're definitely living in a bubble.
And what I'm actually realizing is that how different pockets of conversations are happening at the same time all disconnected. So the biggest challenge for us is, and again, I'm the acquisition integrator now, thank you very much for all the stuff I signed up to that. That means that we're going to have to take all these ideas, all these concepts, and figure out how to stream them line into a way that provides a better architecture for the Department to go fight and win wars.
And the challenge in itself is that I think Commander Kelly retired and he pointed out to me, we're in World War III, right? We're at war. And we are actually officially in World War III or we are heading into that. The challenge we're seeing with China and how they're positioning themselves and how they collectively have come together and through all these problems I realize that we've got a long way to go.
Now that doesn't mean that we haven't done homework, right? As we try to understand the kill chains, right, and try to look at it from a perspective of mission integration, mission engineering, kind of lay out those kill chains, understand what the gaps are and challenges. The main thing all along is, okay, now we understand the problem. We kind of have an idea on solutions.
How do we integrate them? But then the other thing, on the other end, which is kind of what Paul and General Vaughn was talking about, is how do we get there, right? How do we get our industrial and the small business and others to start producing and at scale? And that acquisition visibility, which is another area that I own, is kind of what is going to get us there, right? Not only truly understanding the supply chain and what we call supply chain transparency and I was just reviewing an executive order that's going to come along those lines just today, but it's cost transparency. Are we getting a good deal from industry partners, but at the same time make it fair and equitable to them, right, so they can compete? So all along, again, what I think I'm getting from this conversation is that I think we're heading collectively in the right direction, but in different directions. We're moving forward, but I guess diverging in the direction we need to go, so we kind of have to bring the conversation towards so that we understand how whether we're talking zero trust and architecting a war fighting system, systems, right, that allows for us to be able to in this age of the agentic AI, right, be able to determine that user, right, that war fighter is who it is, right, because at the end this will be systems, system fights, right? The same way that we're going to counter the C5SRT, the same way they're going to try to do it to us, right, our long-range fires are also interconnected, so and even our logistics of supply chain in a contested environment is going to be challenged, right? So more than ever, this is so important, but at the same time, and I'll finish with this, is yes, we've got to understand what industry is doing, our supply chain, we've got to understand how our kill chains, but also we understand how do we all integrate as a nation, right? So I think you're on the path of how to address those problems.
(3:25:38 - 3:27:55)
Again, MOSA, Model Open City Architecture is one problem set that we're dealing with. Software Acquisition Pathways is another one, right? So I can give you a lot of problems that I'm dealing with right now these days, but what we really need is more of this, right, more conversation and continue pushing, so thank you. Thank you for your comments.
I'll add as a part of that presentation that we didn't get to show was a slide that was purposely built for the Defense Industrial Base Accelerator Conference that I just spoke at a few weeks ago in Philadelphia, and in there, that particular slide shows 19 drone companies, it's hundreds as you know, but 19 companies that were selected by the Army under the Drone Dominance Program, and the question that I was asked to address was could we drop in the IP? Let's say it's from your company in small-town America, and you own all the IP, and you can produce at the rate of three a month, and we need to create 30,000 a month or more, so could we use the platform under configuration, under control, to control access to your IP to drop that into regional manufacturing operations where we go out and identify and qualify manufacturing sources of supply, we pay you through remuneration for using your IP, but we scale this thing globally to produce those drones or those assets in-country at the point of need, at the point of speed that's required to execute that program. That was, again, a secondary beneficiary or benefit of what we had built, because we absolutely understood the 2D to 3D drawings, the 3D technical data packages, expediting source approval requests, going through the first article inspection process, holding the hand of the supplier to bring them online, ensure that we could get them through in the automotive, it's called PPAP, the Production Part Approval Process, where we own all of the digital twin, digital thread artifacts all the way down through there, so you can imagine the significance of what we're building, and we really didn't completely understand the full perspective of the mission set, so in there is a question about now that we have the ability to bring all of these companies online, we know that they're not going to get CMMC qualified, we know that they can't even spell MIS-800-171-172, what are we going to do to help them get there? Particularly if we look into the Alaska Native corporations, the tribal companies, I mean, there's a lot of capability that's sitting out there that we'd like to tap into, and I know that Congressman Cole from Oklahoma would love to see us be able to do something more in his state. I feel like that was directed towards me.
(3:27:56 - 3:28:40)
The former presidential candidate. I can spell MIS-171. Alright, so with CMMC what's interesting is an economic warfare perspective where if we can add bureaucracy to slow production, that's a win for our enemy, right? Well, when you look at compliance versus security, compliance is check boxes, it's not security.
Somebody can run an actual penetration test and find actual findings that CMMC or MIS-171 doesn't cover. So it's a lot of just twiddling your thumb to get the paperwork done so somebody else makes $500,000. Yeah, so that's not working.
(3:28:40 - 3:29:42)
And then AI is coming in and doing the development at a rate of probably 30 times what faster than normal development was, so the paperwork can't keep up, right? And then on the threat side the enemies are using AI to conduct attacks and recon much faster than they could legacy wise as well. So the whole system and concept is relatively obsolete, and what it actually is causing is everybody to fall onto the five same technologies or the same large corporation products, which is why on Tuesday sometime in, I think it was like May, like everybody's computer just stopped working, AWS just went down, nobody had access to anything cloud, right? So you've actually created new problems. And the solution isn't pushing down requirements, the solution is providing environments for people to put their stuff.
(3:29:43 - 3:31:00)
Where a service or a co-com or a commander owns his battle space, be it the digital or cyber battle space, and provides services and opportunities that way instead of an IT enterprise global infrastructure perspective. I think if there's a follow-on there I'd be interested, sir, in your understanding of what we need to do to really get after industrial AI. You know we've spent billions on the digital factory, the smart factory, the internet of things, the industrial internet of things, and now we still sit basically at the square root of zero on those capabilities.
But the vulnerabilities, like right now, we're deploying the entire digital manufacturing chain to own all MRO functions for the Marine Corps in Baltimore, California and Albany, Georgia, and now they've asked us to stand up this digital factory capability on a 5G network. But I can tell you when I leave here, I'm going to call back and say, hey, we need to slow this thing down just a little bit. I think there's a lot more vulnerabilities here than what we might understand.
Your thoughts on where we need to go in terms of modernizing our organic industrial base? Yes, so this applies to organic industrial base as well as commercial. It gets to what you're talking about. Again, I'm not here to pitch any of the companies as we discussed, but one of the companies I'm working with got hired by Boeing.
(3:31:01 - 3:31:15)
Boeing has a facility in Louisiana called the Michoud Assembly Facility in Mayaf. They're building the next Artemis rockets there. It's a government-owned, government-operated facility with the Boeing guys on the inside doing the manufacturing.
(3:31:16 - 3:31:29)
They really can't make any changes to infrastructure there. The NASA answer to them, it's NASA-owned, NASA says, we'll just plug into AWS or Google Cloud. For the reasons you just said, Boeing doesn't want to do that.
(3:31:30 - 3:32:26)
Frankly, they don't want to do that across their enterprise. What they did is they brought in a company that deployed in their factory sovereign cloud and distributed AI within the factory. Every tool in there, every torque wrench, every machine is an Internet of Things, not just for accountability like RFID, but also when an operator comes in and grabs the tool and calibrates it, sensors pick up which operator it is, what time he did that, what the torque setting was, how many times he cranked it.
All of that goes into a trustless system, kind of like a blockchain, if you will, and can be queried later. You have provenance on every single part of the rocket. Boeing wants to deploy that across their entire enterprise for their commercial jets and everything else.
It's a little bit slow going, but they've worked out the bugs. What they've done now is they said, let's take a complete cloud environment with miniaturization now. There are NVIDIA GPUs.
(3:32:26 - 3:32:46)
They have this basically secure system inside the factory, 46-acre factory. It feels and looks and smells like you're connected to Azure or AWS or Google Cloud, but they own all of it and physically control all of the elements and all of the memory sticks, everything. And they want to do methods protection.
(3:32:47 - 3:32:57)
We use methods in shorthand. Any advanced AI that's going to hack in. What they've done with their data, the data stack that's in the system is air-gapped from the application stack.
(3:32:58 - 3:33:53)
And so it can access one way the data that's needed to run the application. It's done, like we said, almost zero latency. But if anything comes back upstream to try to access that data, it's air-gapped.
Right now, they don't know how to defeat a very advanced AI, but they can certainly deny it. And that's the tactic they've chosen. One last thing, though, and this kind of ties to that.
A couple weeks ago, I had an opportunity to speak at a conference. The acting Secretary of the Army now, he was, at that time, just running the Army Corps. So he and I got to speak and Tubberville was there and everything else.
It's called the Tennessee-Tom Bigby Waterway Authority. If you're not familiar with it, it connects Paducah, Kentucky to the Gulf of Mexico through a chain of rivers. It took the Army Corps of Engineers about 30 years to dredge and build all that out.
It's been around for probably the 44th anniversary, 44 years. It's every bit as cool as the Panama Canal, but it's right here in our country. One of the things they found is the 13 locks that are on there have a little controller called a PLC.
(3:33:53 - 3:34:32)
Anybody know what a PLC is? PLCs, you order that out of the Grainger catalog, right? You put it wherever you need to do an access. Those things have logins and passwords. And they have factory default logins and passwords.
And when we queried all the locks, more than 50% of the PLCs installed in a critical infrastructure of the United States had the factory default settings for login and password. And by the way, that's how we think it may be the Iranians, but that's how the enemy has been getting in to these water systems and the SCADA and the utilities. They've been hacking in through things like PLCs, temperature controllers, and you name it, where the password is default.
(3:34:34 - 3:34:55)
Can he hear us and talk? Dan, are you there? Dan Hawk? Oh, there he is. Good, good. Sorry, we had a different screen.
(3:34:55 - 3:35:00)
We couldn't see you guys. Okay, let me hand it off to Dan. Go ahead.
(3:35:19 - 3:36:42)
... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... Nino's up here calling shots. He's actually walking out on the 50-yard line now, putting a new ball on the field, but no, this is great. We actually did not know that we had the folks still out there, so this is perfect, guys.
Let me go to Ken real quick. Ken, your thoughts, you know, Nino was giving us about 15 minutes, but why don't we just open it up in general for your thoughts about the conversations that you guys participated in today and what we might close out with, and we'll just go around the horn here, and so we'll finish up with you last as the senior member of the panel. Yes, sir, go ahead, Ken.
(3:36:43 - 3:38:53)
... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... that you get young, expert responses, and you can trust them, and they're accountable. And if you know that all of these things are done correctly, and there's a habit mistake, you can see where the mistake has been made. It's a new, I call it Gen 2. This Gen 2 solution beyond the frontier model.
(3:38:54 - 3:39:35)
And all of those AIs here about not being able to control AIs, this is Gen 1 issue, and it's time for the military to have a completely new, you need a table for clearance, you need to get everyone working in the same direction, you need a controlled AI platform that does all that for you, and it will be easy to trust. And then you can dive, okay, now that I have the picture, now that you've tied all of this together for me, across the agency, across people trying to get into the work, across incumbents, now I can say, now I can make informed decisions, and guide this intelligently, it's gonna be a lot easier. And that way, yeah, it's gonna be positive.
(3:39:35 - 3:39:50)
Yeah, very nice, very nice. Carl, can I call on you and get your perspective? I know it's your civilian hat, not Space Force's official position, but. Absolutely, let me get in there.
(3:39:50 - 3:40:12)
So I think we've got, we've got some challenges that we need to address. We've got the AI team, right? So what we're doing with regards to AI in common, or will it be the same, because they're only, the AI team is really just, the data sets and the thought architecture that it's based on. So if I have bad data, then I'm gonna have bad data on it.
(3:40:12 - 3:40:38)
And that means that the decision support members are really, really critical for connecting the operators, and then the interceptors, for that matter. So I think we've got a lot of synergies here. So what we're dealing with, one of the things that we're doing is we're considering multi-dimensional systems architecture and infrastructure challenges around ACOs, around the war cycle, around policy and government, around engineering requirements.
(3:40:38 - 3:40:59)
So all of these things are critical. And as Bill O'Connor said, all of these things are not trivial things that we have to address. So looking at it from the public sector, the private sector, the government team, all of the things that are absolutely critical as to how we're gonna be addressing these challenges needs some context.
(3:40:59 - 3:41:19)
We need to be able to provide a value proposition to each one of these LODs in these lines of effort. And so the first thing is the core principle, we're looking at every one of those LODs. And once we start looking at what those things are, we then come down to the decision support factors that we need to support.
(3:41:19 - 3:41:38)
If both of these are just distractions, then the way that we're going to address them is terrible. So we're all on the same team here. We have to be able to break these problems in a manner that everybody is understanding from the engineering side, to the policy and governance side, to the operational and security side.
(3:41:39 - 3:41:52)
So none of these things are trivial, but we have to utilize different things and understanding how all of these things are gonna impact the particular domain space that they're operating. Excellent, Carl, thank you. Dr. Hark, a few comments from you, your thoughts, and thank you for your patience.
(3:41:52 - 3:42:05)
Again, I didn't realize you guys were sitting out there in the digital world somewhere. So thank you for staying on. Can't you hear me? You have your hand raised.
(3:42:07 - 3:42:09)
Oh. I can't hear you. I know.
(3:42:11 - 3:43:31)
So, yeah, please. Yeah, I want to make a point about the scale that Dr. Hark, so in looking at that, when it gets to the manufacturing aspect of it, we ended up with a plan for mass manufacturing involving units that are marketable and scalable and configurable. The manufacturing unit itself can be deployed in a mass mode, and then how do you keep that secure? So we're very much aiming for the quantity distribution capability with time transfers to a large number of systems remotely using the cloud data systems.
(3:43:31 - 3:43:54)
I think that's very important. And I'd just like to add that in the AI section, that it's absolutely critical to have AI-reliant systems. You need to have fine-grained engineering systems for AI itself, and you need to eliminate the agents from the people, from the machine.
(3:43:55 - 3:44:16)
And so, that's really the sixth discussion where the power of the thing you actually do. So we really need to talk about, everything that we're discussing together can be turned off instantly by just turning off the power. So we really need to concentrate on the whole picture of the entire system's safety and the safety of my system.
(3:44:16 - 3:44:36)
Well, speaking of turning things off, Nina was giving us the three-minute sign three times now, so I think we should give Greg a thought here. Greg, can you give us a thought there for maybe a minute, and then I think we'll turn it over to the good DASW here to wrap things up. I apologize to the audience that we don't have time to go into some questions, but we've got a social.
(3:44:38 - 3:44:43)
We got another three minutes, okay, good. Yeah, we get to play again. Greg, go ahead.
(3:45:02 - 3:45:48)
Excellent, oh, so over to you, sir, for some final thoughts, closing comments. No, I just want to say thank you for what you do, right? So we pretty much, in a way, that we're acting with urgency, right? All these changes that are happening currently, it's because, in a sense, we kind of run out of time, right? We have to now innovate our adversaries, which are moving at the speed of AI, and you know what that means, right? So for me, obviously, it means a lot of things. Ron is right, being in between acquisition reform and requirements reform, right? That's key for us, understand what the work party needs, and move with speed, right? And one of the things we're doing is reorganizing internally within ASWA, my organization, AI2, merging with JRAC.
(3:45:49 - 3:46:51)
Eventually, if that pans out, we've become a rapid work-fighting integration, meaning to, I don't know, how do we synchronize better urgent requirements with the deliberate planning, but that deliberate planning has to be almost in real time, right? And then one last thought that I wanted to share, on Monday, this just gets personal, right? When you start talking about ICAM, on Monday, I got home, and I see this letter from the Defense Personnel's Civilian Center, whatever the command is, and I open it up, and I'm curious about what this is, and I read there's been a data breach, and your data, your social security is being actually collected by some nefarious activity, whatever, so I think we gotta figure out how do we get better at doing this, right? So again, I know that the conference itself was about ICAM and the challenges associated with that, and we have actually talked about many other things with regard to technology, but at the end of the day, we need to act now, we need to act with urgency. I just cannot de-emphasize that or emphasize that more. So thank you for what you do, and thank you for the opportunity.
(3:46:51 - 3:47:06)
Thank you to Nino for putting this together, to the Carahsoft folks, and certainly a round of applause for our panel. Yeah. Hey, Nino, can I say something? Steve, yeah, go ahead, before we close off, Steve, go ahead.
(3:47:07 - 3:47:24)
Yeah, I'm the owner of two companies, co-founder of the DLIP with Nino. Defense Logistics Innovation Forum, which helps 17 capabilities inside Ukraine through the JRAC, by the way. So we do online forums with a lot of the senior people in the Pentagon.
(3:47:26 - 3:48:08)
So one of the, you know, what I think is the vital interests that we're going to have a forum on national energy strategy, you know, a lot of our allies are dependent on energy from our adversaries, you know, and we've developed in the DOD and the DOE, these modular nuclear reactors, and it's a key enabler for directed energy. Energy resilience in the Philippines and our, you know, as a Navy guy, it could be a facilitator for a nuclear Navy. So later in the year when we talk about this, we're going to have a forum on that.
(3:48:08 - 3:48:38)
So the other company is a consulting company where I advise people on strategies. I'm working on the Philippines National Energy Strategy, a new strategy for the U.S. and the world as well. But one of the things for 30 years in acquisition and logistics and production, you know, I've done a lot of proposal evaluation, written proposals.
(3:48:39 - 3:49:03)
I am a strategy expert. If you need advice with your proposals, I can help with that. I will hook you up with Mr. Moreto, who is a Navy sleeping giant who did a lot of incredible things, and it was incredible to see him, how he operated in the PEOUSC constructs, and we did phenomenal things.
(3:49:03 - 3:49:24)
So I will definitely do that, Steve. So the last one, and that ties into this manufacturing theme that you're talking about. You know, World War II, they ramped up, you know, five, ten years they had industry engaged to ramp up the manufacturing capability.
(3:49:24 - 3:49:51)
And who's interested in additive manufacturing? Yeah, so there's got, you know, you talked about the tiers below that. In shipbuilding, you know, a lot of these lower tier items, you know, the supply chain can't produce them. You know, they don't have the tech data.
(3:49:51 - 3:50:06)
There's all sorts of different bottlenecks. And that's going to be, I think, a huge growth area of the Navy and the Air Force and the Marines. You know, they're all working on that in a big way.
(3:50:06 - 3:50:28)
And with electronics, you know, some of the critical things, you know, the Marines have a part that will make an airplane fly for ten years, but the engineers want it to last forever. So there's a level of risk that becomes a bottleneck. Marines are able to take more risk.
(3:50:29 - 3:50:43)
The Navy's trying to do that. But I could see that once we hit a wartime stance, we need a lot of parts. Maybe big industry isn't going to be able to do that.
(3:50:43 - 3:51:16)
But if you start teaming with the Manufacturing Center of Excellence down in Danvidge, Virginia, I wanted to start a center for innovative additive manufacturing at Carderock. It could be that the whole nation is working in their basements to produce parts and developing a system to do that, to supply parts to our fleet. It's going to set us into what Steve wants to do is the next forum.
(3:51:17 - 3:51:27)
So, again, we have this very important additive manufacturing in the shipbuilding program. We're working closely with those guys. This is a Major General Vaughn, you know, supporting the Navy, Tepche, the shipbuilding program.
(3:51:27 - 3:51:34)
Everything is moving faster. So, Steve, we can actually do something with Kairosoft in support of that. The next one will be nuclear space.
(3:51:35 - 3:51:52)
So we're focusing on the supporting sites for the next one. But I want to go ahead, since we're running out of time and I want to be very respectful to Kairosoft, I want to thank again this incredible panel of senior leaders, retired, current, from the Pentagon, and that have worked with me, that have come. So a big round of applause to this panel.
(3:51:53 - 3:51:58)
Thank you, Dr. Hartman. Really incredible. It's going to wrap it up right now.
(3:51:58 - 3:52:03)
We're going to go ahead and have a little bit of happy hour for about one hour. It's a reception. We're just going to hang out.
(3:52:03 - 3:52:11)
You guys can share some cards. Here's what I'm going to do for you. I'm going to have my AIs send you guys reports of every single person that's been in here, what they're doing.
(3:52:11 - 3:52:23)
We're going to integrate technologies. I'm going to do a mapping for you guys. I'm going to have Kairosoft send me the people that have come, and I'll make introductions to streamline because what we've talked about today is what I've been doing for the last eight years.
(3:52:23 - 3:52:34)
And I think I can help every single one of you, but we'll do it for a great nation as well. So thank you, everybody, for coming. We'll see each other at the happy hour at the Pergola afterwards.
(3:52:36 - 3:52:47)
Oh, yes, and by the way, if you want to get your CP credit evaluation form, please go ahead and use the QR code and you get that in here. We'll see each other. Thank you, everybody, for coming.
(3:52:47 - 3:52:50)
Looking forward to chatting with you guys. Thank you.
No transcript sections match your search.
LinkedIn
Copy Link