Building Sustainable Automation: How Government Agencies Can Scale IT Operations for the AI Era

Posted on by Ash Davis and Francisco Ramirez

Despite investing in numerous automation tools, Government agencies still struggle to achieve true operational efficiency. The issue is not a lack of technology, but the need to better align organizational processes with automation strategies. Agencies often find that automation scattered across teams does not equate to automation at scale.

For State and Local Government agencies navigating budget constraints, workforce transitions and mounting pressure to adopt artificial intelligence (AI), understanding how to make automation sustainable is now mission critical.

Understanding the Foundation

The most effective automation transformations begin not with technology selection but with process evaluation. Agencies that achieve lasting results recognize that automation amplifies existing workflows, accelerating efficient processes while exposing areas in need of standardization. The key lies in establishing organizational readiness before scaling solutions.

Experience shows that technical excellence alone does not guarantee adoption. Many organizations implement advanced automation tools only to see them underutilized because processes were not standardized first. This pattern repeats across ticketing, project management and AI initiatives when solutions are deployed before process design. Sustainable change requires equal focus on culture, workflow and collaboration.

The distinction between organizational and technical capability becomes clear during initiatives like enterprise-wide patching. While patching might appear technically simple, it requires coordination across teams, standardized processes and consistent execution. When approached strategically, patching strengthens structures and communication across departments.

Moving Beyond Linear Scaling

Traditional methods for managing IT complexity have centered on workforce expansion, but modern infrastructure requires new thinking. As organizations add personnel to manage new systems, coordination overhead grows, reducing visibility and collaboration, which then drives additional staffing needs. This challenge extends beyond budgets. Larger teams face higher coordination demands, and IT professionals often overlook their time as an organizational resource until capacity constraints emerge. The question is not just about staffing; it is about designing systems that scale efficiently.

For Government agencies, this issue is especially pressing. Retirements and limited hiring flexibility leave positions unfilled, putting institutional knowledge at risk and resulting in expanding workloads for current employees. In this environment, automation becomes a strategic enabler for maintaining service levels and mission delivery. Manual processes scale linearly, while infrastructure complexity grows exponentially. Centralized automation helps break this cycle by handling routine operations, freeing staff to focus on work that demands human expertise.

Creating Connected Workflows

Sustainable automation strategies move beyond isolated, team-specific implementations toward centralized platforms that enable consistent workflows across the organization. Many agencies have distributed automation capabilities, where infrastructure teams automate provisioning, security teams automate compliance validation and network teams automate configuration, but these workflows often lack seamless integration.

Red Hat, Building Sustainable Automation blog, embedded image, 2025

A single application deployment spans multiple domains, such as provisioning, networking, security scanning, compliance validation and monitoring. When automation operates independently, staff must still coordinate manual handoffs between automated steps. According to Conway’s Law, organizations design systems that reflect their communication structures; fragmented communication results in fragmented architecture.

Centralized platforms address this by establishing shared, standardized automation for common tasks. Instead of multiple teams maintaining separate scripts, one validated and documented process can serve all. This approach enhances auditability, improves consistency, enables scalable growth and eliminates redundant development. Updates to shared workflows require modifying a single authoritative source rather than tracking changes across multiple implementations.

Importantly, centralization is as much about culture and process as technology. Success depends on clear communication of the value of standardization, demonstrating tangible benefits and building trust that centralized approaches will serve all teams effectively. When alignment is achieved, automation platforms reach their full potential, transforming disconnected efforts into unified, scalable operations.

Building the Foundation for Advanced Technologies

The growing interest in AI has created momentum for agencies to explore new solutions, but success requires careful groundwork. Agencies realize the greatest benefits from AI when they first established stable, standardized automation foundations. MIT research shows that 95% of enterprise AI solutions encounter challenges not because of model quality but due to integration difficulties and organizational readiness. Effective AI deployment depends on how well technology integrates within existing workflows.

Many agencies have expanded infrastructure incrementally, developing complex architectures held together by manual processes and specialized expertise. Deploying AI on such foundations is difficult. AI cannot effectively optimize systems when the underlying processes lack consistent automation. In practice, agencies deploying AI to optimize Customer Relationship Management (CRM) operations or automate incident response achieve better results when data and workflows are standardized. This consistency enables organizations to act confidently on AI-driven insights.

Building AI readiness involves working backward from AI’s requirements: integrated systems that share data reliably, standardized processes that AI can learn from and consistent execution that produces trustworthy patterns. Agencies that mature their automation capabilities create the foundation AI needs to succeed, significantly improving the likelihood of achieving meaningful results from AI investments.

Partnering for Success

Achieving sustainable automation is a progressive journey best supported by experienced partners. Leading strategies emphasize a “crawl, walk, run” approach:

Start with a manageable scope
Expand systematically
Build organizational capability over time

This measured progression ensures transformation occurs sustainably for the teams implementing and maintaining these systems.

Many agencies are undertaking comprehensive automation for the first time, making guidance from experienced organizations like Red Hat particularly valuable. Effective partnerships emphasize knowledge transfer over dependency, helping agencies build autonomous, capable teams rather than relying on long-term external support.

The results of this approach are measurable. Red Hat customers have achieved 50% faster networking provisioning, 65% reductions in certain provisioning activities and 67% improvements in other operational areas, freeing staff for innovation and strategic initiatives. These gains also reduce unplanned downtime and improve the overall quality of life for IT teams.

This journey addresses multiple organizational objectives simultaneously. Leadership achieves cost optimization and stronger security, while practitioners gain time, efficiency and better work-life balance. Sustainable automation delivers across these dimensions because the same standardization that drives efficiency also enhances security and empowers staff to focus on meaningful challenges.

Government agencies have reached a pivotal moment where growing infrastructure complexity demands a more evolved approach to IT operations. The path forward lies in fundamentally integrating automation into organizational processes and culture. By prioritizing standardization, embracing centralization and partnering for sustainable transformation, agencies can develop scalable automation strategies that prepare the organizations to leverage emerging technologies like AI.To discover proven strategies for building sustainable automation foundations that prepare your agency for advanced technology adoption, watch Red Hat’s webinar, “The Backbone of Modern Government: Sustainable Automation at Scale.”

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Red Hat, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Billington CyberSecurity Summit: AI Takes Center Stage

Posted on by Vikram Thakur

Premier U.S. Government cyber conference previews AI on offense, on defense and as a target

While adversaries can boost the quality and volume of attacks with artificial intelligence (AI), defenders will apply AI to counter attacks with predictive and proactive defenses.
The advent of Agentic AIs will accelerate this trend and provide more avenues for attack, but defenders will always have the advantage by being able to train AIs with proprietary information and use them to identify vulnerabilities before attackers do.
The transition to post-quantum cryptography will be an industry-wide heavy lift, with extensive rewriting of code to meet post-quantum standards.

Recently, I had the opportunity to share some of my experience and insights at the Billington CyberSecurity Summit in Washington, D.C. Moderated by Chris Townsend, Global Vice President of Public Sector at Elastic, our panel session, “The Future of Cyber Threat: Anticipating Threat Actors’ Next Steps,” explored how threat actors are evolving and what organizations can do now to prepare. Not surprisingly, AI was a hot topic. We also discussed quantum computing, emerging threats and the cybersecurity staffing shortage.

How Attackers Will Leverage AI

Attackers are already using AI to power their attacks, but it is important not to over-sensationalize the impact that AI is having because the proportion of AI-driven attacks is still quite small relative to the overall amount of malicious activity we are seeing. However, we expect that proportion to grow quickly.

One of the main ways attackers are using it now is to create phishing materials, because it addresses what is a weak point for many threat actors, who often are not native English speakers. Attacks that are technically sophisticated can fail because they begin with a spear phishing email whose spelling or grammar is wrong. Large Language Models (LLMs) solve that problem brilliantly because if there is one thing they are good at, it is creating plausible narratives in perfect English.

The other area we see attackers using it is to automate their work. We have already documented examples of code that appears to have been written by an AI.

In the short term, AI will not enable adversaries to do anything new, but we expect it to enhance the quality and volume of their attacks. AI is lowering the entry bar for threat actors. They do not even need to know how to code anymore. Naturally, the number of attacks will begin to go up.

In the medium term, the arrival of Agentic AI is likely to accelerate malicious activity levels, since agents can act autonomously, further minimizing the level of input needed from attackers.

We have already done some research on how agents could be abused and proven that they can already be used to carry out a basic spear phishing attack and deliver malicious code to a target. Agents are still in their infancy, and it is only a matter of time before they become capable of carrying out more sophisticated attacks with minimal instruction.

Preparing For the Quantum Era

The advent of quantum computing presents another significant challenge for cybersecurity. Quantum computers have the potential to break current encryption standards, making it imperative for organizations to transition to post-quantum encryption algorithms.

Adversaries are already preparing for this shift. The “harvest now, decrypt later” strategy involves stealing encrypted data today with the intention of decrypting it once quantum computing becomes viable.

This process of transitioning to post-quantum encryption is not without its challenges. Decades of work have gone into refining and protecting the implementation of existing encryption methods, and we now face the task of revising and rewriting code using new, post-quantum standards. This will inevitably introduce a new generation of bugs, but we will have the benefit of AI to mitigate them.

It Does Not Stop Here

Conferences such as Billington are essential as we navigate this complex landscape. It embodies the Public and Private Sector collaboration that will be key to realizing better cyber defense outcomes moving forward. Together, with partners like Carahsoft delivering mission-critical industry expertise to U.S. Federal and Public Sector agencies, we can anticipate and counter the next generation of cyber threats, ensuring the safety and resilience of our digital ecosystems.

Learn more about how industry icons like Symantec and Carbon Black are putting AI on the front lines of cybersecurity.

Want to learn how Symantec, Carbon Black and Carahsoft can strengthen your cybersecurity posture? Contact us at Broadcom@Carahsoft.com for more information.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

This post originally appeared on security.com, and is re-published with permission.

Forecasting Resilience: How Atlas 14 Strengthens Stormwater and Sewer Design

Posted on by Simon Newton

What forward-leaning State and Local agencies are doing to turn risk into readiness.

Most of us in public works know exactly what the National Oceanic and Atmospheric Administration’s (NOAA) Atlas 14 is, where it is used and why it matters. What has changed lately is not the definition, it is the urgency.

Across jurisdictions, we are seeing the same trend: Flood risk is up, funding scrutiny is rising and legacy assumptions are hitting resistance. The Federal Emergency Management Agency (FEMA) reports that over 75% of federally declared disasters are flood-related, and NOAA’s latest data shows record-setting rainfall intensity increasing across several states.

So, it is no surprise that design criteria anchored in decades-old rainfall estimates are facing hard questions during permitting and public review. For teams navigating FEMA, the National Flood Insurance Program (NFIP) and local requirements, the gap between historical design standards and current expectations has never been more apparent.

That is where updated Atlas 14 data is reshaping workflows—not in concept, but in practice.

A Familiar Tool, New Pressures

Atlas 14 has always been foundational, but recent updates and regulatory emphasis have made it non-negotiable in many contexts. Whether it is used to update a stormwater ordinance or justify capital investments, the message is clear: Designs that do not reflect this data face uphill battles—especially when tied to Federal funding.

In North Carolina, for example, several jurisdictions have already adjusted their stormwater management ordinances to explicitly require Atlas 14 integration. Fairfax County’s own guidelines mandate its use in culvert sizing and detention basin design. And in Texas, new flood risk mitigation plans are using Atlas 14 data as a baseline for grant applications under FEMA’s Building Resilient Infrastructure and Communities (BRIC) program. The bottom line: If your designs are not grounded in this data, your funding case—and your technical case—can be hard to defend.

With rainfall intensity trending higher across multiple regions, stormwater programs that once relied on 10- or 25-year benchmarks are now expected to model 50- and 100-year events—or even higher.

Design For What Is Likely, Defend Against What Is Possible

Colleagues across State and Local Government (SLG) are asking the same question: How can we use this data not just for box-checking, but for making better decisions? How do we defend design assumptions in permit review? How do we model flood events that reflect local topography and future rainfall patterns? How can we show that our Capital Improvement Plan (CIP) priorities align with resilience goals, rather than just meeting regulatory minimums?

That is where predictive modeling comes in. Teams using tools like Bentley OpenFlows Sewer or Bentley OpenFlows Storm are leveraging Atlas 14 as a referenced input to:

Run scenario comparisons based on updated precipitation probabilities
Assess cascading impacts across watershed and sewer networks

The result? Models that are both technically sound and strategically aligned—with funding cycles, risk standards and permitting expectations.

Join Leading Experts to Learn More

But even with strong tools and solid data, the path forward is not always clear. We have heard from agencies weighing how to phase in new standards across legacy systems, how to navigate inconsistencies between State and Federal expectations and how to model flood risk in a way that resonates with both engineers and elected officials.

It is time to take a practical look at how SLG agencies are integrating Atlas 14 into their workflows, especially as new standards and funding opportunities continue to evolve.

Join us on November 13, 2025, to learn more.

If your team is mapping out what is next—or preparing to defend the next infrastructure request—this session will offer insight into what is working across the sector.

Conclusion

We do not need to be convinced of the value of Atlas 14. We use it every day. But as expectations shift and standards evolve, how we apply it matters more than ever.

This is not about reintroducing the data. It is about strengthening the decisions built on it.

Join us for Bentley and Carahsoft’s webinar, “Future-Proofing Flood Modeling: Meeting Today’s Federal Standards and Tomorrow’s Flood Risks,” on November 13, 2025. Register Now.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Bentley, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Tightening Federal OT Cyber Incident Reporting For Critical Infrastructure

Posted on by Michael G. "Schu" Schumacher

Process-Oriented OT Cybersecurity with SIGA

Federal agencies and regulated operators of critical infrastructure are entering a new phase in operational technology (OT) cybersecurity. While many sectors have long followed voluntary guidance such as the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-82 Revision 3, recent years have seen a steady tightening of Federal cyber incident reporting requirements for critical infrastructure. This trend continues in 2025 with additional sector-specific rules taking effect and the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) moving toward its final rule.

From Guidance to Requirements

Federal oversight of OT cybersecurity has moved beyond broad guidelines into a phase where specific reporting obligations are being set by sector. The shift reflects a growing emphasis on timely and consistent incident data that can be used for coordinated national response.

In 2025, several key developments are shaping the landscape:

Federal OT Cyber Incident Reporting, blog, embedded image, 2025

Pipelines: The Transportation Security Administration (TSA) Security Directive Pipeline-2021-02F, effective May 3, 2025, continues to require mitigation measures, testing and contingency planning for pipeline operators. These measures have been in place since the Colonial Pipeline incident and are now firmly embedded in regulatory practice.
Water and Wastewater: The EPA Water Sector Cybersecurity Program has updated its technical assistance and incident-response guidance. While participation is voluntary, the program mirrors many of the practices found in regulated sectors, indicating where expectations are headed.
CIRCIA: The Act is expected to be finalized in late 2025. Once in effect, it will require reporting significant incidents within 72 hours and ransomware payments within 24 hours, creating a cross-sector Federal baseline for incident reporting.

For Public Sector operators in energy, transportation, water and other essential services, these actions confirm that Federal expectations are moving toward consistent, evidence-based incident reporting across critical infrastructure.

The Reporting Challenge in OT Environments

Meeting Federal reporting requirements depends not only on having the right policies in place but also on the ability to detect and verify incidents quickly. In OT environments, many cyber events start as small changes in process behavior that do not appear in traditional network monitoring. When these early signs go unnoticed, agencies may be unable to confirm the incident, assess its impact or provide the detailed operational evidence that regulators require.

In the Purdue Enterprise Reference Architecture (commonly referred to as the Purdue Model), Level Zero refers to the lowest layer of an industrial control system. This is where raw input and output (I/O) signals from field devices report the actual status of equipment such as pumps, valves, circuit breakers and turbines. These electrical signals are the first and most reliable indicators of what is happening in a physical process, and they exist independently of the network data that higher levels use.

Without visibility into Level Zero, operators face several obstacles:

Difficulty confirming whether a cyber event has actually affected operations
Limited ability to quantify operational and safety impacts with precision
Gaps in the time-stamped evidence needed to meet short Federal reporting windows

The challenge is heightened in environments that mix aging legacy systems with modernized control platforms. These environments often lack unified monitoring, making it harder to capture the unaltered operational data regulators now expect.

Why Process-Oriented OT Cybersecurity Matters

In the Purdue Model, Level Zero is the process interface where the control system reads and drives raw I/O signals. Those unprocessed signals provide the closest, most reliable view of real operating conditions, so early signs of a cyber-physical impact frequently show up there first.

Process-oriented OT cybersecurity focuses on monitoring these raw signals in real time. By capturing them out of band from the operational network, agencies gain a trusted source of truth that cannot be spoofed or altered by a network-based attack. This data enables:

Clear timelines of operational changes before, during and after an incident
Early detection of anomalies that may indicate tampering or failure
Reliable forensic evidence for post-incident reporting and compliance audits

This approach bridges the gap between traditional IT security tools and the operational realities of critical infrastructure, ensuring that reporting requirements can be met with both speed and accuracy.

SIGA’s Role in Compliance Readiness

SIGA delivers process-oriented OT cybersecurity for critical infrastructure. SigaGuard connects directly to control-system I/O modules and continuously monitors raw electrical signals at Level 0, entirely out of band from the operational network. This preserves system performance and provides a tamper-proof view of operational data.

SigaGuardX: Early Threat Detection
SigaGuardX supports evidence-based determination of when a cyber event is underway. It classifies whether activity reflects normal operations or an OT cyber breach by applying multiple artificial intelligence (AI) models and cross-referencing the MITRE database of known attacks. It also performs real-time comparisons between Level 0 signal behavior and data from Levels 1 through 4 to surface possible false-data injection attacks, including Stuxnet-like patterns.

Siga-PAS: Process Attack Simulation
Software-based simulated anomalies replicate real-world attack scenarios. Siga-PAS enables agencies to prepare for and respond to OT-specific threats without disrupting ongoing operations, while validating detection logic, incident playbooks and reporting workflows.

Compliance Outcomes

High-fidelity operational evidence that aligns with CIRCIA and sector-specific reporting requirements
Regulator-ready forensic records of sequence, scope and impact
Faster reporting through actionable alerts with operational context
Rapid verification of whether a cyber event affected critical processes

By integrating SIGA’s Level 0 monitoring into existing security operations, agencies can meet tightening Federal reporting requirements and improve their ability to detect, contain and recover from OT cyber incidents. This strengthens both regulatory compliance and the continuity of essential public services.

Visit Carahsoft’s SIGA solutions page to learn more about how SIGA’s cyber-physical security solutions can strengthen your agency’s infrastructure.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including SIGA, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Securing Government AI: Why Federal Agencies Need a Trust Layer for Accountable, Compliant Deployment

Posted on by Seema Khinda Johnson

Federal agencies must deploy AI fast – but safely. The White House’s Executive Order, new OMB guidance requiring Chief AI Officers, and citizen expectations are driving rapid adoption. More than 1,700 AI use cases are already live across Government, doubling in just one year.

The challenge? Traditional security can’t keep up with AI systems operating at machine speed and scale. Federal agencies need Zero Trust architecture built specifically for AI agents, not retrofitted legacy systems. The recent addition of Nuggets’ Trust Layer solutions to the GSA Schedule provides exactly that foundation.

The Zero Trust Imperative for Government AI

Here’s the reality: AI agents make thousands of decisions per second across multiple systems. Without Zero Trust verification, agencies can’t prove who authorized what action, when or with which data.

The core challenges are clear:

Speed vs oversight: AI operates faster than current security can verify
Scale: Thousands of simultaneous agent interactions with no unified oversight
Accountability gaps: No audit trails for autonomous decisions in black-box systems
Compliance blind spots: NIST IAL2/IAL3 standards weren’t designed for autonomous AI
Sophisticated threats: AI-powered spoofing attacks that overwhelm legacy defenses

Federal agencies face intense pressure to adopt AI, but risks around bias, privacy, accountability and public trust threaten safe deployment. The gap between what agencies must deliver–secure, transparent, compliant services—and what legacy systems can support continues to widen.

Why Legacy Solutions Can’t Keep Up

Traditional identity systems were built for humans, not AI agents. While protocols like Agent-to-Agent (A2A) and Model Context Protocol (MCP) enable coordination between agents and tools, they don’t verify trust, intent or authorization, especially when handling sensitive Government data.

Point solutions create security silos and compliance blind spots. Legacy frameworks simply don’t account for autonomous decision-making, leaving agencies without proof of who or what acted, when and with proper authorization. Without this foundation, compliance and accountability are left to chance.

The Trust Layer Solution: Zero Trust for AI

Nuggets provides purpose-built Zero Trust architecture for agentic AI. Recognized by Gartner as a leader in decentralized identity, our trust layer embeds verification into every AI interaction, no matter the agent, system or data involved.

The comprehensive architecture creates compliance by design through three core capabilities:

Verifiable Identity: Cryptographically verified identity for every human, organization and AI agent that works across all platforms, contexts, devices and systems.

Complete Audit Trails: Every AI decision creates tamper-proof records with consent receipts and authorization proofs that meet Federal accountability requirements.

Standards Compliance: Built-in adherence to NIST IAL2/IAL3, AAL2 and UK Digital Identity Trust Framework requirements, ensuring agencies can deploy AI while meeting stringent security standards.

The result: a Zero Trust foundation on which agencies can deploy autonomous AI systems with confidence that every action is verified, compliant and auditable. This will enable both rapid innovation and Government accountability.

Real Impact: Government AI That Works

For Government IT leaders, the practical outcomes are substantial and measurable. Agencies using Nuggets’ trust layer achieve:

Operational Confidence: AI agents operate autonomously while maintaining security standards, delivering efficiency without sacrificing oversight.

Compliance Assurance: Built-in adherence to Federal identity verification requirements eliminates compliance guesswork.

Mission Success: Complete audit trails for all AI interactions and decisions ensure accountability while preventing unauthorized actions that could compromise sensitive operations.

Real-world use cases demonstrate the impact: automated document processing across agencies with complete audit trails, AI-driven eligibility checks and fraud detection that withstand regulatory scrutiny, secure inter-agency data sharing with verified agent identities and AI-powered citizen services that maintain privacy while delivering efficiency.

Each deployment proves that agencies can achieve both AI innovation and Government accountability, systems that are trusted by regulators, citizens and the mission itself.

The GSA Schedule Advantage

Procurement complexity often slows Government adoption of new technologies, but Nuggets eliminates these barriers. The solution is available through multiple pre-vetted contract vehicles, including GSA Schedule No. 47QSWA18D008F, SEWP V contracts, ITES-SW2, NASPO ValuePoint, OMNIA Partners and E&I Contract.

This means agencies can move from evaluation to deployment quickly, leveraging Carahsoft’s established Government relationships and support infrastructure. No lengthy procurement delays, no security gaps, no compliance questions.

Ready for Trusted AI Deployment?

As agencies expand AI capabilities, traditional security cannot keep pace with the speed, scale and complexity of autonomous systems. Purpose-built Zero Trust infrastructure is essential for agencies that must balance innovation mandates with compliance requirements and public accountability.

See how Federal agencies are deploying AI that’s secure, compliant, transparent and trusted. Schedule a personalized demo to explore how Nuggets’ Trust Layer can secure your agency’s AI deployment with the accountability that Government operations require.

Deploy AI that’s trusted by regulators, citizens and your mission. Contact Carahsoft at (844) 214-4790 or Nuggets@carahsoft.com. Learn more at www.carahsoft.com/nuggets.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Nuggets, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Enabling Rapid Compliance with Sysfleet’s RPA Tools

Posted on by Sam Timothy

As technology evolves, Government agencies seek to modernize effectively, securely and efficiently. By utilizing Sysfleet’s RPA tools, agencies can reach compliance, automate workflows, embed data loss prevention and promote solution-based, application life-cycle models.

The Power of RPA

Robotic Process Automation (RPA) tools refer to automation software that performs repetitive, rule-based tasks. In Government agencies, increasing efficiency is a primary concern, as it enables agencies to deliver solutions in a timely fashion.

There are three main benefits to RPA tools. RPA tools:

Shorten the life cycle of requests
Eradicate human error by automating menial tasks
Improve security by detecting anomalies

Traditionally, Government struggles with high-risk projects; projects require an investment of time to gain approvals, and market monopolies result in high premiums. RPA enables Government to shorten the life cycle of projects, which reduces costs and expedites delivery time.

With the added capabilities of artificial intelligence (AI) and machine learning (ML), RPA tools can replace old-school application program interfaces (APIs) development, which can be draining and slow. Through hyper-automation, RPA enables users to carry out operations swiftly.

Meeting Government Needs with RPA

Before onboarding new technology like RPA tools, the Government expects certain inherited features, such as web content, accessibility controls, guidelines and FedRAMP certification. Sysfleet Consulting LLC, a technology solutions company that simplifies business processes, automates workflows and improves efficiency through system integration, is equipped to address the unique needs of Government agencies and enterprises.

Sysfleet helps Government agencies and enterprises gain compliance and audit readiness with its RPA solutions. Sysfleet’s RPA solutions have a unique focus on compliance automation. By transforming manual workflows into controlled, automated processes, Sysfleet embeds audit readiness and data security directly into agency workflow. Additionally, Sysfleet’s RPA tools can modernize with existing legacy systems without disrupting ongoing operations, cutting down on modernization costs. Sysfleet has delivered measurable results, enabling agencies to cut down on processing time by 30-70%, saving hundreds of labor hours quarterly.

Products to Enable Rapid Compliance

As an official Microsoft partner, Sysfleet utilizes applications such as Power Automate, UiPath and Blue Prism Automation to help customers automate repetitive tasks. Through the Power Platform’s Center of Excellence (CoE), a Microsoft product that enables data loss prevention, Sysfleet automatically captures data, enabling users to follow and trace data trails. Additionally, Power Platform maps to National Institute of Standards and Technology (NIST) and Federal Regulation section 508, and can operate within existing Government cloud boundaries and other external systems.

Benefits of the RPA-Enabled Automation

Sysfleet improves operational performance through automation. Traditionally, State Government approvals take years, draining time and resources. With Sysfleet’s RPA tools, agencies can shorten internal approval time by 55%, gaining a return of investment within just six months. The tools automate safely and are easy to scale to existing applications. Additionally, Sysfleet’s RPA tool can expedite long manual processes that traditionally contain human errors due to their complexity.

Carahsoft and Sysfleet

Through strategic partnerships, Sysfleet ensures secure, scalable, future-ready solutions. Sysfleet has proven leadership in Government automation projects, delivering measurable results in mission-critical workflows. By partnering with Carahsoft, Sysfleet is further empowered to support the Public Sector. Carahsoft enables Sysfleet to reach Government customers nation-wide, to help agencies expedite the procurement process, scale and reach marketing and offer solution bundling.

Learn how agencies can accelerate modernization and embed security into every workflow.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Sysfleet, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Why CMDBs Alone Aren’t Enough for Effective Asset Management

Posted on by Raymond Purdy

Federal agencies rely on Configuration Management Databases (CMDBs) to track and manage their assets. But here’s the challenge: CMDBs depend entirely on the data that gets fed into them.

When discovery tools miss devices, when multiple tools report the same device but with different details, when manual processes slow down or when new virtual environments spin up outside of standard procedures, those assets are either invisible or in conflict in your CMDB.

IT and security teams are forced to turn to manual processes to prevent duplicate or inaccurate CMDB records and update missed asset changes. Yet even then, the system inevitably lags behind the reality of the assets in Federal environments.

As a result, your inventory becomes incomplete or outdated and creates real risks, from failed audits to unaddressed vulnerabilities to disruptions in critical business operations.

Your Federal team faces a difficult choice. You can spend significant time and resources continually auditing the CMDB, manually joining data from disparate tools to seek out the truth. Or you can accept the risk that comes with low-quality, “dirty” data. Neither option is ideal when you are accountable for meeting Federal security requirements.

Fortunately, there’s a third, and much better option.

How to complement a CMDB with automated, actionable asset intelligence

To get a full picture of your asset landscape, you need to architect your asset data framework so that it continuously updates both itself and your CMDB. This is where the Axonius Asset Cloud platform comes in.

The Axonius Asset Cloud is an actionability platform that addresses the common gaps in CMDBs by automating asset discovery and inventory across the entire IT and security footprint. You get an always-current, comprehensive and accurate inventory of your entire asset ecosystem. Axonius also looks for potential policy violations and helps administrative and security teams in prioritizing configuration and vulnerability response efforts.

The Axonius Asset Cloud natively provides more than 1,200 adapters that connect to and integrate with commonly deployed security and IT tools, including 27 CMDB platforms. These adapters continuously collect information on 40+ types of assets across IT and security, including devices, users, software, vulnerabilities and configurations.

Axonius turns raw, noisy and overlapping data into a complete, accurate and always up-to-date model of your entire environment through the Axonius Asset Intelligence pipeline. The bar we set for the information Axonius serves is decision-grade output. Each stage in this intelligence pipeline solves a specific class of data engineering problems that static inventories, vulnerability scanners, SIEMs and CMDBs struggle to optimize on their own.

After building this normalized and correlated view of the assets and risks in your environment, Axonius then compares them to what’s in your agency’s CMDB, deletes unwanted or redundant tools from the list and adds any missing assets or metadata to your inventory. You can finally trade hours of data cleanup for decisive moves that secure your systems.

*Uncover assets not tracked in your CMDB*

Security operations teams benefit from the Axonius Asset Cloud as well. The platform can automatically create remediation tickets whenever it discovers a vulnerability. Operations teams can be alerted immediately and prioritize their response to the tickets based on severity or urgency, confident that they have a clear and complete picture of affected systems, users and devices.

Post-incident, the same reports in the Axonius Asset Cloud give teams confidence that the incident has been fully resolved by confirming that affected systems, applications or user accounts have been successfully and completely remediated.

Supercharging your CMDB with Axonius accomplishes multiple objectives:

Your agency gains a real-time, comprehensive view of all its assets, maximizing your CMDB investment and empowering both IT and Security operations.
You can instantly identify rogue or non-compliant assets and respond to ticket requests within a day.
You can uncover unused or legacy assets that are costing your agency money or putting it at risk.
You significantly reduce manual CMDB upkeep and free up hours for higher-impact work.

*Spot conflicting details or missing attributes*

Axonius in action: How the platform works with ServiceNow

Let’s take a look at how this works using the ServiceNow CMDB as an example. First, select the configuration items (assets) you want to ingest into ServiceNow. Axonius imports the selected data into ServiceNow via APIs. This allows you to query, visualize and take action on all of the CMDB data imported into the system.

From there, the platform goes to work, scanning assets, creating tickets, updating inventory and removing assets that should not be in the CMDB, all in real-time. You can then generate reports that highlight vulnerability gaps and items that require correction.

*Axonius complements CMDBs, such as ServiceNow, by highlighting asset trends and identifying missing devices and fields.*

You can use the combination of Axonius and ServiceNow, or other CMDBs, to ensure compliance with FISMA, CISA BOD 23-01 and other relevant standards. The Axonius Asset Cloud platform can pull compliance data from ServiceNow, eliminating the need for manual compliance tracking through the CMDB.

Want to see Axonius in action? Here’s a quick demo by James Flores showing how Axonius improves CMDB coverage.

Leveling up your CMDB

In a time when Government efficiency is under the microscope, agencies need more than a CMDB alone to manage their assets effectively. While CMDBs are valuable for tracking configurations and relationships, relying on them as the sole source of asset information can be time-consuming, impractical and potentially inaccurate. This leads to significant lost hours, unnecessary costs and damaging security vulnerabilities.

The best option—the only option, really—is to complement your CMDB with a solution that gives you instant visibility into its coverage.

The Axonius Asset Cloud allows you to identify gaps, track trends, update CIs and asset data in the CMDB and power incident response teams. It levels up your CMDB to save time, money and your organization from potentially serious security risks.

Learn more at https://www.axonius.com/federal-systems.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Axonius we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Cloud Security: Complex Threats, Clear Solutions

Posted on by Candace Thorson

Cloud technology, for many years, enticed agencies looking for savings and efficiencies. Organizations pursued “cloud-first” policies that migrated data and applications away from onsite infrastructure and into the control, at least in part, of cloud service providers. While the cloud offered promising advantages, some agencies encountered unexpected cost challenges along the way. And lately, malicious actors have gotten exceptionally good at exploiting cloud vulnerabilities.

There isn’t one way to secure your cloud platform, unfortunately. You need a holistic, Zero Trust approach that combines security controls with cyber policies and procedures. Strong encryption and access rules, automated updates, clear visibility and detailed incident response plans are all critical. Knowing who’s responsible for what should go without saying. And repatriating data — bringing it back on premises, for example — is often a commonsense answer.

“Agencies have to comply with stringent regulations … so that means they need a really robust [security] framework, all while managing the complexities of the cloud environment,” said Garrett Lee, Regional Vice President for Public Sector in Broadcom’s Enterprise Security Group. “Cloud, you know, solves some problems, but it also creates some others.” 

In this video interview, Lee explores both the opportunities that cloud computing offers and how to confront its security challenges. Topics include: 

What a holistic approach to cloud security entails
The cost and security drivers behind data repatriation, and why they matter
How to secure four critical domains: endpoints, data, the cloud and networks

Want to learn more cyber resilience strategies? Download Symantec, Carbon Black and Carahsoft’s guide to explore four critical cyber force multipliers that enhance agencies’ security posture amid growing threats and limited budgets.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

This post originally appeared on GovLoop.com, and is re-published with permission

Efficient, Continuous Identity Verification with 1Kosmos’s Enterprise Identity Wallet

Posted on by Christine Owen

In the age of digital technology, digital identity wallets offer users a transportable, secure way of verifying their identity and certifications. Having a reliable, up-to-date method of verifying identity enables enterprises to swiftly and securely manage procedures.

Switching to Digital Wallets

Digital wallets provide a flexible, streamlined experience for enterprises, employees, third-party contractors and business-to-business transactions. In spaces where transactions are high-risk, having a secure, verifiable identity to cross-reference is vital to security. Digital wallets can verify end users for active attorney license statuses, active medical licenses or to prove cybersecurity certifications, such as Certified Information Systems Security Professional (CISSP). These can follow employees throughout their employment.

Utilizing digital wallets in decision-making spaces can help verify end users in addition to their every-day authenticators, similar to step-up authentication. Digital wallets verify identities, eliminating the need for social engineering. If credentials are needed to gain privileged user access, digital wallets help enterprises verify that the end user is who they say they are. For example, during emergencies, such as natural disasters, wallets can help verify that volunteers have active licenses in a timely manner.

1Kosmos’s Enterprise Identity Wallets

1Kosmos enterprise identity wallets deliver centralized, scalable identity management that enable organizations to securely provision and govern employee digital identities, credentials and access privileges across their entire technology ecosystem.

First, 1Kosmos verifies the end user by validating and verifying their provided documentation. Once verified, 1Kosmos creates a digital wallet by collecting, encrypting and storing an end user’s identification information in a private and permissioned ledger, allowing only the end user to access and share their personal data on their own initiative. This information cannot be accessed by 1Kosmos, as it goes through several layers of encryption.

These wallets are built with World Wide Web Consortium (W3C) standards, providing an interoperable experience and enables users to reuse wallets and access their identification as often as needed.

1Kosmos’s Digital enterprise identity wallets are classified through a decentralized management system. 1Kosmos’s private, distributed ledger breaks up end users’ identification wallets, updating new certifications and licenses in its own personalized block, utilizing blockchain in the back end to provide a layer of security to encrypt information. Permissions are access based, providing a layer of security through segmentation. 1Kosmos’s wallets utilize attribute-based access control (ABAC) security, granting permissions based on matching data tags. With the proper credentials, end users can access files instantly.

Protection for High-Risk Transactions

1Kosmos’s enterprise identity wallets have an array of features that make them perfect for high-risk transactions. The wallets have a private and permissioned ledger, offering a distributed identity experience over a centralized one. With Presentation Attack Detection (PAD) Level 1 and Level 2 certifications, 1Kosmos offers protection against deep fake attacks. 1Kosmos offers continuous vulnerability management, FedRAMP high authorization, Kantara certification and Federal Information Processing Standards (FIPS)-140-3 encryption. Perfect for enterprise use and a diverse set of end users, 1Kosmos’s wallets can verify identity, ensuring that all processes are efficient and secure.

Visit 1Kosmos’s page to learn more about their full service, privacy preserving enterprise identity wallets.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including 1Kosmos we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Secrets to Public Sector Sales Success: Insights from Marion Square’s Harvey Morrison

Posted on by Harvey Morrison

The Federal Government needs more solutions, not more software. That is the message we at Marion Square get every day from our agency contacts. They do not want lists of product features or emails about why one technology is better than another. They want to know how that technology will meet their very specific needs, how it will fit into their unique IT architecture and, most importantly, how it will help them solve their challenges.

As such, successfully selling to agencies today looks a lot different from what it did a few years ago. It is not about getting 50 meetings with 50 different agencies; that scattershot approach is a waste of time. Instead, it is about ensuring that the right meetings are held and that each one matters.

That is where Marion Square comes in. We help technology vendors align their products with mission impact and operational fit. Our advisory approach blends deep market intelligence with tailored go-to-market strategies that position technology not as a product, but as an answer to an agency’s most pressing needs.

Based on our conversations with agency contacts, here are the key trends shaping Federal buying behavior, and how we recommend vendors respond.

The Three Pricing Archetypes Driving Public Sector Purchasing

The Government is still under immense pressure to bring costs down and increase efficiencies. Over the past few months, we have heard from many clients whose customers have called for price reductions. We advise them on three ways to respond:

Leading with aggressive time-boxed discounts designed to disrupt incumbents.
Holding pricing steady but adding capabilities to consolidate functionality and edge out niche competitors.
The “default discount” simply lowers the price without a strategic hook.

Vendors must choose their approach carefully. A bold discount can open doors but risks setting unsustainable expectations. Value bundling requires clear articulation of how those added features meet specific mission needs. And while price cuts may help win deals in the short term, they should be anchored in a broader licensing or adoption strategy to avoid devaluation.

Partnering With Services Companies Is a Winning Strategy

Agencies need help navigating integration, implementation, training and sustainment. That is why partnering with services companies is essential. These firms bring institutional knowledge, procurement relationships and hands-on delivery capacity that agencies trust. When a vendor brings a product plus a credible partner to help stand it up, it reduces perceived risk and increases purchase confidence.

At Marion Square, we help clients align with the right service partners early in their go-to-market process. Doing so allows them to frame their offerings not as standalone tools, but as parts of larger, operationally relevant solutions.

Indeed, we have seen a lot of success when vendors position themselves alongside integrators or mission-focused contractors who already have traction within an agency. The collaboration strengthens the overall value proposition and gives agencies greater confidence that the solution can be deployed effectively and deliver measurable outcomes.

Agencies Look to Vendors For Education, Not Just Products

Many Federal stakeholders are overwhelmed by emerging technologies and new mandates. They value a partner who can help them unpack directives like the Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 23-02, for instance, or understand how artificial intelligence (AI) tools can improve workflows, cybersecurity initiatives and so forth. Vendors who show up with insight, rather than just information, become trusted advisors and separate themselves from the pack.

We also see a significant knowledge gap around the innovation programs already available to agencies. Beyond well-known pathways like Small Business Innovation Research Programs (SBIRs), many Government stakeholders are unaware of other funding mechanisms and pilot opportunities that could support emerging technologies. So, we work with clients to help them think of new ways to present their technology and receive funding for their solutions.

For example, we worked with a client focused on AI data processing who was using a traditional hardware approach. We identified an opportunity to reposition their architecture to align with a lesser-known innovation program, helped craft a targeted proposal and they secured funding. It is proof that vendors can add value by not only educating agencies on their capabilities but also guiding them toward untapped opportunities to fund and implement them.

Join Us This Fall

In October, we will be co-hosting a strategy session with our partner Carahsoft to discuss these and other issues. We will discuss current market trends and provide attendees with insights into crafting winning sales strategies that drive traction. We will cover what it takes to get agency attention, how to build messaging that resonates and how to position each solution as the one that helps Government teams deliver on their mission.

We hope you will join us!

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Marion Square we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.