Beyond “Checklist” Compliance: Resilience in Healthcare Cybersecurity

Posted on by Keren de Via

For healthcare and medical institutions, dealing with sensitive information comes with the territory of patient care. In 1996, The Health Insurance Portability and Accountability Act (HIPAA) set several regulations for protecting patient privacy; however, it has few guidelines with how institutions can best configure their cybersecurity against a modern threat landscape. Additionally, cybersecurity compliance is often approached as a checklist exercise. In practice, most organizations are managing multiple overlapping frameworks independently, leading to duplicated work, fragmented processes, and limited visibility into actual risk.

Challenges in Healthcare Cybersecurity Compliance

Healthcare and medical institutions handle an incredible amount of sensitive data, including Protected Health Information (PHI) and Personally Identifiable Information (PII). Some institutions may also have Government contracts, in which case they will also handle Controlled Unclassified Information (CUI). This makes it a particularly enticing target for hackers.

Ransomware is on the rise, largely focusing on mid-market small specialty practices. In a month’s time in the fall of 2025, there was a 67% increase in ransomware attacks, primarily from 18 different threat actors. Ransomware affects multiple systems and effectively paralyzes an organization. The stakes are raised the second a cyberattack is launched; in a hospital with patients relying on technology to keep them healthy, the pressure is immediately on to remediate the issue. In these moments, the ability to understand control effectiveness and respond quickly across systems becomes critical, something fragmented compliance programs often struggle to support effectively.

Beyond external threats, many healthcare organizations face an internal operational challenge: the same controls are often assessed and maintained across multiple frameworks, with remediation and evidence tracked separately. This creates inefficiencies that increase cost and slow response times, even when security investments are in place.

When it comes to following cybersecurity compliance standards, healthcare organizations often approach these standards from a position of self-protection. This is not without precedent. Originally enacted in 1863 to prevent the sale of defective goods to the Government, the False Claims Act (FCA) today is used to prevent the filing of false claims to Medicare and Medicaid. Under FCA, liability can be applied broadly to anyone in the healthcare system, from administrators to nurses and physicians. Additionally, every ransomware attack exposes patient PHI and PII, opening the door to class action lawsuits.

What is NIST-CSF?

To establish uniform guidelines for cybersecurity standards across the Public Sector, the National Institute of Standards and Technology (NIST) published the Cybersecurity Framework (CSF). NIST-CSF 2.0 breaks compliance down into six main categories:

Govern: This section focuses on how an organization can establish, communicate and monitor cybersecurity risk management strategy, expectations and policy, including a recovery plan.
Identify: Once an organization understands their threat landscape, they can identify critical processes and assets and document information flows.
Protect: An organization puts safeguards in place to manage cybersecurity risks, training users in proper protocols, securing sensitive assets and conducting regular data back-ups.
Detect: When anomalous activity is detected, the organization isolates and analyzes the activity, determining the estimated scope of the impact and continuously monitoring all systems for adverse effects.
Respond: After an incident is evaluated, appropriate action is taken. Organizations collect data, prioritize incidents and escalate required actions as needed.
Recover: Once an incident has been resolved, an organization should execute their recovery plan. This includes quality checks and communication with both internal and external stakeholders.

Frameworks like NIST-CSF provide a strong foundation, but the challenge is not understanding the categories. It is operationalizing them across multiple frameworks at once. Not only does this model break down compliance with non-technical language, but it also allows healthcare organizations to approach their cybersecurity framework from a posture of resilience. However, in environments where multiple frameworks are in use, organizations must also consider how these controls align across requirements to avoid repeated effort and inconsistent implementation. NIST-CSF cannot be relied on solely; it states up front that it is not a maturity scale. In other words, it cannot measure how developed or effective an organization’s policies are. Additionally, no healthcare or medical institution faces the same threat landscape. There is no “one size fits all” solution for compliance; each organization must find and adjust a compliance framework that works best for them.

Steps to Strengthen Cybersecurity Posture

Healthcare organizations require clear lines of delineation concerning liability after a cybersecurity breach. It needs to be clear that Security Operations Center (SOC) analysts and other cybersecurity team members do not own the risk; rather, they are simply reporting on risk and identifying the stakeholders that own the risk. It is critical that the Chief Information Security Officer (CISO) remain an objective, honest conveyer of vulnerability and risk intelligence.

Compliance frameworks set the overall goal for cybersecurity, providing a compass to which health organizations can align budgets, staff and policies. To do this, an institution must fully understand their risk tolerance, a process known as risk framing. For example, if an institution chooses to implement a compliance framework focusing solely on HIPAA, it could potentially be neglecting necessary protections for CUI and could face Civil Monetary Penalties (CMP) or the loss of Government contracts or Federal funding. It is critical to examine an entire ecosystem and bolster its weakest points.

Another step in examining that landscape is understanding where multiple frameworks intersect and how they interact with each other. Without a unified approach, organizations often end up performing the same assessments and remediation activities multiple times, creating unnecessary overhead and delaying progress. Simply assuming that alignment across frameworks results in effective compliance creates blind spots, especially when controls are implemented and assessed inconsistently. Ultimately, devoting time and resources to continuous monitoring will keep PHI and PII secure and keep medical institutions running smoothly.

There is no such thing as static compliance; healthcare institutions need to continuously monitor their environment to ensure that their systems are secure. As regulatory requirements continue to evolve, organizations that reduce fragmentation and align controls across frameworks will be better positioned to maintain readiness, respond to threats, and improve their overall cybersecurity maturity.

Increasingly, this means moving toward a more unified, control-based approach, where compliance is not managed as separate efforts, but as a continuous, operational system.

Watch Cyturus’ The Day After Compliance—Healthcare and Medical Institutions webinar to explore more about compliance and observability in healthcare organizations.

Minimizing the Attack Surface: The Onion Model vs. Core-First Protection

Posted on by Walter Hancock

Historical Context of Layered Security

The onion model emerged during the growth of enterprise IT when organizations responded to new threats by adding new defensive layers. Each incident or compliance requirement led to another perimeter or middleware control. While effective in the short term, this layered approach produced patchwork systems with overlapping functionality, inconsistent policies and gaps that attackers could exploit.

The Onion Model and Its Vulnerabilities

The traditional “onion model” of cybersecurity layers defenses concentrically around a central database. Each layer is intended to provide a barrier against intrusion, but the cumulative effect is often an expanded and more complex attack surface. From the inside out, the layers typically include:

Database (Data) – the core asset containing customer records, financial transactions, intellectual property, logs and other sensitive information.
Schema & Validation – enforcement of data formats, constraints and integrity checks designed to prevent malformed or malicious inputs from reaching the core.
Application Logic & APIs – business rules and access methods that determine how applications interact with the database, often exposing numerous interfaces.
Access Controls & Identity (IAM) – authentication and authorization services (passwords, tokens, SSO, MFA) that regulate who can reach protected resources.
Encryption Services – cryptographic mechanisms for protecting data at rest and in transit, including key management, TLS/SSL and disk-level encryption.
Firewalls / Perimeter Security – network boundary defenses, intrusion detection systems, packet filtering and monitoring services designed to repel external threats.

Why the Attack Surface Expands

While each layer aims to protect the core, collectively they create new opportunities for exploitation:

Integration Points – every interface or protocol boundary becomes a seam that can be misconfigured or attacked.
- Configuration Complexity – with more interdependent systems, administrators must manage extensive policy sets and security rules, increasing the likelihood of mistakes.
- Expanded Targets – each layer (firewalls, IAM, middleware, encryption appliances) presents its own vulnerabilities, requiring constant patching and monitoring.
- Dependency Chains – the failure of a single outer system can cascade inward, leaving the core exposed despite the presence of other controls.

In practice, adding more layers often enlarges the attack surface instead of shrinking it. Attackers exploit this complexity, probing for the weakest link among numerous entry points.

Operational Cost of a Typical Attack Surface

Beyond theoretical weaknesses, a large attack surface carries real operational costs. Tool sprawl burdens administrators with dozens of systems to configure and maintain.

Overlapping monitoring layers generate alert fatigue, obscuring genuine threats. Security budgets become diluted, funding maintenance of redundant defenses rather than reinforcing the integrity of the data itself.

Modern Threat Landscape

Today’s adversaries exploit weaknesses that layered defenses cannot easily address. Lateral movement bypasses layers once attackers are inside a network. Supply chain compromises enter through trusted applications, neutralizing perimeter filters. Zero-day exploits render outer walls ineffective overnight. Core-first security, with protection embedded at the data level, ensures confidentiality and integrity even in the face of these modern tactics.

Architectural Simplicity as Security

Simpler architectures are inherently more secure. Each removed integration point reduces the trusted computing base and the probability of misconfiguration. By embedding protections directly into the data layer, Walacor collapses overlapping controls, producing a system that is easier to audit, verify and trust. This simplicity is itself a security multiplier.

The Core-First Alternative

A core-first security model inverts the paradigm by embedding protections at the data layer itself rather than relying primarily on external systems:

Record-Level Encryption and Validation – each data element carries its own cryptographic safeguards, ensuring confidentiality and authenticity.
- Immutable Integrity Proofs – cryptographic hashes and proofs guarantee that tampering is detectable, independent of outer defenses.
- Minimized Trust Dependencies – fewer external layers are required for assurance, reducing the number of systems that must be defended and configured.
- Resilience Under Breach – even if outer controls fail, the data itself remains cryptographically protected and resistant.

This approach shrinks the attack surface by concentrating security at the point of greatest value: the data. Instead of expanding outward with additional complexity, it reduces potential vectors for compromise.

Walacor and Core-First Protection

Walacor implements the core-first philosophy by embedding immutability, cryptographic enforcement and schema validation directly into the data layer. Rather than building outward layers that expand the attack surface, Walacor collapses unnecessary perimeter complexity and anchors protection where it cannot be bypassed: the data itself.

Data-Level Cryptography – each record is encrypted and bound to proofs of authenticity, eliminating reliance on external encryption appliances.
- Immutable Storage – records are tamper-evident at the core, reducing the need for overlapping monitoring systems.
- Integrated Validation – schema and policy checks occur at write-time, blocking invalid or hostile data without middleware add-ons.
- Shrinking the Attack Surface – because Walacor renders many outer layers redundant, there are fewer interfaces to defend, fewer seams to misconfigure and fewer targets for attackers.

Walacor demonstrates that the most effective way to minimize the attack surface is to concentrate defenses in the core, ensuring data integrity and confidentiality regardless of the state of external systems.

Agents, AI and the Attack Surface

The emergence of intelligent agents and AI-driven systems adds a new dimension to the attack surface discussion. Agents interact with data across multiple contexts—querying, transforming and making autonomous decisions. In a traditional layered model, each of these interactions multiplies the integration points and potential vulnerabilities. Malicious prompts, poisoned training data or compromised connectors can all bypass outer defenses to reach sensitive information.

A core-first model directly addresses this risk. By cryptographically securing and validating data at the record level, Walacor ensures that even AI agents cannot be tricked into handling falsified or tampered records. Every data element carries its own assurance, creating a trustworthy substrate for automated reasoning and machine learning pipelines.

In this way, AI becomes a consumer of verifiable data rather than a potential vector for hidden compromise, aligning intelligent agents with the same guarantees that protect human operators.

Forward-Looking Implications

A core-first approach lays the groundwork for enduring benefits. Immutable, verifiable data strengthens sovereignty in federated and multicloud environments. Compliance becomes easier, as audit trails and integrity proofs are inherent to the system rather than bolted on. This architecture future-proofs sensitive systems, ensuring resilience against evolving threats.

Reinforcing the Core-First Premise

The onion model reflects a reactionary philosophy that often results in excessive complexity and a sprawling attack surface. A core-first strategy simplifies the architecture by embedding protection directly into the data layer, eliminating unnecessary exposure and ensuring that sensitive information remains secure even in hostile conditions.

To learn more about a core-first approach to cybersecurity, contact Walacor.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Walacor, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Doing More with Less: How Government Agencies are Rethinking Cybersecurity

Posted on by Brian Snell

In December 2025, Carahsoft and Broadcom commissioned Forrester Consulting to survey 212 U.S. Government cybersecurity decision makers about the state of Public Sector security operations following the budget and headcount reductions of early 2025. What they found was a sector under sustained pressure, but also one actively searching for smarter, more resilient ways forward. The findings provide a candid assessment of where agencies stand today and the steps required to strengthen their cybersecurity posture in an era of constrained resources.

Budget Cybersecurity Gaps

Budget instability remains widespread, with 38% of agency budgets still classified as mostly or completely fiscally unstable. Another fifth of agencies reported no change since the initial cuts were enacted. The result is a cybersecurity landscape where teams are being asked to protect increasingly complex digital environments with fewer people, fewer tools and less financial runway than they had even a year ago. Over half of the respondents report that budget constraints have moderately or significantly impacted their ability to maintain core security operations. Perhaps most telling, just 38% of cybersecurity leaders express confidence in their agency’s security posture following headcount reductions.

The areas most exposed under current resource limitations are network security, data protection and incident response. Roughly a third of respondents also flagged concerns around endpoint security, visibility, analytics and compliance. For agencies already navigating a complex regulatory and threat environment, these vulnerabilities represent more than operational friction; they signal genuine risk to mission-critical systems and the sensitive data agencies are entrusted to protect. As leadership teams work to roadmap investments for the year ahead, two priorities have risen to the top: securing critical infrastructure against bad actors and integrating artificial intelligence (AI) and cybersecurity capabilities.

Rising Breach Risk in a Leaner Environment

Understanding the current risk landscape is an essential first step toward addressing it effectively. 86% of respondents anticipate an increase in potential compromises or breaches in the coming year due to the recent staffing and funding reductions. More than a quarter expect breach numbers to climb by 1–10%, while over 20% anticipate increases of 30% or more. For agencies responsible for protecting sensitive Government data and public-facing services, this trajectory demands immediate strategic attention. The connection between resource reduction and elevated risk is already being experienced across teams, where reduced personnel have created measurable gaps in detection, response and remediation capacity.

The operational data reinforces this concern. 61% of respondents report that security incidents overall have increased in frequency, while 65% say their mean time to remediate (MTTR) has been negatively affected. Over half indicate their ability to secure technology and architecture delivery has also suffered. These are not isolated data points; they reflect a compounding effect where each unaddressed gap creates the conditions for the next. Agencies that do not act strategically in prioritizing their highest-risk exposure areas will face growing difficulty in maintaining the compliance posture and operational resilience their missions demand.

AI and Automation as Force Multipliers for Lean Teams

Amid the challenges, a clear opportunity is emerging. Agencies are increasingly recognizing that AI and automation are essential tools for maintaining security effectiveness when human capacity is stretched thin. 72% of respondents indicated openness to automation tools as a means of enhancing cybersecurity resilience. The top priority areas for automation adoption include incident response, network security, compliance and data protection, precisely the domains where resource gaps are most acute.

Forrester’s recommendations reinforce this direction. Leveraging AI to automate network traffic analysis, policy validation and alert triage allows teams to concentrate on high-confidence threats such as data exfiltration and lateral movement, rather than being consumed by manual tasks. Applied effectively, AI can help offset staffing shortfalls, reduce analyst burnout and preserve or even improve, mean time to investigate (MTTI) or MTTR metrics. Agencies that invest in AI-driven security tools now are not just responding to a short-term resource problem; they are building a more adaptive, scalable security model that can sustain performance through continued uncertainty. This is a strategic shift as much as a technical one, and cybersecurity leaders who embrace it early will be better positioned to protect their environments long-term.

Strategic Consolidation as the Path Forward

The data points toward a clear prescription: agencies must work smarter, not just harder, with the resources available to them.

On the investment side, respondents are focusing on limited resources where they will have the greatest impact: threat detection, incident response, network infrastructure modernization and process automation. Forrester recommends that agencies rationalize their security stack to eliminate overlapping capabilities, adopt consolidated platform solutions such as Endpoint Detection and Response (EDR) or unified network security platforms and reduce one-off tool purchases that contribute to sprawl and complexity. Critically, agencies should plan for sustained lean operations rather than assume a return to pre-2025 staffing or budget levels. Redesigning operating models around automation, risk prioritization and efficiency will be the defining factor for resilient agencies.

The findings from this Forrester study make one thing clear: the agencies that will emerge strongest from this period of constraint are those that treat resource limitations not as a barrier, but as a forcing function for smarter, more deliberate security strategy. By concentrating investments in high-risk areas, embracing AI and automation and consolidating their security stack, Government cybersecurity teams can build a leaner, more resilient security posture that holds up under pressure, today and in the years ahead.

Download the full study, “Smarter Security for Leaner Budgets and Teams” and join our webinar as experts and Government showcase the key findings in depth and discuss the path forward.

A commissioned study conducted by Forrester Consulting on behalf of Carahsoft and Broadcom, March 2026.

Built for This Moment (and All Those to Come) Introducing Symantec CBX: Finally, a security platform for smaller teams fighting larger threats

Posted on by Jason Rolleston

Disconnected, vendor-dependent security stacks leave smaller teams blind to threats and overwhelmed by noise they’re not equipped to manage.
Symantec CBX unifies Symantec and Carbon Black capabilities into a cloud-based XDR platform that delivers native telemetry correlation, AI-driven insights and enterprise-grade protections without enterprise-level complexity.
Built for resource-constrained teams, Symantec CBX reduces costs, cuts alert fatigue, accelerates response and gives organizations a long‑overdue advantage against increasingly sophisticated, AI-powered attacks.
See Symantec CBX in action in Booth N-5345 at RSAC 2026 Conference.

It’s time for the cybersecurity industry to face an uncomfortable truth: The tools meant to make organizations safer are often the very systems slowing them down, and sometimes leaving them vulnerable.

The problem is that security stacks are built over time from disparate tools that prevent analysts from seeing the full operating environment. Smaller security teams have relied on vendors to solve the challenge of integrating various products—and too often, vendors have fallen short, making it too difficult to gather and correlate the telemetry needed to understand what’s really happening across endpoints, networks and data.

While large enterprises have the resources to manage and integrate complex security stacks, left behind are the organizations that make up the largest swath of the cybersecurity customer market: smaller, less-resourced security teams that increasingly face AI-powered, enterprise-grade threats but lack the budgets and in-house expertise to implement enterprise-grade defenses. These sophisticated attacks can decimate smaller organizations, turning them into casualties of an escalating cyber war fueled by nefarious AI agents that never miss a day of work.

These security teams don’t just need better tools. They need an advantage. Now they have one.

XDR from the pioneer of EDR

Today, we’re introducing Symantec CBX, a groundbreaking new extended detection and response (XDR) solution that combines all the best capabilities of Symantec and Carbon Black into a unified, cloud-based platform. Symantec CBX is the first new product to integrate features from these two iconic brands. But more importantly, it’s the first fully featured XDR platform built expressly for smaller teams looking to evolve their security protections, but that lack the expertise and resources needed to configure and optimize traditional enterprise-class XDR solutions.

In Symantec CBX, we’ve distilled decades of innovation from Symantec and Carbon Black into a platform that solves the problem of correlating and making sense of telemetry across endpoints, networks and data. Typically, the various tools within security stacks attempt this via API integrations. But those fragmented couplings are often incomplete and leave dangerous gaps in visibility and actionable insight. Security analysts may understand that something is happening—they just don’t always know what it is or what to do about it.

The problem grows worse as attack surfaces expand. Organizations send more and more data to costly SIEM platforms, leading to a waterfall of challenges, from endless false positives that waste analyst time to murky outcomes that frustrate corporate management looking for evidence that security programs are working. These are costs smaller organizations can’t afford.

Symantec CBX solves this by combining into a single cloud platform Symantec’s robust prevention, data security and network security features with Carbon Black’s pioneering EDR technology for deep visibility, exceptional threat detection and rapid response across attack surfaces. Spared from log-centric ingestion, security teams detect incidents more precisely and can act more confidently.

Native correlation is just the beginning

With Symantec CBX, native telemetry correlation sits at the center of a vast array of advanced capabilities that, until today, were available only from multiple point solutions. In CBX, we have integrated breakthrough features from Symantec and Carbon Black that make teams smarter and more efficient. Here’s what security teams can look forward to:

AI that makes life easier for humans at the helm. We’ve strategically deployed AI to deliver meaningful improvements to security workflows, resulting in capabilities that simply aren’t available anywhere else. Take Carbon Black Threat Tracer, which allows any analyst to see all adversary activity in a single pane. (Even junior analysts can understand immediately where attackers came in, how they executed their attack and what data they accessed across endpoint, network, email and cloud environments.) The CBX platform also includes Symantec Adaptive Protection, which uses AI to stop living off the land (LOTL) attacks before they do damage. And Symantec’s Incident Prediction, the groundbreaking feature we introduced last year, predicts an attacker’s next four to five moves so teams can stop threat actors moving laterally to steal data or shut down systems.

More complete insights for faster remediation. Incident Summaries, another AI-powered feature, gathers comprehensive data about incidents and presents them in well-written, intuitive summaries and remediation guidance so any analyst can engage mitigation when and where it makes sense.

Enterprise-grade network and data protections. Drawing from the best of Symantec Secure Web Gateway (SWG) and Symantec DLP solutions, this new XDR platform defends the network and data domains by stopping malicious traffic at the network edge, while packaging data security essentials from our acclaimed DLP offerings to ensure that sensitive data stays where it belongs. Via the integrated Symantec Cloud SWG

Express, this new platform even supports post-quantum computing cryptography protocols, thus shielding organizations from the threat of increasingly common “harvest now, decrypt later” attacks and relieving concerns over the prospect of attackers someday unlocking encrypted data.

Meaningful outcomes and rapid time to value. Security managers are expected to continuously improve their team’s performance, but that’s not easy when disjointed solutions create needless friction and confusion, and multiple dashboards steal time from an already busy day. We built Symantec CBX with the features and unified management console that enable the outcomes security teams need most: driving down SIEM and operational costs, rescuing analysts from alert fatigue, speeding time to resolution, meeting governance requirements and demonstrating progress by improving metrics.

Out-of-the-box policy configurations make CBX easy to implement and deliver immediate value.

The Goldilocks platform for the heart of the market

Symantec CBX is aimed squarely at the heart of the cybersecurity market, empowering and enabling security teams of virtually any size with a platform that puts them first. No other XDR solution is built so specifically for organizations laboring under tight budgets, too few resources, a persistent lack of senior expertise, chronic alert fatigue and the ever-more–daunting threat of AI-powered attacks.

Symantec CBX is the XDR platform for this moment and this market. As the first new solution from Broadcom to integrate capabilities from both Symantec and Carbon Black, CBX is the realization of our strategy to deliver on the “better together” pledge we made when these two legendary brands first came together under Broadcom’s Enterprise Security Group. And it’s the ideal solution for our global network of Catalyst Partners, with their deep regional expertise and close customer relationships, as they help organizations struggling to keep up in an environment of constant change and unrelenting challenges.

Overwhelmed security teams need an advantage, and now they have one.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

This post originally appeared on Security.com, and is re-published with permission.

Keep More, Store Less: The Case for Advanced Compression in Federal EDR

Posted on by Richard Verwers

How agencies can retain full-fidelity data without overspending on storage

Endpoint detection and response (EDR) depends on data. The more telemetry you collect, the more context you have to detect threats, investigate incidents and meet Federal compliance requirements.

But data volume is also the problem. Federal agencies generate massive amounts of endpoint telemetry every day. Process activity. File changes. Network connections. User behavior. Multiply that across thousands of devices and storage requirements quickly grow beyond what many teams can sustain.

Security teams often face a difficult tradeoff: retain full-fidelity data and absorb higher storage costs, or limit retention and risk losing critical visibility.

That tradeoff is no longer necessary. Advanced data compression changes the economics of endpoint visibility. Agencies can retain unfiltered telemetry for extended periods without expanding storage budgets or adding operational complexity.

The Visibility–Storage Tradeoff is No Longer Sustainable

Federal cybersecurity requirements continue to raise the bar for telemetry collection and retention. Agencies must support Zero Trust initiatives, continuous monitoring programs and audit readiness. Modernization efforts increase the number of connected endpoints, including cloud workloads, remote systems and contractor-managed devices. Each new endpoint expands the telemetry footprint.

At the same time, budgets remain under scrutiny. Storage infrastructure must compete with other mission priorities and security leaders must justify every dollar. When storage costs climb, teams often respond in predictable ways:

Reduce retention windows
Sample or filter telemetry
Drop lower-priority event types
Offload data to external archives that are difficult to query

Each of these approaches creates blind spots. Shorter retention windows limit historical investigations and filtered data weakens threat hunting while fragmented storage slows response times.

In a threat context where adversaries can dwell quietly for months, incomplete data is a liability. Agencies need a way to collect and retain comprehensive telemetry without creating unsustainable storage growth.

Compression-First Architectures Improve Data Retention

Traditional security platforms treat compression as an afterthought. Data is collected at scale, stored in raw or lightly optimized formats and compressed later in the pipeline. By then, infrastructure costs are already locked in.

A compression-first architecture takes a different approach. Advanced compression techniques reduce data size at ingest. Telemetry is optimized as it enters the platform, not after it has consumed storage resources. The result is a significantly smaller storage footprint without sacrificing fidelity. For Federal security operations centers (SOCs), this shift has meaningful impact:

Longer retention without higher cost – Agencies can retain 180 days or more of full-fidelity telemetry while remaining within budget constraints.
Unfiltered visibility – Teams do not need to decide in advance which data might matter later. They can keep it all.
Faster investigations – Optimized storage enables efficient querying across large datasets, supporting threat hunting and incident response.
Simplified architecture – Native compression reduces the need for external storage tiers or complex archival systems.

Instead of managing tradeoffs, security teams regain flexibility.

Full-Fidelity Data Supports Compliance and Zero Trust

Federal mandates increasingly require measurable security maturity. Continuous monitoring, device-level visibility and documented audit trails are central to that effort, and retention depth matters.

When agencies can access complete endpoint histories, they strengthen their ability to:

Validate Zero Trust controls within the device pillar
Reconstruct events during forensic investigations
Demonstrate compliance with evolving Federal security requirements
Support reporting obligations tied to vulnerability and risk management

Short retention windows make it harder to answer fundamental questions: When did this behavior begin? Was lateral movement attempted? Did similar activity occur on other systems?

With compressed full-fidelity data, those questions become easier to answer and teams can look back months, not days. This level of historical visibility supports stronger analytics, more informed risk decisions and more defensible reporting.

Cost Efficiency Matters Under Federal Scrutiny

Every Federal technology investment must demonstrate operational value. Advanced compression directly addresses cost concerns in several ways:

Reduces total storage consumption
Delays or eliminates additional infrastructure purchases
Lowers operational overhead tied to managing multiple storage systems
Minimizes data movement between tiers

At the same time, it strengthens the overall security posture by preserving data that might otherwise be discarded. This combination of efficiency and depth is particularly important for agencies balancing modernization initiatives with budget discipline.

Security cannot become a cost center that expands without limit. It must scale responsibly. Compression-first EDR architecture supports that balance.

The Federal security community no longer needs to accept a compromise between cost and visibility. Advanced data compression enables agencies to:

Collect unfiltered endpoint telemetry
Retain data for extended periods
Support Zero Trust maturity
Strengthen investigative capabilities
Maintain fiscal discipline

As agencies define the next standard for Federal EDR, data strategy must be part of the conversation. Retention, accessibility and efficiency determine whether telemetry delivers long-term value.

Carbon Black and Carahsoft help Federal agencies adopt a compression-first approach to endpoint detection and response, so teams can keep more data, store less and operate with confidence.

Contact us to learn how your agency can adopt a compression-first approach to endpoint visibility while staying within budget.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Why Supply Chain Risk Management is Now a Public Sector Resilience Priority

Posted on by Jeff Ladner

From ransomware disrupting city services to vendor failures impacting school operations, supply chain failures seem to be dominating the headlines lately. Naturally, whether your organization is in the Private or Public Sector, you’ll want to avoid attracting attention for the wrong reasons.

The best way to do that is to prioritize implementing best practices to safeguard critical vendors and services from cybersecurity risks and operational disruptions. In this guide, we’ll cover the NIST framework, how it applies to Public Sector organizations and how you can use NIST best practices to reduce risk and maintain public trust. Even private sector teams increasingly rely on NIST supply chain risk management practices when working with Government partners, especially across information technology environments.

Why Is Supply Chain Risk Management Important?

Managing supplier risk should be a fundamental part of any data-based businesses’ operations, but it’s all the more important for Public Sector organizations, whether that means Federal, State or Local services.

Why? Without clear practices for identifying, assessing and mitigating vendor and operational risk, you could expose your organization to a whole host of potential issues, including:

Financial losses: Even nonprofit organizations depend on reliable financial backing from Governments and other entities. Those revenue streams can be endangered when an overlooked security risk becomes an operational blockage.
Reputational damage: Eroded consumer trust can be as costly as any disruption in service or productivity. When your organization attracts the wrong kind of attention, like for suffering a data breach or failing to fulfill obligations, earning that trust back can be a difficult feat.
Regulatory violations: In worst-case scenarios, failing to catch a supply chain risk before it becomes a major problem can lead to your organization falling afoul of relevant regulations and facing stiff consequences like fines or legal fees.

Learn more: Quick Guide: What is Operational Risk Management?

When Does an Organization Need a Supply Chain Risk Management Framework?

The purpose of using a risk management framework is to standardize the process of identifying, assessing and mitigating potential threats and vulnerabilities to your organization’s supply chain. If your organization’s ability to provide services, attract new users and secure funding would be severely impacted by a potential data breach or supply chain disruption, then you’d most likely benefit from using a framework to ensure consistent supplier security.

State, Local and education (SLED) entities are all the more likely to need a framework for regulating risk assessments and mitigation steps. Since the services provided by such entities are typically essential to a community, it’s that much more important that you take all the necessary actions to secure your supply chain and prevent service interruptions whenever possible.

What Is the NIST Risk Management Framework?

The National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) is the go-to solution public service organizations have been using to mitigate vendor, technology and cybersecurity risks for the last decade. The result of a Federal task force established in 2014 under the Federal Information Security Modernization Act (FISMA), this framework for risk management processes can be used to set standards across Federal agencies and the organizations that work with them.

Today, the NIST framework is a main point of reference for any organization looking to implement a secure and reliable process for managing cybersecurity risks and other potential supply chain issues. The framework is a living document regularly updated to meet the latest challenges in the data privacy space.

Learn more: What is NIST RMF? Risk Management Framework

What Are the NIST Best Practices for Supply Chain Management?

The 2022 revision NIST SP 800-161 offers comprehensive guidelines for handling supply chain risks related to information and communications technology. These recommendations are divided into three main categories: foundational practices, sustaining practices and enhancing practices.

Think of these categories as sequential stages. You’ll need to implement foundational practices before you move on to sustaining practices, and sustaining must come before enhancing.

1. Foundational Practices: Establishing a Process for Supply Chain Risk Management

Some of the best practices recommended in NIST SP 800-161 for creating a foundation for a supply chain risk management process include:

Dedicate a multidisciplinary team to your vendor and technology risk oversight
Create and fill dedicated roles for risk oversight procedures
Gain support from senior leadership to ensure adequate resources
Implement a governance hierarchy and a governance structure
Codify processes for identifying and assessing the criticality of your suppliers, products and services and conducting formal risk assessments, preferably using FIPS 199 impact levels
Establish internal checks and balances for compliance
Integrate risk oversight practices into your policies regarding supplier selection
Raise internal awareness and understanding of the importance of supply chain risk management
Create processes and practices for quality control and consistent development practices

Learn more: Guide: Risk Management Strategies To Future-Proof Your Organization

2. Sustaining Practices: Improving the Efficacy of Your Supply Chain Risk Management

Some of the best practices recommended in NIST SP 800-161 for building on your foundational risk management processes include:

Implement third-party risk assessments
Create a program for monitoring suppliers
Define and quantify levels of acceptable risk
Determine key supplier risk metrics and create procedures for tracking and reporting them
Formalize your information sharing procedures
Establish a training program for vendor risk practices
Integrate supply chain risk management practices into your supplier contracts
Solicit supplier participation in contingency planning and incident response
Collaborate with suppliers to address risk factors
Expand supply chain risk management training to all applicable roles across your organization

Learn more: How to Mitigate Third-Party Risks in Your Supply Chain

3. Enhancing Practices: Predicting Supply Chain Issues Before They Impact Your Business

Some of the best practices recommended in NIST SP 800-161 for building a structured supply chain risk management program include:

Codify processes for quantitative risk analysis, optimize risk response resources and measure your return on investment
Use insights gained over time to identify key risk factors and create predictive strategies to address risks before they arise
Introduce automation into your cybersecurity oversight procedures whenever possible
Join a community of practice where you can improve your cybersecurity risk management practices

Learn more: 5 Reasons Your Company Should Automate Third-Party Risk Management – Onspring

Additional NIST Resources

Organizations implementing a supply chain risk management program often reference several complementary NIST publications, including:

NIST Special Publication (SP) 800-39
NIST SP 800-30r.1
Federal Information Processing Standards (FIPS) Publication 199
NIST SP 800-53

How to Future-Proof Your Vendor Risk Program

It’s impossible to overstate the importance of recognizing and addressing risk factors in your supply chain when your organization is responsible for providing or securing local and state services. The best guide to follow when establishing or enhancing your supplier risk program is the NIST Risk Management Framework. A structured platform can help Public Sector teams manage these challenges more effectively while taking advantage of AI advancements without exposing their organizations to unnecessary risk.

See how Onspring’s platform supports these efforts and get a demo today.

Integrated Threat Hunting: A Smarter Path for Stretched Federal SOCs

Posted on by Richard Verwers

Why visibility, automation and collaboration are now mission-critical

Federal Security Operations Center (SOC) teams are under relentless pressure. Teams are increasingly stretched thin as agencies grapple with AI-enhanced threats, Zero Trust requirements and operational mandates like FISMA 2.0. Despite limited staff and growing workloads, though, the mission remains clear: defend critical infrastructure, secure sensitive data and maintain compliance.

For split-second contexts in the face of critical alerts, fragmented tools and siloed data only make matters worse. Analysts lose time switching between platforms. Revalidating and responding to quickly escalating threats takes time away from mission continuity.

Federal SOCs require integrated, intelligence-driven platforms that support end-to-end threat visibility, rapid response and secure information sharing.

Modern Federal SOCs Face Mounting Challenges

Staffing shortfalls are now a systemic issue. The cybersecurity talent gap currently exceeds 5.5 million unfilled roles globally, with Federal agencies competing for a shrinking pool of qualified professionals.

Meanwhile, tool sprawl and console fatigue complicate workflows. Analysts must juggle multiple platforms to correlate data, validate incidents and track lateral movement all while meeting increasingly complex compliance reporting mandates.

Agencies must also contend with:

AI-generated malware that evades signature-based detection
Expanding attack surfaces from hybrid environments and remote endpoints
Escalating compliance expectations tied to FISMA modernization, OMB M-24-14 and Zero Trust architecture maturity

To keep pace, teams need tools that consolidate, correlate and streamline.

Real-time Response Enhances SOC Agility

Threat impact is defined by the time it takes to respond properly. Delayed containment leads to higher costs and increased exposure. That’s why real-time response is now essential to any defensible cybersecurity posture.

Modern endpoint detection and response (EDR) platforms allow teams to:

Isolate compromised endpoints instantly
Terminate malicious processes at the source
Prevent data exfiltration in-flight
Apply automated playbooks for repeatable, standards-based remediation

These capabilities reduce manual intervention and align with CISA’s SOAR guidance, enabling SOCs to act swiftly within a Zero Trust model. For Federal teams, this also supports audit-readiness with timestamped forensic records that meet FISMA and OMB compliance requirements.

Unified Telemetry Accelerates Threat Hunting

Siloed data weakens an analyst’s ability to detect patterns and perform deep investigations. By unifying endpoint telemetry across devices and environments, teams gain access to richer datasets and longer retention windows for root cause analysis.

Carbon Black EDR captures high-fidelity endpoint activity and retains up to 180 days of telemetry, letting teams uncover threats that may have originated weeks or months prior.

With behavior-based analytics, SOCs can move past static signatures and detect anomalies faster. This involves pinpointing lateral movement, privilege escalation and indicators of compromise before damage escalates.

Collaboration and Data Sharing Reduce Operational Risk

Cybersecurity is a team sport, but without integrated data sharing, even the best defenses can fall short. Fragmented environments limit visibility, making it difficult to act on shared intelligence across tools and agency teams.

Integrated platforms streamline threat intelligence sharing through features such as:

The Carbon Black Data Forwarder, which simplifies integration with SIEM/SOAR platforms
API-driven data sharing that supports automation and collaboration
Compatibility with Zero Trust frameworks, particularly the Device Pillar of OMB M-24-14

With cross-environment visibility and collective learning, SOC teams can improve incident response while advancing cybersecurity maturity across the agency.

Work Smarter, Not Harder

Federal SOCs face high-stakes situations where time and clarity are critical and impact lives in real time. Every alert demands focus. Every decision must be defensible. To operate effectively under pressure, teams need platforms that reduce noise, unify workflows and enable smart action.

Carbon Black and Carahsoft help Federal teams do more with less. We empower analysts with the real-time insights and interoperability they need to protect what matters most.

Contact us to learn how your agency can simplify threat detection, response and collaboration with Carbon Black EDR.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

10 Healthcare Technology Predictions Shaping 2026

Posted on by Tim Boltz

Carahsoft, The Trusted IT Solutions Provider for the Healthcare Industry™, supports healthcare organizations in their mission to deliver efficient, high-quality care across the enterprise. Our comprehensive portfolio of healthcare solutions addresses critical needs across clinical systems, patient experience, enterprise operations, infrastructure and more. We help healthcare organizations streamline workflows, reduce administrative burden and improve security, maximizing the value of technology investments. As healthcare continues to evolve through regulatory changes, innovation and shifting care delivery models, these 10 trends represent the most significant opportunities and challenges facing the industry in 2026.

Interoperability: From Compliance Exercise to Strategic Asset

The 21^st Century Cures Act and the Office of the National Coordinator’s (ONC) Health Data, Technology and Interoperability (HTI)-1 Final Rule have pushed standardized Fast Healthcare Interoperability Resources (FHIR)-based Application Programming Interfaces (APIs) and expanded data classes into the market. The Center for Medicare and Medicaid Services’ (CMS) Interoperability and Prior Authorization Final Rule adds pressure on both payers and providers to exchange information seamlessly. In 2026, however, organizations that treated these regulations as checkbox compliance activities will watch competitors turn interoperability into operational advantage.

Real-time data feeds reduce prior authorization delays. Integration platforms surface insights that drive value-based care arrangements. Data warehouses built for exchange, not just storage, become the foundation for population health management. The early adopters are not just meeting regulatory requirements. They are using data exchange to reduce administrative burden, improve care coordination across settings and unlock revenue opportunities that siloed systems leave on the table.

The Transparent Use of AI in Healthcare

In 2026, healthcare leaders will shift from asking should they use AI to how to document and explain it. The HTI-1 Final Rule introduced algorithm transparency requirements: disclosure when artificial intelligence (AI) and machine Learning (ML) algorithms influence clinical decisions. Clinical teams need to understand when AI-driven insights are guiding care recommendations, and patients deserve to know when algorithms influence their treatment plans.

Regulatory bodies expect organizations to prove their AI tools meet safety and efficiency standards. The organizations that move early on AI governance frameworks, establish clear documentation standards and train clinicians on algorithm literacy will be ready when transparency moves from recommended to required.

AI will also be used as the voice of healthcare. Call center staff miss operational targets by spending 25 minutes on a single call, AI, however, can make 50+ simultaneous calls while giving each patient the time they need. This capability transforms patient engagement at scale. AI enables follow-up with 100% of discharges, identifying interventions that prevent readmissions and materially impact the quadruple aim: better outcomes, better patient experiences, lower costs and improved clinician satisfaction.

Telemedicine Shifts to Integrated Care Model

Telemedicine exploded during the pandemic as an emergency solution. In 2026, leading organizations will stop treating telehealth as a separate channel and start embedding it into the care continuum. Digital front doors guide patients to the right care setting, whether that is video, in-person or asynchronous messaging.

The technology exists and the patient demand has been proven, but what is missing is the operational maturity to weave virtual care into clinical workflows, reimbursement models and quality measurement. Organizations that integrate this technology into their environments will deliver better access without fracturing the care experience.

The Revenue Cycle

Healthcare organizations have been exploring AI in clinical settings (ambient documentation, diagnostic support, care coordination), but the revenue cycle may deliver faster more measurable returns. Prior authorization is a prime target. AI can automate the documentation assembly, predict approval likelihood and flag missing information before submission.

Coding accuracy is another opportunity. Natural Language Processing (NLP) tools can analyze clinical documentation and suggest appropriate diagnosis and procedure codes, reducing claim denials and capturing revenue that incomplete documentation would lead to. The Chief Financial Officer (CFO) conversation around AI will shift in 2026. Revenue cycle leaders will demonstrate tangible Return on Investment (ROI): fewer denials, faster reimbursement and reduced administrative costs. These wins will fund broader AI adoption across the enterprise.

Value-Based Care

The shift to value-based care has been talked about for years, but 2026 is when data infrastructure limitations become impossible to ignore. Value-based contracts require organizations to track outcomes across care settings, measure quality metrics in real time and identify high-risk patients before they become high cost. Siloed Electronic Health Records (EHRs), fragmented data warehouses and manual reporting processes cannot support these requirements.

Organizations need integration platforms that pull data from multiple sources, such as inpatient, outpatient, lab, pharmacy and claims. They need analytics tools that surface actionable insights, not just dashboards, and they need governance frameworks that ensure data quality and consistency.

The healthcare organization succeeding in value-based arrangements are not necessarily the largest or best-resourced. They are the ones that invested early in data infrastructure and developed the analytical capabilities to turn information into action.

Cybersecurity: From IT Issue to Board-Level Risk

The proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Security Rule published December 2024 represents a significant escalation in regulatory expectations. If finalized in 2026, covered entities will face requirements for data encryption, Multi-Factor Authentication (MFA), network segmentation, vulnerability scanning and penetration testing. The Department of Health and Human Services’ (DHHS) Cybersecurity Performance Goals provide a voluntary framework, but the proposed HIPAA updates suggest these practices may become mandatory.

Chief Information Security Officers (CISOs) who can translate technical risks into business impacts will gain influence. Organizations that invest in both technology controls and governance frameworks will build resilience that extends beyond compliance checkboxes. Organizations that elevate cybersecurity to a strategic priority will be better prepared when threats escalate.

The Digital Front Door

Patient expectations have changed. People expect to schedule appointments, complete intake forms and access their health information online. The digital front door is more than a patient portal. It is a comprehensive strategy to meet patients where they are. In 2026, leading organizations will integrate digital patient engagement tools into a seamless experience, reducing administrative burden on staff, improving patient access and generating operational efficiencies.

However, digital tools that do not connect to existing workflows create more problems than they solve. Integration of patient-facing technology with operational systems eliminates duplicate work and improves patient and staff experiences.

Rural Healthcare Transformation

The Rural Health Transformation Program represents the most significant Federal investment in rural healthcare infrastructure with $50 billion over five years, starting in 2026. This funding creates opportunities for technology investments that rural hospitals and health systems, particularly patient-facing solutions, technical assistance for IT and cybersecurity and innovative care models that often depend on digital tools.

Rural organizations that prepare strong applications will access resources that can transform their operational capabilities. However, rural organizations often lack the IT staff, strategic planning capacity and vendor relationships that larger systems have. The organizations that succeed in securing and deploying these funds will be those that partner with experienced implementation teams, prioritize high-impact use cases and build sustainable technology roadmaps.

Technology vendors and solution providers should pay attention to this program. It represents a market opportunity to support underserved communities with solutions that improve access, reduce costs and strengthen resilience.

Workforce Solutions Beyond Scheduling and Talent Management

Healthcare’s workforce crisis continues as burnout and turnover remains high. Traditional solutions help but do not solve the underlying challenges and impact staffing shortages have on care delivery and patient experience. In 2026, forward-thinking organizations will expand their workforce technology strategy beyond administrative efficiency to include tools that directly reduce clinician burden and improve job satisfaction.

Clinical and operational technologies improve the work experience, and organizations that recognize this and invest accordingly will differentiate themselves in competitive labor markets. Workforce development technology such as training platforms, competency management systems and career advancement tools can help organizations grow talent internally rather than recruiting externally. This is especially valuable for rural hospitals that cannot compete with compensation alone. The organizations that treat workforce challenges as technology opportunities will build more resilient, engaged and effective teams.

The Role of Process Automation

Healthcare has embraced automation is administrative functions like claims processing, appointment reminders and billing. These applications deliver clear ROI and do not require clinical engagement. Clinical applications, however, require different considerations than back-office automation. These workflows involve judgement, variability and patient safety concerns.

Automation in clinical settings requires trust. Clinicians need to understand how automated processes work, when to intervene and how to escalate exceptions. IT and operational leaders need to ensure automation enhances workflows rather than creating workarounds that introduce new risks. Healthcare organizations that approach automation thoughtfully will reduce burden, improve efficiency and demonstrate that technology can support instead of complicate clinical work.

These trends represent opportunities for healthcare organizations to leverage technology in pursuit of better outcomes, improved efficiency and stronger financial performance. The organizations with clear priorities, engaged leadership and commitment to implementation will position themselves for success. As regulatory requirements evolve and patient expectations rise, technology partnerships become essential to delivering high-quality care while managing costs and operational complexity.

Explore Carahsoft’s Healthcare Technology solutions portfolio to discover compliant, secure solutions tailored for healthcare organizations.

Download Carahsoft’s Healthcare Buyer’s Guide to evaluate solutions that meet your organization’s operational and compliance requirements.

Contact the Healthcare Team at (571) 591-6080 or Healthcare@carahsoft.com to discuss solutions that accelerate your technology adoption.

Endpoint Detection and Response (EDR) and Federal Cybersecurity Mandates

Posted on by Craig Picken and Elizabeth Schultheisz

Federal cybersecurity mandates are constantly evolving to keep pace with a rapidly changing technological ecosystem, focusing primarily on visibility and record-keeping within software architecture. Endpoint Detection and Response (EDR) remains a steadfast and reliable investigative tool, tracking, alerting to and aiding resolution of suspicious endpoint activity across an agency’s siloed infrastructure.

“Never Trust, Always Verify” With EDR

As malicious actors’ methods and priorities shift the Federal Government’s must evolve as well. Current cybersecurity mandates emphasize a Zero Trust approach, focusing on verifying all end users and devices in near real-time. These mandates should be considered the minimum requirement for an agency’s cybersecurity posture. Agencies should deploy multiple verification and prevention technologies to secure those endpoints.

An effective EDR solution can quickly distinguish between normal and anomalous activity in Federal endpoints. Its continuous monitoring is critical for rapidly assessing a threat before sensitive information can be stolen and leaked. Cyber attackers use sophisticated techniques, including artificial intelligence (AI) to gain an advantage. With EDR, Security Operations Center (SOC) analysts can forensically examine the chain of events and not only resolve an issue but proactively set up safeguards to prevent future incidents.

As the threat landscape evolves, it is important not to get caught up in buzzwords such as “modern” EDR. Typically “modern” means that the solution requires cloud connectivity, which can leave crucial blind spots in areas including air-gapped, limited connectivity or other disadvantaged environments. While new EDR capabilities are always being developed, the fundamental aspects have always remained the same. Visibility, as always, is the most crucial of all. An effective EDR solution is feature-rich, mature and can monitor in diverse environments.

Carbon Black EDR: Visibility on All Fronts

Regarding Public Sector cybersecurity, the primary objective is to protect the entire environment, from air-gapped and cloud environments to end-of-life operating systems. As the founders of EDR, Carbon Black offers a mature solution that can be configured to alert SOC teams to previously unknown, potentially interesting activity. By using open Application Programming Interfaces (APIs), agencies can retain total data sovereignty and pass it off to Security Information and Event Management (SIEM) systems.

Carbon Black EDR offers a full lifecycle cybersecurity solution. The solution proactively and continuously monitors all endpoints and is compatible with multiple integrations. Through watchlists, threat intelligence and other methods, Carbon Black EDR detects anomalous or malicious activity and helps SOC analysts respond through various means. SOC teams can also visualize the progression of the attack through diagrams or timelines. This customizable threat intelligence allows Carbon Black EDR to be a well-rounded solution for any agency looking to align with Federal cybersecurity mandates.

A mature, effective EDR solution always has endpoint activity awareness at the forefront, giving SOC analysts unparalleled visibility into their environment. This focus is crucial, as Federal mandates continue to focus on a Zero Trust approach to cyber security. Increasing your endpoint visibility through EDR not only improves reaction time during a crisis incident but allows SOC teams to proactively prevent future cyberattacks.

Want to learn more about how Carbon Black EDR enhances your endpoint visibility? Contact our Broadcom team at Broadcom@carahsoft.com or visit our website.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

How Endpoint Detection and Response (EDR) Creates a Successful Cybersecurity Posture

Posted on by Craig Picken and Elizabeth Schultheisz

Stringent cybersecurity measures are crucial to secure Public Sector operations, and Endpoint Detection and Response (EDR) is a critical tool in that belt. Malicious adversaries range from rogue actors to nation-state-sponsored attacks, and all frequently target specific organizations that deal with highly sensitive data. By itself, EDR can quickly identify abnormal behaviors or code and help the SOC analyst team respond accordingly. When paired with other Security Operations Center (SOC) tools, EDR further broadens SOC visibility and increases operational efficiency. Federal agencies can use that intelligence to not only resolve security breaches, but also proactively adjust their security measures to prevent further incidents.

All Eyes on the Data: EDR and Data Visibility

Visibility is a fundamental tenet of EDR. When SOC teams have access to data that is current and actionable, they can make calculated, proactive decisions and respond appropriately in crisis scenarios. An effective EDR tool will monitor existing data, detect anomalous behavior and respond to threats in real time.

Data from across multiple sources is recorded and compared against watch lists that SOC analysts can use to search for anomalous activities. Additionally, known threat vectors are continuously monitored in near real-time, and analysts are automatically alerted to suspicious behavior. EDR looks at all endpoint activity, not just individual data silos, and presents that raw data to SOC analysts in a usable, searchable manner.

Efficiency and Data Quality: Two Sides of the Same Coin

It is not just the quantity of data SOC teams can access that matters; the quality of the data is just as crucial. Chief Information Security Officers (CISOs) and SOC teams need to make fast, defensible decisions in both routine and crisis scenarios. Analysts do not have the time to sift through all alert activity and determine those that need immediate response. An effective EDR solution allows for tuning of watchlists to prioritize alerts. By receiving higher fidelity alerts, SOC analysts optimize time spent investigating and providing real-time response by isolating endpoints or acting directly to terminate suspicious processes.

It is not enough for security alerts to be prioritized; if the information is unreliable or incomplete, any analyses or flags extrapolated from that data are virtually worthless. A data-based EDR solution allows SOC analysts to resolve issues quickly, reducing the risk of faulty decisions.

Carbon Black EDR: The Premier Option

After observing the need for security and visibility in endpoints, Carbon Black was founded and pioneered EDR. Its open architecture with Application Programming Interfaces (APIs) makes it possible to correlate the data with other SOC tools, such as network, identity, endpoint protection and data protection tools. Additionally, Carbon Black EDR can integrate with different security products, including Security Information and Event Management Systems (SIEMS). This holistic vision allows SOC teams to understand the entire lifecycle of potential attacks, and accurate data ensures that analysts know exactly what, where and how an incident occurred.

This layered approach to cybersecurity is especially valuable to the Public Sector. Many Federal teams work in multiple siloed or air-gapped networks, and each of these networks have different functions. Carbon Black EDR has the flexibility to be deployed in multiple environments and tailored to their individual operations.

Want to learn more about how Carbon Black EDR can elevate your cybersecurity posture? Contact our Broadcom team at Broadcom@carahsoft.com or visit our website.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.