Category Archives: Department of War

The Year of Expansion for GenAI in Government

Posted on by
Reply

Generative AI (GenAI) is entering a pivotal new phase in 2026, marked by rapid advances in accuracy, reliability and mainstream integration. In 2025, GenAI became embedded into our everyday lives – from AI-generated overviews in search engines to classrooms adapting to powerful, readily accessible large language models. At the Federal level, 2025 White House guidance instructs agencies to push forward with AI infrastructure, building secure data centers to support the compute necessary in implementing innovative, American-built AI into our most vital missions.

GenAI’s unique content generation capabilities can be used to increase efficiency and productivity in our US Government agencies in the form of chatbots, text-to-speech audio generation, AI task managers, coding assistance and other Natural Language Processing (NLP) models. With the rising momentum created by America’s AI Action Plan and increased budgets for AI in areas such as the Department of War (DoW) and Veteran Affairs (VA), 2026 is the year of expansion for GenAI.

Augmenting Agencies in Task Execution

In Government agencies, GenAI commonly removes routing and repetitive workflows, freeing up users to focus on strategic tasks. GenAI works best in mission-support roles, supplementing human roles by improving written communication, increasing the efficiency of accessing information, enabling program status tracking and more. Personalized learning paths and AI assistants can augment current roles.

There are various use cases for GenAI. Program-specific examples include:

  • Defense
    • The DoW has deployed GenAI.mil – a secure, bespoke platform that leverages generative AI to enhance efficiency, speed and operational effectiveness in our most critical defense and national security missions.
  • FEMA & NOAA
    • In inclement situations, GenAI has been used to perform tasks like weather [CA1] and disaster prediction and response. Some GenAI models have even been more accurate than traditional deterministic models, suggesting GenAI has a strong use case in research and science.
  • GSA
    • GSI has launched USAi, a secure GenAI evaluation suite that has helped employees draft emails, generate code and summarize documents.
  • The Department of Veterans Affairs
    • GenAI has been used to automate various medical imaging processes to enhance veterans’ diagnostic services.
  • Healthcare & Department of Health and Human Services
    • Generative AI has enabled healthcare systems to enhance medical images, generate molecular structures for potential drugs and create realistic patient data for AI training.
    • To support containment of the poliovirus, the Department of Health and Human Services initiated an effort to use GenAI to extract information from publications and identify outbreaks in areas previously thought to be polio-free.

Procurement of GenAI solutions is being simplified and expedited by the Federal Government, increasing agencies’ ability to use innovative solutions to solve complex problems. GSA’s OneGov strategy delivers generative AI to the government by removing a major barrier to AI adoption: cost. Through the OneGov agreements, popular GenAI solutions are available for $1, and agencies are given the opportunity to experiment with AI and see what works best for their specific use cases. This strategy aligns with America’s broader AI policy framework – allowing agencies to take advantage of the speed, automation and modernization capabilities provided by AI. Carahsoft’s dedicated OneGov page serves as a centralized resource for determining product availability and identifying procurement pathways.

Federal Guidance for AI Usage

GenAI is already being used successfully in the US Government, and recent Federal guidance cements AI’s place in Government operations. 2025 executive orders (EO’s), such as “Removing Barriers to American Leadership in Artificial Intelligence” pave the way for increased usage of the technology. See below for an overview of relevant generative AI-focused memos and EO’s released in the last few months.

Launching the Genesis Mission – November 24, 2025

The Genesis Mission establishes AI at the forefront of scientific and economic growth and calls for an integrated platform to enable AI-automated research and discovery. The next wave of federal AI will prioritize scalable compute orchestration, secure model training environments, hypothesis-testing AI agents, supply-chain rigor, and measurable national return on investment that will be evaluated by acceleration in discovery velocity, compressed innovation cycles, and compounding mission impact – not extended pilots.

Ensuring a National Policy Framework for Artificial Intelligence, December 11, 2025

This EO adds on to previously established framework by ensuring state-by-state regulatory laws do not act as barriers to fast AI adoption, and that ideological bias is not embedded into AI tools used within each state. By creating a unified framework, America will become the winner of the AI race.

M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles, December 11, 2025

In response to Executive Order 14319, OMB released M-26-04 which establishes principles for unbiased AI: that it is truth-seeking, and that it is ideologically neutral. All LLM’s procured by a government agency must abide by the unbiased AI requirements established in this memo.

Transforming the Defense Innovation Ecosystem to Accelerate Warfighting Advantage, January 9, 2026

This DoW memo formalizes AI as a core warfighting capability across DoW operations and streamlines integration and acceleration of adoption.

War Department’s AI Acceleration Strategy to Secure American Military AI Dominance, January 11, 2026

The DoW’s January 2026 memo outlines their AI dominance strategy. It calls for establishing an AI-first warfighting force – echoing earlier EOs and removing barriers that would hinder adopting practical, mission-first AI solutions for DoW. It highlights the previously mentioned GenAI.mil program that provides direct access to leading GenAI solutions for the DoW, enhancing speed and ease of AI adoption.

Department of War’s Arsenal of Freedom Tour, January 2026

A new “AI Swat Team,” led by the CDAO, is charged with removing barriers and increasing data sharing to speed up AI deployment. The DoW’s AI strategy, and the SWAT team enforcing it, shows that their measure of AI success is how fast usable data reaches operational systems. Organizations that improve data access, quality, and interoperability will be able to maintain strategic advantage.

Recent guidance establishes a framework for AI adoption and usage, enabling fast, common-sense deployment to ensure America wins the AI race. While agencies are encouraged to push forward, they must maintain the highest levels of security.

Building the Foundation for Successful Generative AI in Government

As Generative AI moves beyond pilot programs and into operational use, agencies must ensure these systems meet the established requirements for security, reliability and data protection. GenAI is dynamically generating content, so it must be deployed within secure environments where sensitive information remains protected and outputs are grounded in trusted data sources. Federal guidance emphasizes strong governance, secure infrastructure and validation mechanisms to ensure AI-generated outputs remain accurate and mission-relevant. With these controls in place, agencies can scale Generative AI to support mission execution while maintaining full confidence in the integrity of their systems and data.

Current Federal recommendations include utilizing and onboarding:

  • Risk management solutions
  • On-prem and cloud data security
  • Impact Level (IL) 5 and 6 security standards for mission-critical or classified information
  • Air gapping, which physically isolates computer systems and networks to avoid breaches
  • Model Context Protocol (MCP), the universal open standard for connecting AI applications to external systems
  • Zero Trust Architecture (ZTA), the foremost security strategy that verifies the identity of end users as they access the network
  • Data governance for Retrieval-Augmented Generation (RAG), which enables content filtering and identity validation

Agencies are strongly encouraged to draw on guidance from reputable experts, including the National Institute of Science and Technology (NIST), whose AI Risk Management Framework (RMF) offers a proven foundation for responsible adoption. In addition to technical protocols, it is helpful to keep a human in the loop to audit and observe GenAI output, minimizing chatbot errors. Cybersecurity considerations, including data poisoning, data leakage and hallucinations, must be actively monitored to ensure models operate safely and consistently across Government missions.

Keeping security at the forefront is vital for GenAI’s success in Government. With thoughtful governance and strong safeguards, GenAI can advance agency missions without compromising security. The stakes are high, but so is the opportunity.

As The Trusted IT Solutions Provider for Government™, Carahsoft offers a comprehensive portfolio of AI and GenAI solutions designed to meet the unique security, compliance and operational requirements of Federal, State and Local Government agencies. From secure on-premises deployments to cloud-based platforms that meet Impact Level 5 and 6 standards, Carahsoft’s technology partners deliver the tools agencies need to implement AI responsibly and effectively.

Visit Carahsoft’s AI Solutions portfolio to explore GenAI platforms, risk management frameworks and Zero Trust security solutions that align with Federal guidance and support mission-critical operations.

Explore OneGov offerings available through Carahsoft.

Contact Carahsoft’s AI team to discuss how GenAI can transform your agency’s workflows while maintaining the highest security standards.

The Top 5 Insights from AFCEA West 2026 

Posted on by
Reply

Naval leaders gathered at Armed Forces Communications and Electronics Association (AFCEA) West Conference delivered a clear message: the sea services are undergoing their most significant transformation in decades to meet an increasingly complex threat environment. Admiral Daryl Caudle, Chief of Naval Operations’ (CNO) emphasis on achieving 80% combat surge readiness to the Marine Corps’ accelerated force design modernization, the discussions revealed the Navy and Marine Corps are fundamentally rethinking how they train, equip and fight as an integrated force. 

The conversations that unfolded across multiple panel sessions painted a comprehensive picture of both the challenges facing the sea services and the innovative solutions being implemented to address them, from generating readiness across all domains to resourcing maritime dominance and integrating emerging technologies.  

Here are the five key insights that will guide the future of maritime superiority. 

1. Achieving 80% Combat Surge Readiness Requires Foundational Investment in People and Platforms 

The CNO established “80% combat surge ready” as the target resiliency metric. This threshold is designed to ensure the Navy can execute and provide desired outcomes during relative peace while maintaining capacity to surge when needed. In the panel titled “Generating Readiness Across All Domains,” Commander Naval Surface Forces Vice Admiral Brendan McLean spoke with several naval leaders and emphasized that if the fleet struggles now during peacetime operations, the challenges will become insurmountable when conflict begins. 

This combat surge readiness target represents more than a numerical goal; it reflects a fundamental shift in how the Navy approaches fleet generation. The foundry concept places Sailors first, recognizing that the most important weapon system remains the individual Sailor or Marine and their ingenuity, toughness and capabilities. Training must focus on developing mastery and self-sustainment rather than simply checking qualification boxes – we must train like we’re going to fight. 

Achieving this readiness level demands addressing critical infrastructure challenges, particularly in maintenance and sustainment. Supply chain effectiveness emerged as another critical factor. Submarine forces, for example, have driven gross effectiveness and net effectiveness metrics up 40% in two years by improving configuration change processes, conducting enhanced audits and working with Naval Supply Systems Command (NAVSUP) to overcome bureaucratic barriers. 

2. Force Design Modernization Accelerates Lethal Capabilities to the Tactical Edge 

Force design represents a fundamental rethinking of Marine formations and employment concepts. The Marine Littoral Regiments (MLR) and Marine Expeditionary Units (MEU) are designed as inherently dispersed, mobile units with lower signatures that complicate adversary targeting. These formations create hard-to-hit postures that enable forces to persist in contested environments, strengthening the entire naval force. 

Force design remains a journey rather than a destination, characterized by continuous learning and adaptation. Marine Corps leaders described how early force design decisions around infantry battalions have evolved through experimentation and wargaming, building resiliency back into formations while incorporating small unmanned aerial systems and other emerging technologies. The ability to operate from austere locations ashore through Expeditionary Advanced Base Operations (EABO) supports Distributed Maritime Operations (DMO) by creating multiple dilemmas for adversaries unsure of where the next threat will emerge. 

3. Information Dominance Powers Decision Advantage in Contested Environments 

Information warfare capabilities and the ability to make decisions faster than adversaries define success in contested maritime operations. As information warfare leaders emphasized, the side that wins is the side able to decide and act fastest, and the commander who generates and maintains tempo puts the adversary on the defensive. The Maritime Operations Center (MOC) emerged as a critical node for generating this decision advantage. With responsibility for battlespace awareness, integrated fires and assured Command and Control (C2), MOCs are evolving beyond traditional command centers to become dynamic fusion centers that leverage multiple sensors, shooters and C2 nodes across all domains.  

Artificial intelligence (AI) is transforming how information flows into operational decisions. Leaders described AI not as a replacement for human judgment, but as a battle partner that curates vast amounts of data and presents options to decision makers. Technology experts such as Alteryx, CrowdStrike, Quantum and RegScale understand that the most valuable contribution of AI to defense will be to help human beings make better, faster and more precise decisions, especially in combat, where decision makers often face overwhelming volumes of conflicting data. 

Building information dominance requires cultural transformation around information sharing. Leaders acknowledged the tension between traditional need-to-know restrictions and the imperative to create truly data-centric environments where information flows seamlessly to support distributed operations. The challenge extends beyond technology to include standards, governance and trust frameworks that enable sharing intelligence and operations synchronization in real time across services, combatant commands and coalition partners. 

4. Distributed Maritime Operations Demands Seamless Blue-Green Integration 

The integration of Navy and Marine Corps forces for DMOs represents the operational approach designed to counter adversary anti-access and area denial strategies in contested environments. As fleet commanders emphasized, this integration creates exponential expansion in capability rather than simple force multiplication. 

One Marine Expeditionary Force’s (MEF) integration with Third Fleet demonstrates how this concept translates to operational reality. The ability to operate small, dispersed and mobile formations from austere locations ashore forces adversaries into complex dilemmas. Additionally, Marine aviation provides critical enabling functions that tie distributed operations together, such as Intelligence, Surveillance and Reconnaissance (ISR), electronic warfare, aviation ground support and more. 

Training infrastructure must evolve to support this level of integration. The Surface and Mine Warfighting Development Center (SMWDC) now conducts Information Warfare Advanced Team Training integrated with Surface Warfare Advanced Tactical Training (SWAT) events, bringing Warfare Tactics Instructors (WTI) together with Strike Warfare teams to refine tactics, techniques and procedures based on operational lessons learned. 

5. Industry Partnership at Speed Accelerates Innovation to Operational Forces 

The Red Sea operations demonstrated how Government, industry and laboratory partnerships operating at unprecedented speed can deliver operational advantage. What previously required a month to analyze engagement data, develop software updates and deploy improvements to ships was compressed to two days.  

Naval leaders issued clear guidance to industry on critical capability gaps. Obsolescence management emerged as a priority challenge, and industry partners who must maintain expertise will be critical. Open architecture and intellectual property access would enable faster adaptation to provide products when and where needed without waiting for single suppliers. 

The newly established Naval Rapid Capabilities Office (NRCO) demonstrates institutional commitment to accelerating innovation. Within three months of establishment, the office has inducted six to seven systems. The process emphasizes demoing and testing rather than lengthy development cycles and getting capabilities into operator hands for evaluation before scaling production. 

Carahsoft, The Trusted Government IT Solutions Provider™ excels at achieving rapid delivery through our partner vendors. We connect naval commands with industry partners specializing in open architecture systems, AI-driven analytics, cybersecurity solutions and emerging technologies that address critical capability gaps. Our established contract vehicles streamline procurement timelines, enabling defense organizations to move from requirement identification to deployment at the speed operations demand to support mission-critical modernization efforts. 

Charting the Course for Maritime Dominance 

AFCEA West 2026 reinforced that sustained maritime dominance requires synchronized progress across people, platforms, concepts and partnerships. The Navy and Marine Corps are not simply acquiring new technologies; they are fundamentally transforming how they organize, train and fight as an integrated naval force prepared for high-end conflict. 

The 80% combat surge readiness target, accelerated force design fielding, information warfare integration, distributed maritime operations and industry collaboration at speed represent interconnected elements of a comprehensive modernization strategy. Success depends on maintaining focus on foundational capabilities, such as trained Sailors and Marines, maintained platforms, resilient networks and proven tactics, while rapidly integrating emerging technologies that provide decision advantage. 

As Carahsoft, The Trusted Government IT Solutions Provider™, continues supporting defense modernization, the insights from AFCEA West 2026 inform how industry can best partner with the sea services to deliver the capabilities required for maritime superiority in an era of great power competition. 

Explore Carahsoft’s Defense Technology portfolio of leading solutions that support naval modernization priorities including AI, cybersecurity, cloud infrastructure and advanced analytics. 

Contact us at (888) 662-2724 or NavyInc@carahsoft.com to discuss how Carahsoft’s technology partners can support your mission requirements. 

Top 10 DoW Events for Government in 2026 

Posted on by
Reply

As the Department of War (DoW) navigates an increasingly complex threat landscape, staying at the forefront of technological innovation and strategic collaboration is mission critical. In 2026, DoW stakeholders will have several opportunities to engage with senior military leaders, explore defense technologies and strengthen partnerships across the defense and Intelligence Communities (ICs). Carahsoft Technology Corp., The Trusted Government IT Solutions Provider®, has deep expertise supporting the DoW through our extensive portfolio of cybersecurity, cloud, artificial intelligence (AI) and mission-focused solutions. Below are the top DoW events where Carahsoft and our partners will be advancing defense innovation and operational readiness. 

Sea-Air-Space 

April 19-22, 2026 | National Harbor, MD | In-Person Event 

Sea-Air-Space 2026 is the premier global maritime exposition hosted by the Navy League of the United States at the Gaylord National Resort & Convention Center in National Harbor, Maryland. It brings together senior military leaders, Government officials, defense industry executives and technology innovators to explore the latest advancements in maritime and naval security, operations and technology. The event features extensive exhibit halls, keynote speakers, expert panels, networking opportunities and discussions on integrated approaches to maritime defense and emerging threats.  

Sessions to look out for: 

  • Multi-Domain Integration and Naval Expansion in the Space Age 
  • From Concept to Capability: Aligning Autonomy Across our Maritime Forces 
  • Sea Power and National Defense: Naval and Coast Guard Readiness 

Throughout the three-day exhibit, Carahsoft is dedicated to supporting maritime and naval professionals with 48 live vendor demonstrations showcasing real-world use cases and defense solutions. Our team of defense technology experts will be on-site to provide personalized consultations, answer questions about procurement pathways and connect you with solutions that address your specific operational requirements. Stop by to explore how our partners’ innovations can enhance mission readiness across the sea services. 

Modern Day Marine 

April 28-30, 2026 | Washington, DC | In-Person Event 

Modern Day Marine 2026 is the largest military equipment, systems, services and technology exposition uniquely focused on supporting the U.S. Marine Corps, taking place at the Walter E. Washington Convention Center in Washington, D.C. It brings together Marines, DoW leaders, industry partners and authorized Government representatives to explore warfighting innovations, interactive exhibits and demonstrations. The event features more than 350 exhibitors, expert briefings, live technology showcases and specialized activities like the OBJ1 Wargaming Convention and themed zones highlighting emerging capabilities.  

Sessions to look out for: 

  • Logistics Command Artificial Intelligence Symposium 
  • Ground Systems Enterprise Senior Leader Symposium 

Carahsoft is proud to support the Marine Corps community at Modern Day Marine 2026 with engaging live demonstrations of mission-critical technologies designed to enhance warfighting capabilities. Our team will provide Marines and DoW leaders with expert guidance on innovative solutions in AI, cybersecurity, logistics automation and battlefield communications. Visit our space to experience firsthand how these technologies can strengthen operational effectiveness and connect with our specialists who understand the unique challenges facing the Marine Corps today. 

GEOINT Symposium 

May 3-6, 2026 | Aurora, CO | In-Person Event 

The Geospatial Intelligence (GEOINT) Symposium 2026 is the nation’s largest gathering of GEOINT professionals, organized by the U.S. Geospatial Intelligence Foundation (USGIF) at the Gaylord Rockies Resort & Convention Center in Aurora, Colorado. It brings together Government, military, industry and academic leaders to explore how GEOINT technologies and partnerships are shaping national security, defense and global decision-making. The event features main-stage sessions, panel discussions, an expansive exhibit hall, networking receptions and opportunities to engage with emerging innovations across land, sea, air, cyberspace and space domains. GEOINT Symposium serves as a key forum for collaboration, professional development and advancing the role of GEOINT in addressing complex geopolitical and security challenges. 

Carahsoft is committed to advancing GEOINT capabilities for the defense and intelligence communities at GEOINT Symposium 2026. Our live demonstrations will highlight cutting-edge solutions in geospatial analytics, AI-powered intelligence platforms and secure data integration designed specifically for GEOINT professionals. Connect with our team of specialists who bring deep expertise in supporting Government geospatial missions and can provide tailored guidance on implementing technologies that enhance decision-making across all operational domains. 

SOF Week 

May 18-21, 2026 | Tampa, FL | In-Person Event 

Special Operations Forces (SOF) Week 2026 is the premier annual international conference and exposition for the SOF community in Tampa, Florida. Jointly sponsored by U.S. Special Operations Command (USSOCOM) and the Global SOF Foundation, it brings together special operators, defense industry leaders, Government officials and global partners to connect, share insights and advance capabilities relevant to modern special operations missions. The event features keynote sessions, professional development panels, extensive exhibition halls, live demonstrations and networking opportunities that foster collaboration.  

Carahsoft is honored to support the Special Operations Forces community at SOF Week 2026 through our partner pavilion showcasing innovative, mission-ready solutions tailored to the unique requirements of SOF operations. Our presence provides special operators and defense professionals with direct access to advanced technologies in secure communications, tactical AI applications, cyber capabilities and specialized equipment. Our dedicated SOF solutions team will be available throughout the event to provide consultations, demonstrate how these technologies perform in challenging operational environments and discuss procurement pathways that support rapid capability delivery to warfighters. 

TechNet Cyber 

June 2-4, 2026 | Baltimore, MD | In-Person Event 

TechNet Cyber 2026 is a flagship three-day cyber defense conference and exposition hosted by AFCEA International at the Baltimore Convention Center. It brings together U.S. Government and military cyber professionals, industry leaders and academic experts to address pressing cybersecurity challenges, emerging threats, policy, operations and technology integration in the contested cyberspace domain. The event features keynote addresses, panel discussions and an extensive exhibit hall where participants can explore innovative solutions and tools designed to strengthen secure, resilient cyber operations across defense and national security missions.  

Carahsoft is dedicated to supporting military and Government cyber professionals at TechNet Cyber 2026 through our partner pavilion featuring innovative cyber defense solutions addressing the most pressing threats facing DoW networks. Our cybersecurity specialists will provide personalized consultations on Zero Trust Architecture, AI-powered threat detection, secure cloud operations and compliance frameworks essential to defending critical information systems. Visit our pavilion to explore technologies proven in Government environments, engage with experts who understand DoW cybersecurity requirements and discover resources that can strengthen your organization’s cyber resilience. 

TechNet Augusta 

August 17-20, 2026 | Augusta, GA | In-Person Event 

TechNet Augusta 2026 is a regional defense and cybersecurity conference and expo hosted by AFCEA International in Augusta, Georgia. It brings together military, Government and industry professionals, especially those involved with Army cyber operations and unified land operations, to share insights, collaborate on cyber electromagnetic activities and discuss emerging challenges in the cyber domain. The event features educational sessions, networking opportunities and exhibits aimed at fostering communication, problem solving and innovation between the military and the commercial sector. 

Carahsoft is committed to supporting Army cyber operations and unified land operations professionals at TechNet Augusta 2026. Our booth will feature live demonstrations of cyber and IT solutions specifically designed to address the challenges of cyber electromagnetic activities and defensive cyber operations. Connect with our team of Army-focused technology specialists who can provide expert guidance on implementing solutions that enhance tactical network security, improve cyber situational awareness and accelerate digital transformation initiatives across Army installations and mission systems. 

TechNet Indo-Pacific 

October 27-29, 2026 | Honolulu, HI | In-Person Event 

TechNet Indo-Pacific 2026 is a major strategic defense conference and exposition in Honolulu, Hawaii, co-sponsored by AFCEA International and AFCEA Hawaii. It is the largest event of its kind in the Indo-Pacific Rim, bringing together military, Government, industry and academic leaders to address evolving regional security challenges, defense policy and operational readiness specific to the Indo-Pacific theater. The symposium features keynote speakers, panel discussions, professional sessions and an expansive exhibit hall where organizations showcase technologies and solutions to support secure, resilient communications and multi-domain capabilities.  

Carahsoft is dedicated to supporting defense and Government professionals addressing Indo-Pacific security challenges at TechNet Indo-Pacific 2026. Our booth will serve as a resource hub featuring vendor collateral, expert consultation and technology resources tailored to the unique operational requirements of the Indo-Pacific theater. Our regional specialists understand the specific communications, cybersecurity and multi-domain integration needs facing military and Government leaders in this critical area of operations and will be available to discuss solutions that enhance interoperability, strengthen partnerships and support strategic readiness across the region. 

Alamo Cybersecurity Exposition (ACE) 

December 7-10, 2026 | San Antonio, TX | In-Person Event 

ACE 2026 is the annual conference and exposition hosted by the Alamo Chapter of AFCEA at the JW Marriott San Antonio Hill Country Resort & Spa. It draws military, Government and defense industry professionals together to discuss cybersecurity, Information Technology (IT) and multi-domain operations, featuring expert panels, keynote speakers, acquisition updates and an expanded cybersecurity expo. The event also includes professional development opportunities, networking and events supporting charitable causes like golf tournaments benefiting military families.  

Carahsoft is committed to supporting defense IT and cybersecurity professionals at Alamo ACE 2026. Our booth will provide attendees with access to expert consultations, educational resources and technology demonstrations addressing critical challenges in enterprise IT resilience, secure software delivery and multi-domain operations. Our team brings extensive experience supporting defense acquisition programs and can provide guidance on procurement strategies, contract vehicles and solution implementation tailored to your organization’s specific mission requirements and security objectives. 

DoDIIS Worldwide Conference 

August 9-12, 2026 | Tampa, FL | In-Person Event 

The Department of Defense Intelligence Information System (DoDIIS) Worldwide Conference 2026 is the Defense Intelligence Agency’s (DIA) premier information technology and intelligence systems event, bringing together senior decision makers, technical experts and stakeholders from the DoW, the IC, industry, academia and allied partners to collaborate on mission-critical technology solutions. It serves as a forum to share insights on data integration, IT modernization, secure information systems and innovations that support intelligence and warfighter missions. The immersive in-person conference features distinguished speakers, expert panels, networking opportunities and showcases of technical solutions designed to enhance decision-making and operational effectiveness. DoDIIS plays a key role in fostering partnerships and advancing capabilities across the defense and intelligence ecosystems. 

Carahsoft is honored to support the defense and intelligence communities at DoDIIS 2026 through our dynamic partner pavilion featuring cutting-edge technologies designed to advance mission success across the DoW and IC. Our team of intelligence solutions specialists will be available to provide personalized consultations on data integration platforms, IT modernization strategies, secure information sharing capabilities and analytics tools essential to supporting intelligence and warfighter missions. Visit our pavilion to explore proven solutions, engage in meaningful discussions about your organization’s technology challenges and connect with resources that can enhance decision-making, operational effectiveness and mission outcomes across the defense and intelligence ecosystems. Check out the agenda here.

Billington CyberSecurity Summit

September 8-10, 2026 | Washington, DC | In-Person Tradeshow

The Billington CyberSecurity Summit 2026 is the 17th annual gathering of Government and industry cyber leaders, serving as a premier forum for Federal, State and Local cybersecurity professionals to discuss critical threats, policy developments and defense strategies. This three-day summit brings together thousands of attendees and hundreds of expert speakers across more than 40 sessions and breakout discussions to explore topics like AI integration in cybersecurity, Zero Trust architecture, threat intelligence, operational resilience and emerging defense capabilities. The event offers extensive networking opportunities, solution showcases and deep-dive sessions that address the most pressing cybersecurity challenges facing the Public Sector. Sessions have not yet been released for 2026, but previous years have covered topics ranging from AI-driven threat detection to securing critical infrastructure and implementing proactive cyber defense strategies.

Carahsoft is committed to supporting DoW and Federal cybersecurity professionals at the Billington Cybersecurity Summit 2026 with a comprehensive resource presence featuring educational materials, expert consultations and technology demonstrations. Our cybersecurity specialists will be available throughout the three-day event to provide guidance on implementing Zero Trust frameworks, securing defense networks, addressing compliance requirements and exploring innovative solutions to combat evolving cyber threats. Visit our space to access resources tailored to DoW cybersecurity challenges, connect with solutions providers who understand defense mission requirements and engage in discussions about strengthening your organization’s cyber resilience and operational readiness. Check out the agenda here.

From maritime operations and SOF to cyber defense and GEOINT, these 2026 events provide essential opportunities for DoW stakeholders to explore innovative solutions, connect with industry leaders and strengthen partnerships across the defense ecosystem. Each gathering addresses the most pressing challenges facing the DoW, offering hands-on demonstrations, expert insights and valuable discussions that drive operational readiness and mission success. Carahsoft is proud to support these critical initiatives through our presence at each event and our extensive portfolio of defense-focused partners and solutions. 

To learn more or get involved in any of the above events, please contact us at DoWMarketing@Carahsoft.com. 

For more information on Carahsoft and our industry-leading DoW technology partners’ events, visit our DoW Solutions Portfolio. 

Understanding CMMC: A Roadmap for Federal Contractors

Posted on by
Reply

The Department of Defense (DoD) recently announced new cybersecurity compliance mandates for contractors and subcontractors in the DoD’s supply chain. Private companies that process, store or transmit DoD data are now required to comply with the Cybersecurity Maturity Model Certification, or CMMC.

The new mandate impacts every private company that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). That’s a large group: According to the DoD’s own estimation, at least 220,000 private companies currently have access to FCI and CUI and require CMMC certification.

Because the CMMC is relatively new, some organizations may be struggling to understand their obligations. Learn more about exactly what the CMMC is and what steps organizations should take right now to be prepared for audits and remain eligible for DoD contracts.

What Is CMMC?

CMMC is the cybersecurity compliance structure used by the Department of Defense. High-profile security breaches like Solar Winds highlighted the need for rigorous data protection throughout the DoD supply chain. The DoD implements the CMMC framework to vet potential contractors and subcontractors and protect against third-party data breaches.

There are three CMMC certification levels: 1, 2 and 3. The different levels correspond to the degree of sensitive information being handled. All companies that contract with DoD need to have at least Level 1 CMMC, while companies that handle more sensitive information will need to have Level 2 or Level 3 cybersecurity compliance certifications.

Recent Changes to CMMC

The CMMC has recently undergone some amendments. An older version of the CMMC, or CMMC 1.0, was implemented in 2019. The new version, CMMC 2.0, came into effect at the end of 2024.

Contractors must now comply with CMMC 2.0, although implementation is taking place in stages. For any organization contracting with the Defense Department, the most important takeaway is that you absolutely must be CMMC compliant to continue working with the Department.

What Level of CMMC Certification Do You Need?

If your organization handles any FCI or CUI, you’ll need CMMC certification. Which level is right for you? You can’t know for certain until you apply for a contract, as there is some variation from one external contract to another.

However, you can make an educated guess about the certification you’ll need. The DoD’s Scoping and Assessment Guide also provides more detail about the standards for each level.

Level 1 CMMC

Level 1 is the most straightforward CMMC certification. It doesn’t require third-party auditing; contractors do a self-assessment to get the certification.

Level 1 is usually appropriate for contractors who handle FCI material and nothing else. FCI is unclassified Government information that isn’t publicly available. Details about Government employees or facilities, for example, might be categorized as FCI. Although the information is sensitive, it is not considered critical enough to require the extra protection of a Level 2 or Level 3 certification.

Level 2 CMMC

If your organization handles both CUI and FCI, you will probably require Level 2 CMMC certification.

In many cases, Level 2 certification is straightforward and can be achieved through a self-certification process. However, in some cases you will need to pass a third-party audit for Level 2 certification. The procedure depends on the sensitivity of the data you’ll be handling. The more sensitive the information, the more precautions the DoD puts in place to prevent a potentially disastrous security breach.

Level 3 CMMC

Level 3 CMMC is the most serious and the most difficult certification to obtain. If your organization routinely handles both CUI and FCI and also deals with material that impacts DoD operations, then you may need this certification.

Level 3 CMMC mandates stricter protections than the other two certification levels. It’s required in cases where a data breach could create widespread problems for the Department of Defense, or even for national security.

To obtain Level 3 CMMC certification, you must undergo a Government audit. The Government will thoroughly assess your security system and determine whether it meets the appropriate standards for certification.

What Is the Cybersecurity Compliance Timeline?

CMMC 2.0 came into effect in December 2024. From that date on, organizations working with the Department of Defense are mandated to begin implementing CMMC compliance according to a 4-phase plan.

Phase 1

This stage began in December 2024, as soon as CMMC 2.0 came into effect. During Phase 1, prospective new DoD contractors are required to conduct a self-assessment to ensure cybersecurity compliance according to Level 1 or 2 CMMC. Phase 1 requirements went into effect November 10, 2025.

Phase 2

The full Level 2 standard comes into effect in November 2026, ushering in Phase 2 of CMMC 2.0. At this stage, contractors are subject to third-party audits to ensure cybersecurity compliance with Level 2 and Level 3 certification.

Phase 3

Phase 3 is set to begin in November 2027. At that time, organizations that handle the most sensitive data will be mandated to undergo a Government-run security audit to ensure compliance with Level 3 CMMC certification.

Phase 4

In November 2028, all new defense contracts will contain language stipulating the CMMC level requirement.

What Steps Should You Take To Comply with the CMMC?

Cybersecurity compliance is fairly straightforward and can be broken down into a few key steps.

Step One: Preparation

Determine which certification level is appropriate for your organization and its needs. Begin by deciding which contracts you’d like to apply for, and use the contracts to decide the appropriate certification level.

Remember that it’s always a good idea to aim for the lowest appropriate certification level, as higher levels are more difficult to obtain. If you are not dealing with highly sensitive data, it’s not worth trying to obtain the Level 3 certification.

Step Two: Internal Assessment

Conduct a preliminary assessment of your organization, analyzing where you will need to make changes to achieve cybersecurity compliance.

It’s good practice to do this in two stages. First, complete a self-assessment. Next, check your assessment with an objective source.

Step Three: Third-Party Audit

If you’re working towards Level 2 or Level 3 certification, you’ll need to be audited, either by an approved third-party auditor or by the Government. The CMMC marketplace makes it easy to set up the assessment. Again, you should first perform a self-assessment to make sure that you’ve addressed any shortfalls in your organization before you undergo this audit.

Step Four: Course Correction

The audit may reveal deficiencies in your security system. If so, you may be granted time to correct these deficiencies and still successfully apply for your CMMC certification.

Once you receive your CMMC certification, you’ll need to renew it once a year to confirm that your organization is keeping up with DoD best practices for cybersecurity.

Get Started With the CMMC Certification Process

From Compliance to Capability: Key Insights from CS5 CMMC Global Conference 2025

Posted on by
Reply

The CS5 CMMC Global Conference 2025, the official conference of The Cyber AB, brought together more than 1,000 senior leaders from the Department of War (DOW), the Cyber AB, Federal agencies and the broader Defense Industrial Base (DIB) in Washington, D.C. The conference served as the essential gathering for defense contractors and DIB suppliers to chart the next phase of Cybersecurity Maturity Model Certification (CMMC) implementation, cyber resilience and supply chain security.  Speakers explored key themes, including:

  • CMMC’s Next Phase: Turning Compliance into Capability and Defending the Digital Nation
  • AI-Driven Compliance
  • Driving Operational Excellence through Documentation
  • Combat Readiness: Scaling Across the Defense Ecosystem
  • Strengthening Supply Chain Resilience

CMMC’s Next Phase

Turning Compliance into Capability

CMMC’s next phase represents precision in action and marks a national shift from policy compliance to operational defense. The United States now views information security as a foundational element of national defense. Safeguarding Controlled Unclassified Information (CUI), whether technical information, operational intelligence or logistical data, is inseparable from mission readiness and warfighter support. The DIB now operates as the digital frontline of national security, where compliance is no longer optional but an essential layer of protection.

Defending the Digital Nation

Contractors demonstrate that they not only meet Federal requirements but also actively share the responsibility of defending the nation’s digital infrastructure. CMMC represents both a compliance framework and a patriotic commitment to protecting critical information, ensuring that data remains secure in an era where proximity to the battlefield no longer determines risk.

AI-Driven Compliance

Artificial Intelligence is transforming the CMMC landscape by acting as a force multiplier for speed, accuracy and operational efficiency. Across the Defense Industrial Base, AI-enabled tools are drafting policies, tagging evidence, detecting anomalies and summarizing documentation that once required extensive manual effort. Large language models (LLMs) can rapidly produce preliminary content that validates cybersecurity readiness and synthesizes complex data, enabling DIB contractors to prepare security readiness at scale. Speakers emphasized the need for human oversight to ensure that AI-generated output is validated and aligned with compliance integrity, as automation without governance creates new vulnerabilities. In practice, organizations should leverage AI to enhance efficiency and maintain traceable audit trails, while reserving decision-making, evidence validation and risk assessment for qualified staff. 

When implemented responsibly, AI enables a balanced model of collaboration between human expertise and machine efficiency, accelerating readiness without compromising accountability or security.

Driving Operational Excellence through Documentation

Governance, Risk and Compliance (GRC) platforms serve as key accelerators by automating version controls, maintaining audit trails, centralizing repositories and linking policies directly to evidence. Updating documentation frequently ensures team alignment and simplifies compliance upkeep as levels role out and evaluations are conducted. Embedding documentation into corporate culture ensures long-term sustainability and empowers teams to focus on meaningful security efforts rather than reactive updates.

Best Practices:

  • Automate version controls and standardizes templates to ensure consistency
  • Use GRC systems to consolidate documentation and eliminate silos
  • Treat documentation as continuous validation: write it, organize it and prove it
  • Integrate compliance reviews into routine workflows to sustain readiness and confidence

Combat Readiness: Scaling Across the Defense Ecosystem

The official enforcement of Title 48 of the Code of Federal Regulations on November 10, 2025, will operationalize CMMC as a mandatory requirement for Federal contracts, transforming cybersecurity from a best practice into an enforceable procurement standard across the DIB.

As CMMC Phase 1 begins, compliance must be achievable and affordable, particularly for small and mid-sized contractors that anchor the defense supply chain. Organizations should use this time to budget to train and develop strategies for compliance, leveraging hyperscalers and automation to accelerate readiness. Speakers emphasized that scalable readiness, supported by harmonized frameworks and the reduction of overlapping requirements, is critical to sustaining momentum toward full certification.

Early preparation is essential, as a limited number of assessors may create scheduling delays once enforcement expands. Companies that act now by documenting, training and aligning their operations with Federal standards will not only meet compliance expectations but also reinforce their resilience, competitiveness and commitment to securing the nation’s defense ecosystem.

Strengthening Supply Chain Resilience

High-profile cyber intrusions reaffirmed a simple truth: supply chain security is the foundation of national security. Every organization must know what it protects, how it protects it and how that protection is verified through certification. Compliance is no longer just a cost of doing business; it is both a competitive advantage and a national defense imperative. Contractors should prepare their teams to understand eligibility requirements, strengthen internal controls and treat certification as an investment in long-term success. By embedding compliance into corporate culture and operational workflows, companies not only safeguard data but also enhance brand credibility, reduce systemic risk and ensure continuity of operations across the DIB.

Each contractor that fortifies its cyber posture strengthens the resilience of the entire supply chain because securing the DIB is securing the nation.

How Carahsoft Can Help

Whether your organization is preparing for its first CMMC assessment or advancing its cybersecurity maturity, there are continuous opportunities to strengthen readiness and collaboration across the Defense Industrial Base.

Explore CMMC Resources

Visit Carahsoft’s CMMC page to access compliance guides, vendor solutions and educational content designed to support Defense Industrial Base organizations at every maturity level. From understanding capability domains to preparing for assessments, our resources help organizations make informed decisions throughout their CMMC journey.

Download our comprehensive Cybersecurity Maturity Model Certification Framework Guide to understand the requirements, assessment processes and best practices for achieving CMMC compliance across all maturity levels.

Connect with CMMC Experts

Gaining CMMC compliance can be a complex and time-consuming process, but Carahsoft can guide your organization through every stage. Partnered with more than 200 cybersecurity vendors, Carahsoft connects DIB organizations with the right technologies, service providers and experts to address every maturity level and capability domain.

Contact the Carahsoft Team at (888) 662-2724 or CMMC@carahsoft.com to discuss your organization’s specific compliance needs and discover tailored solutions from our network of cybersecurity partners.

Attend Upcoming CMMC Events

Stay informed on the latest CMMC developments through Carahsoft-hosted workshops, webinars and training sessions. Through our network of partners, policy insights and educational events, Carahsoft helps organizations advance their cybersecurity maturity and meet evolving compliance requirements. Register to receive updates on upcoming CMMC-focused events and training opportunities.

Billington CyberSecurity Summit: AI Takes Center Stage

Posted on by
Reply

Premier U.S. Government cyber conference previews AI on offense, on defense and as a target

  • While adversaries can boost the quality and volume of attacks with artificial intelligence (AI), defenders will apply AI to counter attacks with predictive and proactive defenses.
  • The advent of Agentic AIs will accelerate this trend and provide more avenues for attack, but defenders will always have the advantage by being able to train AIs with proprietary information and use them to identify vulnerabilities before attackers do.
  • The transition to post-quantum cryptography will be an industry-wide heavy lift, with extensive rewriting of code to meet post-quantum standards.

Recently, I had the opportunity to share some of my experience and insights at the Billington CyberSecurity Summit in Washington, D.C. Moderated by Chris Townsend, Global Vice President of Public Sector at Elastic, our panel session, “The Future of Cyber Threat: Anticipating Threat Actors’ Next Steps,” explored how threat actors are evolving and what organizations can do now to prepare. Not surprisingly, AI was a hot topic. We also discussed quantum computing, emerging threats and the cybersecurity staffing shortage.

How Attackers Will Leverage AI

Attackers are already using AI to power their attacks, but it is important not to over-sensationalize the impact that AI is having because the proportion of AI-driven attacks is still quite small relative to the overall amount of malicious activity we are seeing. However, we expect that proportion to grow quickly.

One of the main ways attackers are using it now is to create phishing materials, because it addresses what is a weak point for many threat actors, who often are not native English speakers. Attacks that are technically sophisticated can fail because they begin with a spear phishing email whose spelling or grammar is wrong. Large Language Models (LLMs) solve that problem brilliantly because if there is one thing they are good at, it is creating plausible narratives in perfect English.

The other area we see attackers using it is to automate their work. We have already documented examples of code that appears to have been written by an AI.

In the short term, AI will not enable adversaries to do anything new, but we expect it to enhance the quality and volume of their attacks. AI is lowering the entry bar for threat actors. They do not even need to know how to code anymore. Naturally, the number of attacks will begin to go up.

In the medium term, the arrival of Agentic AI is likely to accelerate malicious activity levels, since agents can act autonomously, further minimizing the level of input needed from attackers.

We have already done some research on how agents could be abused and proven that they can already be used to carry out a basic spear phishing attack and deliver malicious code to a target. Agents are still in their infancy, and it is only a matter of time before they become capable of carrying out more sophisticated attacks with minimal instruction.

Preparing For the Quantum Era

The advent of quantum computing presents another significant challenge for cybersecurity. Quantum computers have the potential to break current encryption standards, making it imperative for organizations to transition to post-quantum encryption algorithms.

Adversaries are already preparing for this shift. The “harvest now, decrypt later” strategy involves stealing encrypted data today with the intention of decrypting it once quantum computing becomes viable.

This process of transitioning to post-quantum encryption is not without its challenges. Decades of work have gone into refining and protecting the implementation of existing encryption methods, and we now face the task of revising and rewriting code using new, post-quantum standards. This will inevitably introduce a new generation of bugs, but we will have the benefit of AI to mitigate them.

It Does Not Stop Here

Conferences such as Billington are essential as we navigate this complex landscape. It embodies the Public and Private Sector collaboration that will be key to realizing better cyber defense outcomes moving forward. Together, with partners like Carahsoft delivering mission-critical industry expertise to U.S. Federal and Public Sector agencies, we can anticipate and counter the next generation of cyber threats, ensuring the safety and resilience of our digital ecosystems.

Learn more about how industry icons like Symantec and Carbon Black are putting AI on the front lines of cybersecurity.

Want to learn how Symantec, Carbon Black and Carahsoft can strengthen your cybersecurity posture? Contact us at Broadcom@Carahsoft.com for more information.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

This post originally appeared on security.com, and is re-published with permission.

Strengthening the OneGov Mission with a New GSA Offer for Broadcom Security Solutions 

Posted on by
Reply

The U.S. General Services Administration (GSA) is redefining Federal procurement through its OneGov Strategy, an initiative aimed at streamlining how Government agencies purchase and implement technology. This unified approach is designed to reduce costs, enhance cybersecurity, improve operational efficiency, and move away from the historically siloed procurement process. 

To help realize this vision, Broadcom is offering its robust security solutions to civilian and unclassified Department of Defense (DOD) agencies through a limited-time promotion—ensuring agencies can access trusted, commercial-grade tools with greater ease and affordability. 

Breaking Down Security Silos with Unified Protection 

The GSA’s OneGov strategy emphasizes the need for agencies to operate as a unified enterprise rather than isolated entities. Broadcom’s security portfolio directly supports this vision by providing integrated solutions that work cohesively across agency boundaries. The combination of Symantec Data Loss Prevention (DLP), Carbon Black Endpoint Detection and Response (EDR) and Carbon Black App Control creates a comprehensive security framework that addresses multiple threat vectors from a single console. 

This unified approach eliminates the complexity of managing disparate security tools while providing the visibility and control necessary for cross-agency collaboration. By streamlining policy management, reporting and incident response through integrated platforms, agencies can reduce administrative overhead and focus resources on mission-critical activities. 

Advancing Zero Trust Architecture Through Proven Technologies 

Executive Order on Improving the Nations Cybersecurity requires DoD agencies to establish plans to drive adoption of Zero Trust architecture, while also mandating enhanced software supply chain security and deployment of multifactor authentication and encryption. Zero Trust implementation requires foundational security capabilities that provide continuous verification and monitoring across all network control points. Broadcom’s security solutions deliver these essential components through proven technologies that have been battle-tested in the most demanding environments. 

Symantec DLP provides the highest level of data protection with real-time visibility and control over sensitive information. The platform automatically prevents data leaks through intelligent messaging blocking and modification capabilities, ensuring that critical Government assets remain secure whether in transit, at rest or in use. This automated approach reduces the burden on security teams while maintaining strict compliance with Federal data protection requirements. 

Carbon Black EDR continuously records endpoint activity, enabling proactive threat hunting and reactive incident response capabilities. This comprehensive visibility allows security teams to detect and respond to advanced threats even in air-gapped environments, providing persistent monitoring essential for Zero Trust architecture. 

Implementing Positive Security Models for Enhanced Protection 

Traditional security approaches rely on maintaining lists of known threats, which can quickly become outdated as attack vectors evolve. Carbon Black App Control takes a fundamentally different approach by implementing a positive security model that only allows trusted and approved software to execute on Government systems. 

This proactive security stance effectively prevents malicious attacks from establishing a foothold, thereby reducing the attack surface and providing agencies with greater confidence in their endpoint security posture.  

Flexible Deployment Options for Diverse Government Environments 

Government agencies operate across a spectrum of technical environments, from cloud-native deployments to air-gapped networks with limited connectivity. Broadcom’s security solutions are designed to function effectively across this entire range, providing consistent protection regardless of deployment constraints. 

Whether agencies require on-premises installation for sensitive workloads, cloud deployment for scalability or air-gapped operation for classified environments, these solutions maintain their full functionality and security effectiveness. This flexibility ensures that agencies with varying technical resources and requirements can implement comprehensive security measures without compromising their operational needs. 

Maximizing Value Through Strategic Procurement 

The current promotional offering saves 75% off GSA ceiling prices for net new license purchases, representing significant cost savings for DoD agencies looking to enhance their security capabilities. This promotion runs from August 1 through September 30, 2025, and is available through Carahsoft’s GSA Schedule with no minimum quantity requirements. 

The pricing structure is designed to be Government Purchase Card friendly, reducing procurement friction and enabling teams to quickly acquire the security tools they need. For existing customers, the promotion applies to net new licenses, allowing agencies to expand their security coverage while taking advantage of substantial savings. 

Carahsoft and our partners are here to support your agency in leveraging this simplified procurement pathway. Our team is available to deliver tailored quotes, arrange customized demonstrations and help you maximize the value of Broadcom’s solutions in advancing your modernization objectives. 

Ready to transform how your agency secures data and advances Zero Trust goals? Contact our Broadcom team at BroadcomFED@carahsoft.com or call us at 571-662-3260 to learn more and take advantage of this limited-time offer. 

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Identity is The Backbone of Secure, Agile DoW Missions

Posted on by
Reply

I had the opportunity to present to the DoW community at AFCEA TechNet Cyber where where stakes are high and operational tempo is relentless, embedding security into every layer of the digital environment is no longer optional. Identity governance and administration (IGA) has emerged as a cornerstone of cyber resilience, enabling secure modernization, supporting Zero Trust mandates, and accelerating mission impact.

Identity as a Strategic Force Multiplier

Modern warfare and defense readiness extend far beyond kinetic capabilities. Cyber is now a primary domain of operation, and within that domain, identity is the new perimeter. Identity security is not simply about access control; it is about governing who has access to what, when, and under what conditions—across all users, environments, and applications.

A well-implemented IGA program transforms complexity into control. It provides the visibility and automation needed to reduce risk, enforce policy, and enable agility. From onboarding mission partners to ensuring continuous compliance with audit and risk frameworks, identity governance acts as the connective tissue between policy, people, and mission success.

Governance is the Gateway to Zero Trust

The DoW’s Zero Trust Architecture (ZTA) is predicated on one central truth: never trust, always verify. At the core of this paradigm is the concept of least privilege—granting users only the access they need, nothing more.

IGA platforms like SailPoint do more than facilitate access. They enforce policy and establish what access should look like, continuously verifying access needs, and tie the identity to activity. Instead of relying on static credentials or infrequent certifications, identity governance brings continuous verification to life—ensuring users, devices, and applications are validated and flagged in the policy information point before access is granted.

This proactive stance aligns IGA with foundational guidance such as the Risk Management Framework (RMF), and the NIST SP 800-53 controls. Governance is not just a checkbox; it is operational security in action.

FIAR, Compliance, and Continuous Audit Readiness

Passing audits like FIAR (Financial Improvement and Audit Readiness) is more than a bureaucratic exercise. It’s a demonstration of operational integrity and mission readiness. Identity governance simplifies this process by embedding compliance into everyday operations.

IGA platforms automate access certifications, enforce separation of duties (SoD), and maintain immutable audit trails. Instead of scrambling for documentation during audit season, organizations can prove—at any time—that they were always in compliance. This shift from reactive to continuous audit readiness is a game-changer for large DoW organizations.

Mission Agility Through Automation

In the DoW, time is not a luxury. Missions shift quickly, mission partners rotate often, and new technologies are deployed at speed. Manual processes simply cannot keep up.

IGA enables automation across the entire identity lifecycle. From onboarding new coalition partners to deprovisioning departing contractors, governance tools streamline access requests, approvals, and revocations. This not only enhances security but also reduces administrative overhead, freeing resources for mission-critical tasks.

Moreover, by integrating with technologies like the DoW Federation Hub, identity governance extends its reach to federated and cross-domain environments—supporting secure joint and coalition operations at scale.

Real ROI: Security that Pays for Itself

The value of IGA goes beyond risk mitigation. It delivers measurable return on investment (ROI) through operational and financial gains. These include:

  • Audit cost reductions through automated evidence collection and fewer control failures
  • License savings by rationalizing unused or redundant entitlements
  • Operational efficiency through faster onboarding/offboarding and reduced manual workloads
  • Risk reduction by limiting the window of exposure for insider threats or privilege misuse

This is ROI by design—security investments that drive cost savings while advancing strategic goals.

A Maturity Model for Sustainable Progress

Identity governance is not a one-time deployment—it’s a journey. I have created a maturity model for the DoW that provides a structured path from basic CAC availability to advanced, AI-driven, risk-adaptive governance. Each step builds capabilities that align with Zero Trust pillars, from policy enforcement to real-time threat response.

As organizations mature, they can integrate IGA with other strategic technologies such as Comply-to-Connect, SASE, and XDR, multiplying both security effectiveness and mission agility.

Conclusion: Govern Everyone, Prove Every Access

To secure the mission, you must govern identity with the same rigor used to defend the network. Identity security is no longer a backend control; it is the control plane for modern defense operations.

Govern everyone. Prove every access. This is the blueprint for a Zero Trust future—one where audit readiness is continuous, access is justified, and the mission moves at the speed of trust.

Learn more about how ICAM solutions empower agencies to manage digital identities with precision.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including SailPoint we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

The Hidden Threat: Why Ignoring Non-Human and Third-Party Identities is a Risk You Cannot Afford

Posted on by
Reply

I had the opportunity to present and discuss the threat of Non-Human and Third-party Identities at AFCEA TechNet Cyber with the Department of Defense (DoD) community. It is obvious that the maturity of Identity, Credential and Access Management (ICAM) and all identities is top of mind. The Industry, the National Institute of Standards and Technology (NIST), Department of Homeland Security – Cybersecurity and Infrastructure Security Agency (DHS CISA) and the DoD are all starting to focus on the problem, as it is recognized that identity is no longer just an IT problem—it is the front line of defense. We have been deep in digital transformation and the adoption of Zero Trust frameworks and have discovered an inconvenient truth: most organizations are flying blind when it comes to managing the very identities that power their operations—non-human and third-party users.

And that is a problem.

The New Cyber Perimeter: Identity

The old perimeter—firewalls and virtual private networks (VPNs)—is dead. What stands between you and the next breach is your ability to govern who or what has access to your systems. Yet many agencies remain fixated on credentials and authentication, while ignoring vast swaths of non-human actors (bots, robotic process automations (RPAs), service accounts) and external partners (vendors, contractors, mission partners).

This is not just a gap. It is a canyon.

According to Deloitte, 63% of organizations lack visibility into third-party access. Even more troubling, most have no way to list or audit all machine identities operating in the background. These invisible accounts often have persistent, high-level access and no formal governance, making them prime targets for threat actors.

Real-World Breaches, Real-World Consequences

Look no further than the SolarWinds and Okta breaches. In both cases, attackers exploited unmanaged service accounts or contractor credentials to move laterally and escalate privileges. These were not arcane zero-days—they were lapses in identity governance. And they cost credibility, customer trust and in some cases, national security.

The lesson? You cannot protect what you cannot see. And you definitely cannot secure what you do not control.

Why Automation and Governance Are Non-Negotiable

In a Zero Trust architecture, access is no longer assumed—it is continuously verified. But that verification breaks down when service accounts are created ad hoc, with no expiration dates, no ownership and no audit trail. The same goes for third-party users who are onboarded through spreadsheets or informal emails, then forgotten once their project ends—yet their access lives on.

This is how breaches happen.

Governance gaps like these leave organizations exposed to avoidable risks: policy drift, compliance violations, excessive access rights and a lack of accountability. Without automation and lifecycle management, identities multiply faster than security teams can manage them—leading to sprawl, privilege creep and ultimately attack surface expansion.

The Case for Identity-Centric Security

Modern enterprises need identity security platforms that extend beyond the traditional workforce. That means treating machine and third-party identities with the same level of scrutiny, controls and lifecycle management as full-time employees.

SailPoint’s approach offers a compelling blueprint:

  • Non-Employee Risk Management (NERM): Centralized, auditable workflows for third-party access, including onboarding, offboarding and access reviews.
  • Machine Identity Security (MIS): AI-driven discovery, classification, ownership assignment and access certification for bots, RPAs and service accounts.

Together, these capabilities provide visibility and governance across all identities, regardless of origin. They also support Zero Trust mandates like least privilege, just-in-time access and continuous verification.

Business Benefits Beyond Security

This is not just about reducing risk. It is about enabling speed and scale without sacrificing control.

With strong identity governance:

  • Mission partners and contractors get the access they need faster—without creating long-term exposure.
  • Audit preparation becomes easier, with clear logs of who had access to what, when and why.
  • Compliance improves, especially in regulated industries, based on NIST and other frameworks.
  • Security teams can shift from reactive firefighting to proactive risk management.

And perhaps most importantly: organizations become more resilient in the face of evolving threats.

The Bottom Line

Cybersecurity is no longer just about protecting data—it is about protecting trust. And trust starts with visibility and control over every identity that touches your systems.

If your organization is still relying on outdated processes to manage non-human and third-party users, now is the time to act. Inaction is not neutral—it is a strategic liability. As attack surfaces expand and adversaries grow more sophisticated, unmanaged identities will remain the soft underbelly of your defenses.

Zero Trust is not just a framework—it is a mindset. And in that mindset, every identity matters.

It is time to see what has been hiding in plain sight.

Ready to reinforce your identity perimeter? Discover how SailPoint’s ICAM solutions empower organizations to manage digital identities with precision. Explore Now.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including SailPoint we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

The Top 10 OSINT Events for Government in 2025 

Posted on by
Reply

Open Source Intelligence (OSINT) is no longer a niche capability—it is a core component of modern intelligence work. Carahsoft and our partners have spent years attending and supporting the top OSINT events. We have seen firsthand how AI, automation and smarter data strategies are reshaping the way Government teams gather, analyze and act on intelligence.  

This list of the top OSINT events for 2025 and beyond highlights the best places to learn, connect and bring new ideas back to your mission. 

OSMOSIS: DC 

August 6-7 | Reston, VA | In-Person Event 

OSMOSIS:DC is a two-day conference held by OSMOSIS, an Association for OSINT Professionals. The theme for this year is “Technology, Trends, and Transformations.” The expo-style event offers participants direct access to leading vendors, hands on experience with the latest tools and expert-led workshops. Attendees will have the opportunity to connect with industry leaders and build career advancement strategies to help stay ahead of emerging OSINT trends. OSMOSIS:DC is a great opportunity to gain transformative insights from the OSINT industry!  

Take a look at some of last year’s top themes in preparation for the 2025 event: 

  • Harnessing Location Intelligence: Advanced OSINT Techniques for Cyber Intelligence Investigations 
  • Linguistic Fingerprints: Using Language to Profile Subjects in OSINT Investigation 
  • Digging for Digital Dirt: Unearthing Bad Actors with Open-Source Intelligence 

Carahsoft invites our partners to exhibit at OSMOSIS:DC, hosted at our Conference & Collaboration Center in Reston. Whether you are looking to sponsor, speak, exhibit or just attend, reach out to osintverticalmarketing@carahsoft.com to get involved in this intimate networking event! 

Billington Annual Cybersecurity Summit 

September 9-12 | Washington, D.C. | In-Person Event 

The Billington Annual Cybersecurity Summit is the leading forum for cybersecurity professionals, Government leaders and industry executives to discuss emerging threats, best practices and the latest trends. With over 200 expert speakers, 100+ cyber-focused vendors and more than 40 sessions, attendees will have the chance to engage with top specialists, explore state-of-the-art technologies and participate in thought-provoking discussions. The Summit’s strong focus on collaboration between the Public and Private Sectors provides insights that address real-world security challenges. Learn about cybersecurity strategies, AI-driven threat detection and the latest advancements in national defense at this crucial event!  

Carahsoft is looking forward to sponsoring and exhibiting at this year’s event. We’re excited to engage with attendees throughout the week. We will also be hosting a large partner pavilion and encourage attendees to stop by and learn more about our partners and their technology solutions! Check out the events tab on our website  for more details closer to the event! 

Intelligence & National Security Summit 

September 18-19 | National Harbor, MD | In-Person Event 

The Intelligence and National Security Summit (INSS), held by AFCEA International and the Intelligence and National Security Alliance (INSA), gathers thought leaders, policymakers and industry experts dedicated to advancing solutions for shaping the future of intelligence and national security. The two-day event will feature five plenaries, and six breakout sessions focused on AI and emerging technologies, critical infrastructure security, space acquisition and more. Attendees will gain hands on experience with innovative technologies in the Intelligence Community (IC), insights from experts in the field, as well as networking opportunities with Government leaders, technical professionals and leading researchers. Expert-led panels and interactive discussions will cover critical national security challenges and provide actionable strategies for navigating the complex world of intelligence. Join this premier forum to explore the emerging threats, intelligence operations and technological advancements that are redefining the security landscape! 

Carahsoft supports INSS by enabling our vendor partners to participate as sponsors and exhibitors, ensuring a strong industry presence at the event.  

IACP 

October 18-21 | Denver, CO | In-Person Event 

The International Association of Chiefs of Police (IACP) is an annual event that brings together public safety professionals from around the world to explore new techniques, share expertise and prepare their departments for future success. The conference features an exposition hall showcasing products from more than 600 vendors, education workshops and networking opportunities with fellow law enforcement professionals. Spanning four days, attendees will have the chance to engage in policy discussions on the latest challenges in policing, leadership and public safety innovation. As one of the largest law enforcement events, IACP 2025 is an essential gathering for agencies looking to enhance their strategies and stay ahead in an evolving security landscape. 

Attendees should expect sessions surrounding how to leverage OSINT for criminal investigations, OSINT for threat assessment and risk mitigation, as well as Dark Web and Deep Web investigations.  

Carahsoft will have a booth at IACP where several of our vendor partners will demonstrate their solutions and share educational content. We will also be hosting a networking reception with several of our vendor partners, welcoming conference attendees for food, drinks, networking and more!  

OSINT Foundation Awards 

November 7 | VA | In-Person Event 

The OSINT Foundation Awards recognize individuals and organizations that have made significant contributions to the field of OSINT. Attendees will explore the latest OSINT methodologies, data analysis techniques and the critical role of open source information (OSIF) in national security and risk assessment. This prestigious event highlights major achievements, facilitates professional networking and demonstrates OSINT’s impact on intelligence operations. Join industry experts as they honor innovation, dedication and the future of OSINT! 

Awards honored at last year’s ceremony included:  

  • Innovation of the Year 
  • Volunteer of the Year 
  • Practitioner of the Year 
  • Unit of the Year 
  • Catalyst of the Year 
  • Product of the Year 

View a more in-depth explanation of the selection criteria here. 

Carahsoft is a proud partner of the OSINT Foundation, supporting them annually by hosting the OSINT Foundation Tech Expo. We encourage our partners to get involved with this event by nominating individuals who they believe exemplify excellent service to the nation and contribute to the OSINT discipline. 

Global Security Exchange

Sept 29 – Oct 1, 2025 | New Orleans, LA | In-person Event

Global Security Exchange (GSX) 2025 is the premier event for security professionals across the public and private sectors, offering a comprehensive forum to explore the evolving threats and innovations shaping today’s global risk landscape. With immersive education sessions, insightful keynotes and cross-industry networking, GSX brings together leaders and practitioners from around the world to exchange ideas, strategies and best practices. Attendees will gain firsthand insight into the tools and technologies driving the future of physical and cyber security.

Carahsoft is proud to exhibit at GSX 2025 at Booth #2907. Stop by to connect with our OSINT experts and discover the latest open source intelligence technologies designed to help you stay ahead of emerging threats. We look forward to engaging with the security community and sharing how our partners are equipping organizations to be the first line of defense in today’s complex environment.

OSINT Foundation Tech Expo 

April 30 – May 1, 2026 | Reston, VA | In-Person Event 

The OSINT Foundation Tech Expo is an annual event that brings together professionals and experts in the field, showcasing the latest advancements in OSINT technologies and related services. Attendees can expect a variety of presentations, workshops and networking opportunities designed to enhance knowledge and skills in gathering and analyzing publicly available information. The event aims to foster collaboration and innovation within the OSINT community, making it a must-attend for anyone involved in intelligence and cybersecurity! 

Carahsoft is proud to host the OSINT Foundation Tech Expo at the Carahsoft Conference & Collaboration Center in Reston, a space dedicated to ensuring collaboration and support across the technology industry and Government. Carahsoft invites our partners to join the 50 OSINT vendors and agencies already lined up to showcase their own tabletop exhibits. Carahsoft has also collaborated with FedGovToday’s Francis Rose to interview our partners for their Innovation in Government and Video Insights! 

GEOINT 2026 

May 3-6, 2026 | Aurora, CO | In-Person Event 

The GEOINT Symposium is the nation’s largest annual gathering of Government, industry and academic professionals advancing the tradecraft of geospatial intelligence and will be held at the Gaylord Rockies Resort & Convention Center in Aurora, Colorado, May 3-6, 2026. Each year, the Symposium underscores the collaborative efforts and cutting-edge innovations shaping the future of GEOINT. The Symposium will feature industry-leading keynote speakers, main stage panels and hands-on training sessions on topics such as mission planning, precision timing and navigation. Attendees will be able to engage with geospatial intelligence experts to deepen their understanding, foster connections and stay at the forefront of innovative technologies. Attend GEOINT 2026 to explore the critical role geospatial intelligence will play in building a secure future!

Carahsoft intends to showcase a Partner Pavilion with our vendors again in 2026. We look forward to attending GEOINT 2026 and join our OSINT customers to learn more about the latest in geospatial open source intelligence.  

SOF Week 2026 

May 3-8, 2026| Tampa, FL | In-Person Event 

SOF Week 2026 is the annual gathering for the international Special Operations Forces (SOF) community. Jointly sponsored by U.S. Special Operations Command (USSOCOM) and the Global SOF Foundation, the event serves as a platform for fostering collaboration, innovation and excellence in modern special operations. SOF Week will feature keynote addresses from senior leaders, professional development workshops, chances to network and sessions focused on non-profit initiatives. Do not miss this key event shaping the future of SOF operations! 

Carahsoft and more than 45 partners will attend and showcase solutions in AI, DevSecOps, cybersecurity, cloud technologies and open source intelligence.  

TechNet Cyber 2026 

June 2-4, 2026 | Baltimore, MD | In-Person Event 

TechNet Cyber 2026, hosted by the Armed Forces Communications and Electronics Association (AFCEA), is a flagship cybersecurity event bringing together U.S. Cyber Command, the Defense Information Systems Agency (DISA), Joint Force Headquarters-Department of Defense (DoD) Information Network and DoD Chief Information Office (CIO), as well as a mix of military, Government, industry and academic leaders. This conference serves as a platform for collaboration, uniting policy, strategic architecture, operations and command and control to address global security challenges in the digital domain. Attendees can expect a comprehensive program featuring expert panels on cybersecurity advancements, technology demonstrations and networking events aimed at enhancing national cybersecurity efforts. Join us in Baltimore to connect with top decision-makers and help drive solutions for this vital mission! 

 The event will feature a range of exhibitors, including Carahsoft’s leading cyber technology providers. Carahsoft looks forward to joining our open source intelligence customers at TechNet Cyber in 2026. 

Join us at one of our 2025 OSINT events to connect with intelligence leaders and professionals dedicated to advancing OSINT. Do not miss this opportunity to explore innovative OSINT techniques and tools, data analysis, cybersecurity and more! 

To learn more or get involved in any of the above events please contact us at OSINTVerticalMarketing@Carahsoft.com. For more information on Carahsoft and our industry leading OSINT technology partners’ events, visit our OSINT solutions portfolio.