Category Archives: Zero Trust

Top 10 Zero Trust Events for Government in 2026 

Posted on by
Reply

As cyber threats grow more sophisticated and perimeter-based security models become increasingly obsolete, Zero Trust Architecture (ZTA) has emerged as the foundation of modern cybersecurity strategy. From identity-centric access controls to continuous validation and application-level segmentation, Zero Trust principles are transforming how agencies protect sensitive data, secure hybrid environments and defend against advanced persistent threats. Carahsoft Technology Corp., The Trusted Government IT Solutions Provider®, supports Federal, State and Local agencies in their journeys through partnerships with leading Zero Trust solution providers. The following events represent opportunities to gain actionable insights, connect with industry experts and explore technologies that accelerate Zero Trust maturity across the Public Sector.  

ATARC’s Cybersecurity Futures: Built on Zero Trust Summit – Part I 

February 26, 2026 | Reston, VA | In-Person Event 

The Advanced Technology Academic Research Center’s (ATARC) Cybersecurity Futures: Built on Zero Trust Summit delivers a comprehensive exploration of Zero Trust operationalization for Federal professionals. This intensive one-day event addresses the practical challenges agencies face when implementing Zero Trust across both legacy and modern systems, featuring expert guidance on artificial intelligence (AI)-enabled threat detection, workforce development and policy evolution. Participants will engage directly with Public Sector decision makers and top industry partners to explore topics such as real-world applications, frameworks and proactive resilience.  

Sessions to look out for: 

  • “Zero Trust Beyond Compliance” – This panel examines how agencies can move past basic compliance approaches to build resilient, adaptive ZTAs that address legacy system modernization and robust data protection strategies.  
  • “Next‑Gen Threats, Next‑Gen Defenses: The Tech‑Cybersecurity Equation” – Experts from Massachusetts Institute of Technology (MIT) Lincoln Laboratory and the Department of War’s (DoW) Chief Digital and AI Office explore how AI and automation are reshaping advanced threats and defensive capabilities that can reduce incident response timelines by up to 40%. 

Carahsoft is proud to co-host this Summit at our Conference & Collaboration Center, alongside ATARC, NextGov/FCW and Washington Technology, demonstrating our ongoing commitment to advancing Zero Trust adoption across the Federal Government. Throughout the day, our team will be available to connect Government professionals with the resources, expertise and solutions needed to successfully implement ZTAs that protect mission-critical operations. We will showcase Zero Trust innovations in our pavilion and are offering 12 unique sponsorships opportunities for our vendor partners, including panel participation, technology showcases and more! 

CyberSmart 2026 – The Two Edges of AI’s Sword 

April 9, 2026 | Reston, VA | In-Person Event 

FedInsider’s CyberSmart 2026 examines how AI is reshaping the cybersecurity landscape for Federal and State agencies. This half-day event will feature expert-led discussions on balancing AI’s defensive power with its potential for exploitation and applying Zero Trust principles across software supply chains and critical infrastructure. Designed for cybersecurity leaders, attendees can engage and network with peers, participating in strategic conversations on balancing innovation with security mandates. 

Sessions to look out for: 

  • “The Intersection of AI and Cyber (and Cyber Defense)” – This session analyzes how AI is revolutionizing cyber warfare tactics, examining both its potential to enhance agency defenses and its exploitation by adversaries. 
  • “Zero Trust and Supply Chain Security Belong Together” – Participants will explore strategies for embedding Zero Trust frameworks into software supply chain risk management. 

Hosted at the Carahsoft Conference & Collaboration Center, this summit is co-organized by Carahsoft and FedInsider. Recognizing the importance of balancing AI innovation with security frameworks, the event will center around critical discussions on Zero Trust, OT protection and AI-risk mitigation. CyberSmart 2026 reinforces Carahsoft’s dedication to helping Government agencies navigate the dual opportunities and risks presented by AI in cybersecurity by connecting them with proven solutions and strategic guidance. 

GovCIO CyberScape Summit 

April 16, 2026 | Arlington, VA | In-Person Event 

GovCIO’s CyberScape Summit assembles Federal and industry cybersecurity leaders to address top priorities in defending against sophisticated threats. The 2026 program emphasizes emerging solutions in AI, Zero Trust and identity, cloud and supply chain security, critical infrastructure protection, data security and incident response capabilities. Held at the Renaissance Arlington Capital View, this one-day event offers attendees the opportunity to engage with experts on strategies for building cyber resilience across Federal missions. 

Sessions to look out for: 

  • “Advancing Identity Management and Zero Trust” – This dedicated session examines how to strengthen identity management and implement ZTAs that secure access points and reduce organizational risk. 
  • “Securing Critical Infrastructure” – While infrastructure-focused, this session will address Zero Trust principles as agencies work to protect essential systems from increasingly sophisticated threats. 

Carahsoft is partnering with GovCIO for the CyberScape Summit, facilitating conversations to aid Federal agencies as they strengthen their cybersecurity posture through Zero Trust and identity management strategies. As The Trusted Government IT Solutions Provider®, Carahsoft provides agencies with expertise, resources and proven technologies needed to advance Zero Trust maturity and meet Federal compliance requirements. Our team will be present throughout the Summit to offer guidance and insights on how to turn Zero Trust principles into actionable implementation strategies. 

DGI 2026 Virtual Workshop – Zero Trust in Practice: Lessons from Public-Private​ Frontlines 

April 23, 2026 | Virtual Event 

The Digital Government Institute’s (DGI) Zero Trust in Practice workshop convenes Public and Private Sector leaders to share Zero Trust implementation strategies and lessons from real‑world deployments. This focused two-hour virtual session emphasizes operational approaches to securing hybrid environments, protecting sensitive data and reducing attack surfaces through continuous validation and application‑level segmentation. The program highlights recent guidance from the Cybersecurity and Infrastructure Security Agency’s (CISA) Zero Trust Architecture Implementation Report and provides agencies with maturity benchmarks for assessing their Zero Trust progress. This workshop is part of DGI’s mission to deliver in‑depth education for Government IT. 

Sessions to look out for: 

  • “CISA’s Zero Trust Architecture Implementation Report: What It Means for Your Roadmap” – This session translates the latest CISA guidance into actionable takeaways, helping agencies align their initiatives with established implementation benchmarks and maturity measures. 
  • “Operationalizing Zero Trust Across Hybrid & Application Layers”– Practitioners share proven strategies for continuous validation and application‑level segmentation, drawing from frontline implementation experiences across Government and industry. 

Carahsoft actively supports the Federal Zero Trust community and is partnering with DGI for the 2026 Zero Trust in Practice workshop, helping to facilitate meaningful knowledge exchange between Government professionals and industry experts. Our team will provide attendees with insights on aligning Zero Trust strategies to National Institute of Standards and Technology (NIST), DoW and CISA frameworks. By bringing together Public and Private Sector perspectives, Carahsoft is fostering a collaborative environment where Government professionals can gain actionable takeaways to advance their agency’s Zero Trust maturity. 

AFCEA TechNet Cyber 

June 2-4, 2026 | Baltimore, MD | In-Person Event 

TechNet Cyber, held at the Baltimore Convention Center, is AFCEA International’s premier cybersecurity summit and tradeshow. Drawing more than 5,000 defense, military and Federal IT professionals, the event focuses on persistent and advanced cyber threats. This three-day forum brings together leadership from U.S. Cyber Command (USCYBERCOM), the Defense Information Systems Agency (DISA), the DoW Chief Information Officer (CIO), industry and academics to explore strategic architectures, cyber operations, policy and joint capabilities essential for national defense. Attendees can engage in expert-led panels, keynote addresses and innovation showcases focused on AI, DevSecOps, network defense and ZTA.  

Attendees can expect: 

  • Zero Trust to be a key focus throughout the event, based on AFCEA’s continued emphasis on secure architectures and identity-driven defense strategies. 

Carahsoft will support the defense and intelligence community at TechNet Cyber 2026 by hosting a Partner Pavilion, providing personalized consultations, sharing implementation success stories and helping attendees identify practical pathways to enhance their agency’s cyber defense capabilities in alignment with the DoW’s Zero Trust strategy. Join Carahsoft and our partners at this year’s event to be a part of the innovative path forward!  

930gov – Mission-Enabled Modern Technology Forum 

July 28, 2026 | Washington, D.C. | In-Person Event 

The Digital Government Institute’s (DGI) flagship 930gov conference brings together Government IT professionals and industry innovators at the Walter E. Washington Convention Center for their 14th annual gathering. Strategically scheduled near fiscal year end, the event features over 50 exhibits and programming across five solution tracks: Records Management, EA/Mission Enablement, Artificial Intelligence and Data Management. and Cyber/Zero Trust. This format enables agencies to align mission objectives with technology investments while connecting directly with decision makers, subject matter experts (SMEs) and actionable content developed by an educational advisory committee. As the longest‑running multi‑sponsored technology forum for the D.C. Public Sector, 930gov provides unparalleled access to solutions and expertise. 

Sessions to look out for: 

  • Cyber/Zero Trust Track: “Operationalizing ZT Across Agencies” – Sessions will address implementing Zero Trust aligned with NIST and CISA guidance, integrating identity, data and application‑level segmentation and documenting lessons learned from Government rollouts. 
  • EA/Mission Enablement Track: “Enterprise Architecture for AI & Mission Outcomes” – This track examines how enterprise architecture drives innovation, enables AI and machine learning (ML) capabilities and helps agencies transition from process‑orientation to results‑driven cultures. 

Committed to helping Federal agencies navigate the intersection of cybersecurity, Zero Trust and emerging technologies, Carahsoft actively supports and promotes 930gov. As Government agencies face pressure to modernize while maintaining robust security postures, Carahsoft is aiding them in finding strategic insights, proven frameworks and expert guidance needed to align technology investments with mission objectives. Our team will be facilitating meaningful conversations across all five tracks, with a particular focus on Zero Trust principles and AI strategies. 

Billington CyberSecurity Summit 2026 

September 8-10, 2026 | Washington, D.C. | In-Person Event 

The 17th Annual Billington CyberSecurity Summit is a gathering of Federal, State, Local and industry cybersecurity leaders at the Walter E. Washington Convention Center. Drawing over 2,500 attendees and featuring 200+ speakers across 40+ sessions and breakout discussions, the summit addresses today’s most critical cyber threats, policy developments and defense innovations. The comprehensive agenda explores AI, secure architectures and emerging cyber trends through plenary keynotes, leadership luncheons and interactive receptions. More than 100 vendor booths will showcase cutting-edge cybersecurity solutions. 

Attendees can expect breakout tracks and panel sessions exploring: 

  • ZTA  
  • identity-centric defense  
  • threat intelligence  
  • resilience strategies  

Carahsoft is looking forward to sponsoring this year’s Billington CyberSecurity Summit and will host a booth to engage with attendees in meaningful discussions and share insights from across the Federal landscape. We will also be hosting a large partner pavilion where attendees can explore proven solutions and receive strategic guidance on how to implement ZTAs that protect mission-critical operations. Check back for more details closer to the event! 

GovCIO Federal Cloud & Data Forum 2026 

October 8, 2026 | Washington, D.C. | In-Person Event 

GovCIO’s Federal Cloud & Data Forum addresses the critical intersection of secure cloud adoption, data modernization and Zero Trust integration for Federal IT and cybersecurity professionals. This one-day forum will examine how agencies can leverage cloud technologies while maintaining compliance with Federal mandates such as Executive Order (EO) 14028 and Office of Management and Budget (OMB) Memorandum 22-09. Attendees will explore strategies for securing multicloud architectures, implementing effective data governance and harnessing AI-driven analytics, all essential components for achieving mission success in today’s complex threat landscape. 

Past sessions covered topics such as: 

  • Applying Zero Trust principles in cloud environments to secure hybrid and multicloud architectures. 
  • Leveraging data modernization and AI to enhance decision-making and mission outcomes. 

Carahsoft is proud to partner with GovCIO for the Federal Cloud & Data Forum, supporting Federal agencies as they navigate the complexities of secure cloud adoption Zero Trust implementation. We will showcase leading solutions from our vendors that help agencies accelerate their cloud journey while maintaining compliance with Federal cybersecurity frameworks. By participating in the Forum, Carahsoft positions itself to better serve the Federal community in its efforts to modernize infrastructure while protecting sensitive data and mission goals. 

ATARC’s Public Sector Zero Trust Summit – Part II 

November 19, 2026 | Reston, VA | In-Person Event 

The second installment of ATARC’s Public Sector Zero Trust Summit extends the conversation on implementing Zero Trust frameworks across Federal, State and Local agencies. This event convenes Government and industry leaders to address practical implementation strategies, legacy modernization challenges and the integration of emerging technologies like AI and automation into ZTAs. Attendees will benefit from thought leadership sessions, networking opportunities and actionable insights aligned with Federal mandates and CISA guidance on Zero Trust maturity. 

Past sessions covered topics such as: 

  • Zero Trust Implementation Strategies for Public Sector Environments 
  • Cross-Agency Collaboration and Lessons from Real-World Deployments 

Carahsoft is proud to support ATARC’s Zero Trust initiatives and will sponsor the November summit, continuing our year-round commitment to helping Federal agencies advance their Zero Trust maturity through every stage of implementation. We will showcase leading solutions from our vendor ecosystem, connecting agencies with the resources and expertise needed to accelerate their journey towards comprehensive Zero Trust adoption.  

2026 Cyber Leaders Exchange 

TBD 2026 | Virtual Event 

The Cyber Leaders Exchange serves as a premier forum for Federal cybersecurity executives and industry leaders to collaborate on strategies for defending against evolving threats and implementing Zero Trust across Government networks. The event has historically featured keynote presentations, expert panel discussions and networking opportunities centered on identity management, secure cloud adoption and compliance with Federal cybersecurity mandates. Attendees can expect actionable insights on operationalizing Zero Trust principles and leveraging emerging technologies to strengthen cyber resilience across agency missions. 

Carahsoft is partnering with Cyber Leaders Exchange again this year for the 2026 Cyber Leaders Exchange, supporting discussions on Zero Trust and cybersecurity modernization. We will engage with attendees throughout the event to share proven strategies, discuss lessons learned from real-world implementations and help agencies identify actionable approaches to strengthening their cybersecurity posture. Our team will showcase solutions from our vendors that accelerate Zero Trust adoption and meet Government compliance requirements. Check back for more details on this critical virtual forum! 

  

This lineup of 2026 events reflects the urgency of adopting Zero Trust in order to protect the critical assets, sensitive data and national security interests that exist in Government networks. These events offer professionals opportunities to learn from pioneering implementations, connect with solution providers and accelerate their own Zero Trust journeys. Carahsoft remains committed to supporting agencies at every stage of Zero Trust maturity through our comprehensive portfolio of vendor-leading solutions. Join us at the events above to explore how we can help your organization achieve Zero Trust objectives, strengthen cyber resilience and maintain compliance with Federal mandates. 

To learn more or get involved in any of the above events, please contact our team at ZeroTrustMarketing@Carahsoft.com. 

For more information on Carahsoft and our industry-leading Zero Trust technology partners, visit our Zero Trust solutions portfolio. 

Securing Air-Gapped and Classified Environments: The Importance of Customized Endpoint Protection

Posted on by
Reply

Military and intelligence agencies manage extremely sensitive information, and their missions often require them to operate in high-risk environments where even the slightest breach of security or sensitive data exposure means disastrous results to the mission and to national security. Their most vital networks are air-gapped—disconnected from the internet—so cloud-native security tools cannot secure these sensitive assets.

There is a myriad of reasons organizations choose to air-gap their systems. To effectively secure classified networks, weapons systems, tactical field systems and critical infrastructure, agencies are faced with the challenge of building and maintaining a security strategy involving endpoint, network and data security defenses that can deliver strong cyber command and control without relying on internet connectivity.

No Single Strategy is 100% Attack Proof

Physically or logically isolating networks into air-gapped networks is a sound security strategy that defense, intelligence and civilian agencies employ to prevent access to sensitive or classified systems and operations. Yet their isolation alone is not enough to ensure air-tight security.

While air-gapping does reduce remote risk, it is not exactly immune to cyber risk. Air-gapped environments are designed to block external adversaries by isolating networks from the internet or a broader enterprise. But that isolation inevitably shifts risk toward the people who do have access—admins, operators, contractors, maintenance staff and trusted vendors. By eliminating one problem, there is often an unintended consequence of risk—by blocking outsiders, threat likelihood from insiders becomes concentrated.

In most air-gapped environments, a small set of users has elevated access. Patching and updates are slow, and monitoring is limited or entirely local to the air-gapped network. Due to the isolation of the systems, physical presence is required, increasing insider impact. This makes insiders the most capable attack vector—whether through malicious or simply negligent behavior. 

Air-gapped environments make heavy use of Universal Serial Bus (USB), compact disks (CDs), digital versatile disks (DVDs), portable Solid-State Drives (SSDs) and sneakernet to move data from system to system, and to apply updates and patches. This offers the opportunity for tampering, and these environments often lack the continuous monitoring needed to spot and stop these risks, resulting in threat detection gaps and delays.  A mature data protection strategy is vital in air-gapped environments to thwart insider threats.

Because air gapped systems rely entirely on local security measures, organizations must build layered, robust defenses to secure classified and sensitive assets. Local protection is everything, and for high-risk agencies that means monitoring and securing every single endpoint.

How Endpoint Protection Fills the Gaps

Endpoint protection is a broad term describing technology and strategies used to secure end-user devices, such as laptops, computers and mobile devices. Since these devices get the most direct human interaction while housing vital data, they are exceptionally vulnerable to cyberattacks, even in air-gapped networks. To avoid critical breaches, security operators must be able to detect, prevent and respond to threats on each endpoint device in any given environment, especially when they interact with classified data.

Many organizations are turning to cloud-native endpoint security solutions that depend upon cloud-based machine learning for anomaly detection. While these endpoint security tools may be suitable for some systems and some environments, they depend on the cloud to function so they cannot operate in disconnected or air-gapped environments. This opens security gaps, leaving devices vulnerable to cyberattacks and insider threats. Security teams can solve this problem by investing in endpoint protection approaches that are well-suited to air-gapped environments, enabling the visibility and control necessary to safeguard these critical systems.

The Benefits of Customizable Endpoint Protection

The ability to tailor security for nuanced policy control and security monitoring—including specific configurations for user roles, device types or classification levels—is crucial to ensure a strong security posture. Endpoint security solutions must also be established independently from the cloud, to run behavioral analytics even in fully isolated network enclaves.

When a threat occurs, detailed information is vital to protecting high-value assets, and robust air-gapped endpoint security systems enable rapid identification and threat mitigation while providing analysts with forensic data for investigation. This critical context also informs refinements to tailor and optimize the security approach for the environment’s unique mission.

Implementing a Zero Trust approach is still vital to reducing threats to air-gapped environments, just as it is in internet-facing networks. Hardening systems by ensuring only trusted software can execute enables the mission but not an attacker.

Safeguarding the data from insider threats is another important element of a mature air-gapped security operation. Data Loss Prevention (DLP) offers an important countermeasure against cybersecurity risk in air-gapped environments and allows security teams the ability to ensure that organizational data is appropriately controlled. 

Two Industry Leaders, One Unbreakable Line of Defense

Defense and intelligence agencies cannot afford to leave gaps from security tooling that is unsuitable to defend disconnected networks and endpoints. They need an endpoint security suite built for their world—one that delivers advanced security capabilities to offline, high-stakes and mission critical IT systems. Symantec and Carbon Black deliver exactly that: proven protection designed for Federal environments.

Both solutions are purpose-built for Government, but each brings its own strengths to the field:

  • Symantec delivers powerful static and dynamic malware analysis, plus built-in USB device management to automatically flag and quarantine malicious media. Symantec also offers an industry-leading DLP solution well-suited to air-gapped environments where ensuring data is properly safeguarded is mission-critical.
  • Carbon Black provides deep behavioral detection and advanced Endpoint Detection and Response (EDR), capturing forensic logs, watchlists tuned to the unique environment and analytics to support detailed investigations. Carbon Black also enables organizations to establish a positive security model with policy-based governance to ensure their systems only execute trusted software and use only allowed removable media devices.

Joined together, renowned brands Symantec and Carbon Black offer proven, mature solutions to safeguard air-gapped environments and data by providing visibility to identify threats and streamline investigations and protection policies to neutralize threats. Their combined detection and granular visibility close the gaps left by cloud-reliant platforms—especially necessary in disconnected air-gapped and bandwidth-constrained environments—giving agencies the command and control they need to stop threats before they compromise the mission.

Watch the expert webinar to hear how Department of War guest speakers are addressing their endpoint security gaps.

Can’t get enough? Download NextGov/FCW’s latest article for deeper insights on the fight to secure air-gapped environments.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Securing Federal Access: How Identity Visibility Drives Zero Trust Success

Posted on by
Reply

Federal agencies face mounting pressure to implement Zero Trust frameworks but often struggle with where to begin. The answer lies in understanding identity telemetry, the insights into who has access to what and how threat actors exploit identities to gain privilege and maintain persistence. Because threat actors increasingly steal credentials and pose as legitimate users, Federal agencies can no longer rely solely on detection tools that trigger alarms after attacks succeed. This shift demands a new approach to Zero Trust, one beginning with comprehensive visibility into the identity attack surface before implementing controls.

From Detection to Prevention

Federal agencies have historically relied on detection-based security tools like Endpoint, Detection and Response (EDR) and Extended Detection and Response (XDR) solutions to detect malicious activity. While still valuable, these reactive tools are inadequate as adversaries are compromising both human and non-human credentials, operating for extended periods. Using legitimate credentials, threat actors gain persistent access and escalate permissions while evading detection.

The missing component is proactive threat hunting that maps potential identity exposure before they are exploited. This requires aggregating identity data across the entire IT environment and analyzing how threat actors could leverage poor identity hygiene such as overprivileged accounts, insecure Virtual Private Networks (VPNs), exposed passwords and secrets, blind spots in third-party access and dormant identities to gain access to critical assets and data. Zero Trust relies on knowing exactly how identities function across the environment; without this visibility, agencies are essentially enforcing Zero Trust policies blindly and wasting time and money by not investing in protection capabilities that are resilient against cyberattacks. Identity telemetry should guide agencies in building proactive identity and mature Zero Trust capabilities.

The Fragmented Identity Visibility Problem

Federal environments span on-prem Active Directory (AD), multicloud environments, federated identity providers and numerous Software-as-a-Service (SaaS) applications, causing confusion, overlap and complex interactions across these different environments that are difficult to track, limiting end-to-end visibility of hidden attack paths for lateral movement and escalation.

These “unknown trust relationships” or “paths to privilege” stem from:

  • Identity provider misconfigurations replicating over-permissive access
  • Nested group memberships granting indirect privileges
  • Federation relationships enabling cross-domain escalation
  • Generic “all access” group rights elevating unprivileged users

These exposures exist between siloed systems and provide entry points for threat actors. Addressing this requires aggregating identity data, mapping cross-domain relationships and calculating the human, non-human and AI based identities. This exposes blind spots and transforms an unknowable attack surface into a manageable identity landscape.

True Privilege Calculation

Traditional privilege assessments focus on group membership and cloud role assignments but miss factors like nested groups, cloud application ownership, misconfigured identity providers and federation pathways. These elements often elevate an identity’s privilege far beyond what surface-level audits reveal.

BeyondTrust, Securing Federal Access blog, embedded image, 2025

True privilege calculation measures an identity’s effective and actual privilege across all connected systems and domains, including relationships, configurations and escalation pathways. For example, an identity that appears low-privileged in AD may federate into Identity and Access Management (IAM) roles and elevate its privilege. This visibility supports key Zero Trust decisions, such as:

  • What access should be continuously verified
  • Gaps in least privilege enforcement
  • Which accounts are most likely to be targeted
  • Where to place micro-segmentation boundaries

Given the scale and complexity of modern Federal environments, manual calculation is impossible. Automated solutions must continuously analyze permissions, relationships and identity provider configurations while mapping escalation paths. True privilege calculation transforms Zero Trust from theory into actionable strategy that goes from implementation to Zero Trust maturity.

Critical Attack Vectors

Dormant privileged accounts, often left active after personnel departures or reorganizations, retain elevated permissions long after their use ends. Threat actors frequently identify and reactivate these accounts to move laterally and maintain persistence using legitimate credentials. Effective identity hygiene requires:

  • Continuous monitoring of new dormant accounts
  • Cleanup of existing dormant or misconfigured accounts and standing privilege
  • Behavioral detection to flag unusual privilege escalation attempts or unexpected activity

Identity security cannot be a point-in-time exercise. Without visibility and a proactive approach, configurations drift and dormant accounts accumulate. Agencies must continuously identify dormant privileged accounts and immediately investigate if they suddenly become active, one of the strongest indicators of compromise. Continuous visibility transforms identity hygiene from a reactive alert-based approach to actionable telemetry for proactive threat hunting around current and known attack risk.

The Expanding Identity Attack Surface

The identity attack surface extends far beyond human users to service principals, cloud workloads, Application Programming Interface (API) credentials and automated systems, collectively known as “non-human identities.” These accounts often have elevated privileges but lack safeguards like password rotation, Multi-Factor Authentication (MFA) or behavioral analytics, creating significant security gaps.

Agentic AI introduces new challenges. Unlike traditional service accounts, AI agents act autonomously based on their instructions, tools and knowledge sources. A seemingly low-privilege agent could escalate privileges by interacting with other agents, creating complex escalation chains. Understanding an AI agent’s effective capability, not just its assigned permissions, is essential.

AI and non-human identity risks come from interconnected relationships. An AI agent running as a cloud workload may access secrets, interact with privileged systems or execute commands across domains. True privilege calculation for these entities requires mapping downstream actions they could initiate. Federal agencies need governance designed for non-human identities and AI agents, including:

  • True privilege calculation of escalation paths
  • Comprehensive inventory across all systems
  • Monitoring of potential blast radius as AI adoption accelerates
  • Context and knowledge of AI use and where agents are being deployed
  • Visibility into AI agent instructions, tools and knowledge sources

Investing in identity visibility now prepares agencies for emerging challenges as AI adoption becomes more prevalent.

Federal agencies must secure hybrid environments against adversaries who exploit identities rather than technical vulnerabilities. The path forward requires shifting from reactive detection to proactive threat hunting, eliminating fragmented visibility, measuring true privilege across all domains, maintaining continuous identity hygiene and extending visibility to non-human identities and agentic AI. Identity telemetry provides the data foundation needed for Zero Trust maturity, showing agencies where and how to strengthen their security posture.

Discover how comprehensive identity visibility drives Zero Trust maturity by watching BeyondTrust and Optiv+Clearshark’s webinar, “Securing Federal Access: Identity Security Insights for a Zero Trust Future.”

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including BeyondTrust, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Securing Government AI: Why Federal Agencies Need a Trust Layer for Accountable, Compliant Deployment

Posted on by
Reply

Federal agencies must deploy AI fast – but safely. The White House’s Executive Order, new OMB guidance requiring Chief AI Officers, and citizen expectations are driving rapid adoption. More than 1,700 AI use cases are already live across Government, doubling in just one year.

The challenge? Traditional security can’t keep up with AI systems operating at machine speed and scale. Federal agencies need Zero Trust architecture built specifically for AI agents, not retrofitted legacy systems. The recent addition of Nuggets’ Trust Layer solutions to the GSA Schedule provides exactly that foundation.

The Zero Trust Imperative for Government AI

Here’s the reality: AI agents make thousands of decisions per second across multiple systems. Without Zero Trust verification, agencies can’t prove who authorized what action, when or with which data.

The core challenges are clear:

  • Speed vs oversight: AI operates faster than current security can verify
  • Scale: Thousands of simultaneous agent interactions with no unified oversight
  • Accountability gaps: No audit trails for autonomous decisions in black-box systems
  • Compliance blind spots: NIST IAL2/IAL3 standards weren’t designed for autonomous AI
  • Sophisticated threats: AI-powered spoofing attacks that overwhelm legacy defenses

Federal agencies face intense pressure to adopt AI, but risks around bias, privacy, accountability and public trust threaten safe deployment. The gap between what agencies must deliver–secure, transparent, compliant services—and what legacy systems can support continues to widen.

Why Legacy Solutions Can’t Keep Up

Traditional identity systems were built for humans, not AI agents. While protocols like Agent-to-Agent (A2A) and Model Context Protocol (MCP) enable coordination between agents and tools, they don’t verify trust, intent or authorization, especially when handling sensitive Government data.

Point solutions create security silos and compliance blind spots. Legacy frameworks simply don’t account for autonomous decision-making, leaving agencies without proof of who or what acted, when and with proper authorization. Without this foundation, compliance and accountability are left to chance.

The Trust Layer Solution: Zero Trust for AI

Nuggets provides purpose-built Zero Trust architecture for agentic AI. Recognized by Gartner as a leader in decentralized identity, our trust layer embeds verification into every AI interaction, no matter the agent, system or data involved.

The comprehensive architecture creates compliance by design through three core capabilities:

Verifiable Identity: Cryptographically verified identity for every human, organization and AI agent that works across all platforms, contexts, devices and systems.

Complete Audit Trails: Every AI decision creates tamper-proof records with consent receipts and authorization proofs that meet Federal accountability requirements.

Standards Compliance: Built-in adherence to NIST IAL2/IAL3, AAL2 and UK Digital Identity Trust Framework requirements, ensuring agencies can deploy AI while meeting stringent security standards.

The result: a Zero Trust foundation on which agencies can deploy autonomous AI systems with confidence that every action is verified, compliant and auditable. This will enable both rapid innovation and Government accountability.

Real Impact: Government AI That Works

For Government IT leaders, the practical outcomes are substantial and measurable. Agencies using Nuggets’ trust layer achieve:

Operational Confidence: AI agents operate autonomously while maintaining security standards, delivering efficiency without sacrificing oversight.

Compliance Assurance: Built-in adherence to Federal identity verification requirements eliminates compliance guesswork.

Mission Success: Complete audit trails for all AI interactions and decisions ensure accountability while preventing unauthorized actions that could compromise sensitive operations.

Real-world use cases demonstrate the impact: automated document processing across agencies with complete audit trails, AI-driven eligibility checks and fraud detection that withstand regulatory scrutiny, secure inter-agency data sharing with verified agent identities and AI-powered citizen services that maintain privacy while delivering efficiency.

Each deployment proves that agencies can achieve both AI innovation and Government accountability, systems that are trusted by regulators, citizens and the mission itself.

The GSA Schedule Advantage

Procurement complexity often slows Government adoption of new technologies, but Nuggets eliminates these barriers. The solution is available through multiple pre-vetted contract vehicles, including GSA Schedule No. 47QSWA18D008F, SEWP V contracts, ITES-SW2, NASPO ValuePoint, OMNIA Partners and E&I Contract.

This means agencies can move from evaluation to deployment quickly, leveraging Carahsoft’s established Government relationships and support infrastructure. No lengthy procurement delays, no security gaps, no compliance questions.

Ready for Trusted AI Deployment?

As agencies expand AI capabilities, traditional security cannot keep pace with the speed, scale and complexity of autonomous systems. Purpose-built Zero Trust infrastructure is essential for agencies that must balance innovation mandates with compliance requirements and public accountability.

See how Federal agencies are deploying AI that’s secure, compliant, transparent and trusted. Schedule a personalized demo to explore how Nuggets’ Trust Layer can secure your agency’s AI deployment with the accountability that Government operations require.

Deploy AI that’s trusted by regulators, citizens and your mission. Contact Carahsoft at (844) 214-4790 or Nuggets@carahsoft.com. Learn more at www.carahsoft.com/nuggets.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Nuggets, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Cloud Security: Complex Threats, Clear Solutions

Posted on by
Reply

Cloud technology, for many years, enticed agencies looking for savings and efficiencies. Organizations pursued “cloud-first” policies that migrated data and applications away from onsite infrastructure and into the control, at least in part, of cloud service providers. While the cloud offered promising advantages, some agencies encountered unexpected cost challenges along the way. And lately, malicious actors have gotten exceptionally good at exploiting cloud vulnerabilities.

There isn’t one way to secure your cloud platform, unfortunately. You need a holistic, Zero Trust approach that combines security controls with cyber policies and procedures. Strong encryption and access rules, automated updates, clear visibility and detailed incident response plans are all critical. Knowing who’s responsible for what should go without saying. And repatriating data — bringing it back on premises, for example — is often a commonsense answer. 

“Agencies have to comply with stringent regulations … so that means they need a really robust [security] framework, all while managing the complexities of the cloud environment,” said Garrett Lee, Regional Vice President for Public Sector in Broadcom’s Enterprise Security Group. “Cloud, you know, solves some problems, but it also creates some others.”  

In this video interview, Lee explores both the opportunities that cloud computing offers and how to confront its security challenges. Topics include:  

  • What a holistic approach to cloud security entails
  • The cost and security drivers behind data repatriation, and why they matter
  • How to secure four critical domains: endpoints, data, the cloud and networks

Want to learn more cyber resilience strategies? Download Symantec, Carbon Black and Carahsoft’s guide to explore four critical cyber force multipliers that enhance agencies’ security posture amid growing threats and limited budgets.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

This post originally appeared on GovLoop.com, and is re-published with permission

Identity is The Backbone of Secure, Agile DoW Missions

Posted on by
Reply

I had the opportunity to present to the DoW community at AFCEA TechNet Cyber where where stakes are high and operational tempo is relentless, embedding security into every layer of the digital environment is no longer optional. Identity governance and administration (IGA) has emerged as a cornerstone of cyber resilience, enabling secure modernization, supporting Zero Trust mandates, and accelerating mission impact.

Identity as a Strategic Force Multiplier

Modern warfare and defense readiness extend far beyond kinetic capabilities. Cyber is now a primary domain of operation, and within that domain, identity is the new perimeter. Identity security is not simply about access control; it is about governing who has access to what, when, and under what conditions—across all users, environments, and applications.

A well-implemented IGA program transforms complexity into control. It provides the visibility and automation needed to reduce risk, enforce policy, and enable agility. From onboarding mission partners to ensuring continuous compliance with audit and risk frameworks, identity governance acts as the connective tissue between policy, people, and mission success.

Governance is the Gateway to Zero Trust

The DoW’s Zero Trust Architecture (ZTA) is predicated on one central truth: never trust, always verify. At the core of this paradigm is the concept of least privilege—granting users only the access they need, nothing more.

IGA platforms like SailPoint do more than facilitate access. They enforce policy and establish what access should look like, continuously verifying access needs, and tie the identity to activity. Instead of relying on static credentials or infrequent certifications, identity governance brings continuous verification to life—ensuring users, devices, and applications are validated and flagged in the policy information point before access is granted.

This proactive stance aligns IGA with foundational guidance such as the Risk Management Framework (RMF), and the NIST SP 800-53 controls. Governance is not just a checkbox; it is operational security in action.

FIAR, Compliance, and Continuous Audit Readiness

Passing audits like FIAR (Financial Improvement and Audit Readiness) is more than a bureaucratic exercise. It’s a demonstration of operational integrity and mission readiness. Identity governance simplifies this process by embedding compliance into everyday operations.

IGA platforms automate access certifications, enforce separation of duties (SoD), and maintain immutable audit trails. Instead of scrambling for documentation during audit season, organizations can prove—at any time—that they were always in compliance. This shift from reactive to continuous audit readiness is a game-changer for large DoW organizations.

Mission Agility Through Automation

In the DoW, time is not a luxury. Missions shift quickly, mission partners rotate often, and new technologies are deployed at speed. Manual processes simply cannot keep up.

IGA enables automation across the entire identity lifecycle. From onboarding new coalition partners to deprovisioning departing contractors, governance tools streamline access requests, approvals, and revocations. This not only enhances security but also reduces administrative overhead, freeing resources for mission-critical tasks.

Moreover, by integrating with technologies like the DoW Federation Hub, identity governance extends its reach to federated and cross-domain environments—supporting secure joint and coalition operations at scale.

Real ROI: Security that Pays for Itself

The value of IGA goes beyond risk mitigation. It delivers measurable return on investment (ROI) through operational and financial gains. These include:

  • Audit cost reductions through automated evidence collection and fewer control failures
  • License savings by rationalizing unused or redundant entitlements
  • Operational efficiency through faster onboarding/offboarding and reduced manual workloads
  • Risk reduction by limiting the window of exposure for insider threats or privilege misuse

This is ROI by design—security investments that drive cost savings while advancing strategic goals.

A Maturity Model for Sustainable Progress

Identity governance is not a one-time deployment—it’s a journey. I have created a maturity model for the DoW that provides a structured path from basic CAC availability to advanced, AI-driven, risk-adaptive governance. Each step builds capabilities that align with Zero Trust pillars, from policy enforcement to real-time threat response.

As organizations mature, they can integrate IGA with other strategic technologies such as Comply-to-Connect, SASE, and XDR, multiplying both security effectiveness and mission agility.

Conclusion: Govern Everyone, Prove Every Access

To secure the mission, you must govern identity with the same rigor used to defend the network. Identity security is no longer a backend control; it is the control plane for modern defense operations.

Govern everyone. Prove every access. This is the blueprint for a Zero Trust future—one where audit readiness is continuous, access is justified, and the mission moves at the speed of trust.

Learn more about how ICAM solutions empower agencies to manage digital identities with precision.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including SailPoint we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

The Hidden Threat: Why Ignoring Non-Human and Third-Party Identities is a Risk You Cannot Afford

Posted on by
Reply

I had the opportunity to present and discuss the threat of Non-Human and Third-party Identities at AFCEA TechNet Cyber with the Department of Defense (DoD) community. It is obvious that the maturity of Identity, Credential and Access Management (ICAM) and all identities is top of mind. The Industry, the National Institute of Standards and Technology (NIST), Department of Homeland Security – Cybersecurity and Infrastructure Security Agency (DHS CISA) and the DoD are all starting to focus on the problem, as it is recognized that identity is no longer just an IT problem—it is the front line of defense. We have been deep in digital transformation and the adoption of Zero Trust frameworks and have discovered an inconvenient truth: most organizations are flying blind when it comes to managing the very identities that power their operations—non-human and third-party users.

And that is a problem.

The New Cyber Perimeter: Identity

The old perimeter—firewalls and virtual private networks (VPNs)—is dead. What stands between you and the next breach is your ability to govern who or what has access to your systems. Yet many agencies remain fixated on credentials and authentication, while ignoring vast swaths of non-human actors (bots, robotic process automations (RPAs), service accounts) and external partners (vendors, contractors, mission partners).

This is not just a gap. It is a canyon.

According to Deloitte, 63% of organizations lack visibility into third-party access. Even more troubling, most have no way to list or audit all machine identities operating in the background. These invisible accounts often have persistent, high-level access and no formal governance, making them prime targets for threat actors.

Real-World Breaches, Real-World Consequences

Look no further than the SolarWinds and Okta breaches. In both cases, attackers exploited unmanaged service accounts or contractor credentials to move laterally and escalate privileges. These were not arcane zero-days—they were lapses in identity governance. And they cost credibility, customer trust and in some cases, national security.

The lesson? You cannot protect what you cannot see. And you definitely cannot secure what you do not control.

Why Automation and Governance Are Non-Negotiable

In a Zero Trust architecture, access is no longer assumed—it is continuously verified. But that verification breaks down when service accounts are created ad hoc, with no expiration dates, no ownership and no audit trail. The same goes for third-party users who are onboarded through spreadsheets or informal emails, then forgotten once their project ends—yet their access lives on.

This is how breaches happen.

Governance gaps like these leave organizations exposed to avoidable risks: policy drift, compliance violations, excessive access rights and a lack of accountability. Without automation and lifecycle management, identities multiply faster than security teams can manage them—leading to sprawl, privilege creep and ultimately attack surface expansion.

The Case for Identity-Centric Security

Modern enterprises need identity security platforms that extend beyond the traditional workforce. That means treating machine and third-party identities with the same level of scrutiny, controls and lifecycle management as full-time employees.

SailPoint’s approach offers a compelling blueprint:

  • Non-Employee Risk Management (NERM): Centralized, auditable workflows for third-party access, including onboarding, offboarding and access reviews.
  • Machine Identity Security (MIS): AI-driven discovery, classification, ownership assignment and access certification for bots, RPAs and service accounts.

Together, these capabilities provide visibility and governance across all identities, regardless of origin. They also support Zero Trust mandates like least privilege, just-in-time access and continuous verification.

Business Benefits Beyond Security

This is not just about reducing risk. It is about enabling speed and scale without sacrificing control.

With strong identity governance:

  • Mission partners and contractors get the access they need faster—without creating long-term exposure.
  • Audit preparation becomes easier, with clear logs of who had access to what, when and why.
  • Compliance improves, especially in regulated industries, based on NIST and other frameworks.
  • Security teams can shift from reactive firefighting to proactive risk management.

And perhaps most importantly: organizations become more resilient in the face of evolving threats.

The Bottom Line

Cybersecurity is no longer just about protecting data—it is about protecting trust. And trust starts with visibility and control over every identity that touches your systems.

If your organization is still relying on outdated processes to manage non-human and third-party users, now is the time to act. Inaction is not neutral—it is a strategic liability. As attack surfaces expand and adversaries grow more sophisticated, unmanaged identities will remain the soft underbelly of your defenses.

Zero Trust is not just a framework—it is a mindset. And in that mindset, every identity matters.

It is time to see what has been hiding in plain sight.

Ready to reinforce your identity perimeter? Discover how SailPoint’s ICAM solutions empower organizations to manage digital identities with precision. Explore Now.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including SailPoint we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

The Top Zero Trust Events for Government in 2025 

Posted on by
Reply

Zero Trust stands out within the cybersecurity market because of its transformative approach to the immensely secure framework of “never trust, always verify.” Zero Trust cybersecurity technology industry experts are driven to safeguard Government networks and offer solutions that align with protecting critical information and reducing risk to national security. Carahsoft supports vendors that help Government organizations understand Zero Trust frameworks, develop a Zero Trust strategy and implement a Zero Trust Architecture (ZTA). Throughout this year, Carahsoft and our partners are participating in several events focused on strengthening Zero Trust throughout the Public Sector. Join us to learn how the industry and Government can collaborate to stay ahead of cybersecurity challenges and build a strong foundation for proactive security. 

Public Sector Network Government Cybersecurity Showcase Series 

Multiple Dates | In-Person Events 

Join PSN’s Government Cybersecurity Showcases, a series of events making multiple stops where attendees can explore how Public Sector leaders can embrace innovation while strengthening cybersecurity. As agencies adopt AI, data analytics and smart technologies, the need for resilient Zero Trust frameworks has never been greater. This event will highlight strategies for securing digital transformation, protecting critical infrastructure and fostering cross-sector collaboration—ensuring that innovation enhances, rather than compromises, security and trust. Don’t miss the teaser for our upcoming cybersecurity series to get a sneak peek at the experts, insights and innovations shaping the future of cyber defense. 

Events to look out for: 

  • Tallahassee, FL – August 27: Agenda 
  • Columbus, OH – September 2025: Agenda Coming Soon! 
  • Austin, TX – November 12: Agenda coming soon! 

Carahsoft has partnered with Public Sector Network to host the 2025 Government Cybersecurity Showcase Series, a multi-city event series focused on the evolving landscape of cybersecurity in the Public Sector. These in-person events will bring together Government decision-makers and industry leaders to explore how innovative technologies—from AI to Zero Trust—are reshaping agency security strategies. Carahsoft is offering sponsorship opportunities to our partners. If you are a partner interested in further details on how to participate, please contact your Carahsoft Team. 

SANS Government Security Solutions Forum 

July 22 | Virtual Event 

The SANS Institute stands on a mission of empowering cybersecurity professionals and honoring the highest standard in cybersecurity education to make the world a safer place. The Government Security Solutions Forum will delve into the latest trends in network protection, AI and cyber defense, supply chain, workforce development and more to help attendees understand how to combat modern threats effectively. In previous years, participants engaged with technology experts and listened to unique panel discussions with audience Q&As surrounding invaluable security initiatives across the Public Sector in areas such as Zero Trust implementation, achieving CMMC compliance and harnessing AI. Join us at this year’s event for all this and more! 

Stay tuned for the official 2025 agenda. Here are some of the topics you can expect at this year’s event: 

  • AI-Augmented Cyber Defense 
  • Zero Trust Architecture 
  • Cyber Defense Best Practices 
  • Securing Government’s Expanding Attack Surface 
  • Navigating Compliance Challenges 
  • Emerging Cyber Threats and Future Trends 

Carahsoft looks forward to partnering with the SANS Institute for the 5th year in a row to bring this event to life. Carahsoft has over 800 employees focused on cybersecurity and partnerships with over 150 vendors. To learn more about the topics discussed at the forum and what to expect in July, read our highlights from last year’s event. 

930gov Conference 

 July 31 | Washington, D.C. | In-Person Event 

The 930gov Conference is the annual multi-track conference that brings together Government IT professionals, thought leaders and solution providers for a full day of education and networking. Hosted by the Digital Government Institute, this one-day event covers a range of critical topics including Cybersecurity/Zero Trust, AI, Cloud, Data and Records Management and Enterprise Architecture. With its turnkey format, 930gov offers Government attendees and sponsors alike a streamlined, high-impact experience—making it one of the most accessible and valuable events of the year. 

Sessions to look out for:  

  • Cyber/Zero Trust Track: Intersection of Cyber, AI and Privacy – This track will feature Zero Trust implementation lessons learned, advancements in continuous monitoring and the evolving threat landscape, including the rise of AI-driven phishing. 

Carahsoft is partnering with DGI to support this event. 2025 sponsors included Carahsoft partners such as Microsoft and Armis. Carahsoft and DGI are offering Turn-key Booth sponsorships that feature premium exhibitor booth space, lead retrieval and overall access to the event. If you would like to get involved, please contact your Carahsoft Team. 

Billington Cybersecurity Summit 

September 9-12 | Washington, D.C. | In-Person Event 

A long standing and experienced event, the Billington Cybersecurity Summit features an extensive array of cyber topics, speakers, sessions and interactive breakouts for attendees to truly immerse in the world of today’s emerging cybersecurity solutions and trends. In its 16th year running, this leading Government cybersecurity summit promises an exceptional lineup of Government presenters, an invaluable leadership luncheon, an all-attendee networking reception and over 100 vendor booths featuring strategy development and technology demos. 

For a sneak peek into what you can expect at the summit, topics covered during last year’s event included:   

  • Zero Trust 
  • Ransomware 
  • Advancing cyber diplomacy 
  • Protecting critical infrastructure 
  • Learning how to use proactive defenses 
  • Engineering AI into cybersecurity platforms 
  • Implementing an effective risk management approach 

Carahsoft is looking forward to sponsoring this year’s event and will feature a booth to engage with attendees throughout the week. We will also be hosting a large partner pavilion and encourage attendees to stop by and learn more about our partners and their technology solutions. Check out the events tab on our website for more details closer to the event!  

Carahsoft Cyber Leaders Exchange 

October 1-2 | Virtual Event 

Presented by Carahsoft in collaboration with Federal News Network, The Cyber Leaders Exchange will dive into how the Government is building cyber resilience, including showcasing tips, tactics and tools to support your organization’s mission-critical cybersecurity efforts. Look forward to sessions about cybersecurity strategy-building, workforce challenges, AI within cybersecurity, Zero Trust and informative speakers from trusted technology vendors as well as Government experts. 

Join Federal News Network for Carahsoft’s 4th Annual Cyber Leaders Exchange, taking place virtually on October 1st and 2nd. This dynamic two-day event will spotlight top voices in Government and industry talking about Cybersecurity. Additional details coming soon. Carahsoft is offering sponsorship opportunities to our partners. If you are a partner interested in further details on how to participate, please contact your Carahsoft Team. 

ATARC Public Sector Zero Trust Summit 

October 23 | Reston, VA – Carahsoft Conference and Collaboration Center | In-Person Event 

This in-person event will feature expert discussions, networking opportunities and insights into the strategies and technologies driving secure, resilient Government operations. 

Sessions to look out for: 

  • Building and Measuring Success in Public Sector Security – This session explores practical approaches to adopting ZTA aligned with current Executive Orders focusing on challenges such as identity management, secure access and legacy system integration. 
  • Zero Trust Beyond Compliance – This session will explore how to leverage modern tools, enhance data protection and integrate Zero Trust into existing infrastructures without disrupting mission-critical operations. 
  • Zero Trust and the Cloud: Strategies for Federal Hybrid Environments – This session will focus on strategies for implementing Zero Trust in federal operations that span both cloud and on-premises systems. 
  • Enhancing Efficiency: Trends, Innovations and the Future of Zero Trust – Explore emerging trends and innovations shaping the future of cybersecurity, including advancements in automation, AI-enhanced threat detection and quantum-resilient encryption. 

Carahsoft is proud to serve as the event partner and host for the ATARC Public Sector Zero Trust Summit for the 7th year. Carahsoft is offering sponsorship opportunities to our partners. If you are a partner interested in further details on how to participate, please contact your Carahsoft Team. Attendees will also have the opportunity to earn up to 6 CPE Credits. 

RSA Public Sector Day 2026 

March 23-26 | San Francisco, CA | In-Person Event 

 The 13th Annual RSA Public Sector Day at the RSA Conference examines key areas such as developing a strong cybersecurity workforce, understanding the impact of artificial intelligence (AI) on both offensive and defensive cyber operations and improving the exchange of information among Government entities.  

Attendees will hear directly from top Government leaders and industry professionals as they discuss their perspectives and strategies for enhancing cybersecurity across all levels of Government and healthcare. Check out our website for more information about our involvement in 2026. 

AFCEA TechNet Cyber  

June 2-4 | Baltimore, MD | In-Person Event 

This flagship event serves as the center of gravity for a whole-of-government effort to bring together the policy, strategic architecture, operations and Command and Control (C2) leaders—along with the joint capabilities—needed to meet the global security challenges and successfully operate in a digital environment. 

Carahsoft’s and more than 50 partners will attend to showcase a full range of cybersecurity, AI, DevSecOps and cloud solutions.  

As Government agencies are implementing Zero Trust strategies to meet sophisticated threats, it is imperative that the tech industry provides the most up-to-date information and solutions surrounding cybersecurity. Join Carahsoft and our partners at this year’s events to be a part of the innovative path forward. 

To learn more or get involved in any of the above events please contact us at ZeroTrustMarketing@Carahsoft.com. For more information on Carahsoft and our industry leading OSINT technology partners’ events, visit our Zero Trust solutions portfolio. 

From Concept to Implementation: Operationalizing Zero Trust Architecture in Government Environments

Posted on by
Reply

Zero Trust has evolved over the last 15 years into a cornerstone of Federal cybersecurity strategy, influencing enterprises as well as State and Local Governments. While the principles of continuous authentication and least privilege are widely accepted, many organizations still need the industry’s support with implementation.

The National Institute of Standards and Technology’s (NIST) National Cyber Center of Excellence (NCCoE) has bridged this gap by offering practical guidance for applying Zero Trust concepts in real-world solutions.

Understanding Zero Trust Principles

Zero Trust is a cybersecurity strategy built on the assumption that networks are already compromised, making it the most resilient approach for securing today’s hybrid environments. Rather than relying on network perimeters, Zero Trust focuses on continuous authentication and verification of every access request, regardless of where those resources are located.

This approach requires organizations to secure all communications through encryption and authentication, grant access on a per-session basis with least privileges, implement dynamic policies, continuously monitor resource integrity and authenticate before allowing access. The objective is to reduce implicit trust between enterprise systems to minimize lateral movement by potential attackers.

Organizations must also collect and analyze as much contextual information as possible to create more granular access policies and strengthen current controls for an enhanced Zero Trust Architecture (ZTA).

NIST’s Role and Guidance

NIST has been instrumental in defining and operationalizing Zero Trust through guidance documents and practical demonstrations like Special Publication (SP) 800-207, published in 2020, which established the foundation for ZTA. Building on this framework, NIST’s NCCoE worked with industry, Government and academia to launch a project to show how these concepts could be implemented in real-world environments.  

Initially focused on three example implementations, the project expanded to 19 different ZTA implementations using technologies from 24 industry collaborators, including Palo Alto Networks.

These implementations were built around three primary deployment approaches:

  1. Enhanced Identity Governance: Emphasizes identity and attribute-based access control, ensuring access decisions are linked to user identity, roles and context.
  2. Microsegmentation: Uses smart devices such as firewalls, smart switches or specialized gateways to isolate and protect specific resources.
  3. Software-Defined Perimeter (SDP): Creates a software overlay to protect infrastructure—like servers and routers—by concealing it from unauthorized users.

Although not included in SP 800-207, the project also recognized Secure Access Service Edge (SASE) as an emerging deployment model that integrates network and security functions into a unified, cloud-delivered service.

Practical Implementation Strategies

Palo Alto Networks - Operationalizing Zero Trust - Blog - Embedded Image - 2025

The NCCoE project tackled the critical question: where should organizations start on their Zero Trust journey? By adopting an agile, incremental approach with “crawl, walk and run” stages, the project phased its implementation based on deployment approaches. This allowed gradual, manageable builds while addressing real-world complexities.

Technologies such as firewalls, SASE with Software-Defined Wide Area Network (SD-WAN) and Endpoint Detection and Response (EDR) using Palo Alto Networks Cortex XDR® were utilized, with remote worker scenarios reflecting modern hybrid environments. NIST SP 1800-35 outlines the phased approach and provides a practice guide, including technologies, reference architectures, use cases, tested scenarios and security controls built into each implementation.

One of the most significant challenges addressed was interoperability between different security solutions. Rather than overhauling infrastructure, organizations can leverage existing technologies while gradually introducing new solutions to enhance security and move toward a mature ZTA.

Integrating Technology Solutions

The NCCoE highlighted how comprehensive security platforms enable Zero Trust principles across hybrid environments. Palo Alto Networks presented a comprehensive ZTA built with artificial intelligence (AI) and machine learning (ML), leveraging capabilities including Cloud Identity Engine for federated identity management, next-generation firewalls for microsegmentation, cloud-delivered security services and SASE for remote access and EDR.

The approach focused on three key objectives:

  1. Continuous trust verification and threat prevention
  2. Single policy enforcement across all environments
  3. Interoperability with other security solutions

AI was embedded throughout the platform—from policy creation to user and device analysis—ensuring that Zero Trust policies are enforced consistently and adapted automatically in response to evolving threats. This intelligent strategy provides a scalable and resilient foundation for securing modern, hybrid environments.

Community Collaboration and A Holistic Approach

The success of the NCCoE project underscored the importance of collaboration between Government and industry to develop practical Zero Trust solutions. This partnership enabled the development of a holistic security monitoring system that can track user behavior across on-premises, cloud and remote environments. The integration of AI and ML streamlined incident response, reducing mean time to detection and resolution.

Experts recommend that organizations begin their Zero Trust journey with fundamental capabilities such as identity and access management (ICAM), endpoint security and compliance and data security. Implementing multi-factor authentication (MFA), integrated with existing Active Directory (AD) systems or identity providers, is an effective first step in strengthening access security. Monitoring network traffic and endpoint behavior using threat intelligence, user behavior analytics and AI allows organizations to proactively detect and respond to threats, providing a solid foundation for a resilient ZTA.

The journey to operationalizing Zero Trust continues to evolve, with NIST planning updates to their guidance documents to address emerging technologies like SASE and special considerations for operational technology (OT) environments. By adopting the principles, frameworks and practical implementation approaches demonstrated through the NCCoE project, Government agencies can develop more resilient security architectures that protect resources across diverse environments.

To learn more about implementing ZTAs in Government environments, watch the full webinar “Operationalizing Zero Trust: NIST and End-to-End Zero Trust Architectures,” presented by Palo Alto Networks, NIST and Carahsoft.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Palo Alto Networks, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

TechNet Cyber 2025: Top 5 Insights on Zero Trust, Interoperability and More 

Posted on by
Reply

Technology is a vital part of the United States Department of Defense (DoD)’s capabilities, making security and enhancements essential to the nation’s stability and growth. AFCEA International’s flagship event, TechNet Cyber, emphasizes the role of cybersecurity and IT within the DoD. Alongside its partners, such as such as Amazon Web Services (AWS), Everfox and Ciena, Carahsoft attended TechNet Cyber to support DoD mission objectives. Carahsoft maintains a unique position in the defense industry with the ability to connect DoD and intelligence community (IC) personnel, Government IT decision-makers, thought leaders and industry and vendor partners. At this year’s conference, leaders and operators in the IT and Defense Department joined to network, facilitate problem solving and explore ways to expedite and secure the procurement process.

Expanding Zero Trust: “Flank Speed” is Ready to Scale 

To safeguard against potential cybersecurity attacks, the DoD is working to secure its networks with Zero Trust, a security strategy focused on identity, credential and access management. In the session “DoD Zero Trust Success Stories,” David Voelker, Zero Trust Architecture Lead for the Department of the Navy, discussed recent initiatives to bolster Zero Trust within Flank Speed, the Navy’s single enterprise Microsoft 365 solution that provides productivity tools, collaboration tools and OneDrive storage. The Department of the Navy is planning to conduct autonomous penetration testing to determine the quality of Zero Trust capability implementation. Last year Flank Speed met 151 of 152 Zero Trust activities, meeting target far ahead of schedule. Flank Speed is the Navy’s single enterprise Microsoft 365 solution that provides productivity tools, collaboration tools and OneDrive storage.

Another speaker, Ian Leatherman, the Zero Trust Strategy Lead for Microsoft U.S. Federal, discussed key takeaways from Microsoft’s work with Flank Speed. Visibility into agency networks is critical to emboldening existing Zero Trust strategies. Mr. Leatherman stated, “When in doubt, collect the telemetry: you never know what new or novel adversary techniques you may find.” Knowing exactly how many endpoints, applications and users are on the network at any given time positions the DoD to swiftly deal with incoming threats. 

Leatherman also discussed recent initiatives to involve all Navy personnel in a cybersecurity strategy; security is more than a technology solution, but a way to ensure safety within the agency. David Voelker, Zero Trust Architecture Lead at the Department of the Navy echoes this statement. While the Zero Trust Portfolio Office set their DoD-wide Zero Trust adoption target as the end of fiscal year 2027, Flank Speed is already operational. Voelker notes that the Flank Speed configuration could be lifted and shifted to other customers in the DoD, with a quick deployment time of under 24 hours. Mr. Voelker also recommends automating this shift.  

Carahsoft and our vendor partners offer several cybersecurity solutions to help Government agencies implement Zero Trust architectures that protect critical information and reduce national security risk. Our offerings align with Public Sector Zero Trust maturity models developed by NIST, the DoD and CISA.  

Carahsoft, TechNet, blog, embedded image, 2025

How Mission Objectives Drive Acquisition  

Acquiring powerful, up-to-date technology enables the DoD to protect against persistent and increasingly sophisticated cyber-attacks. The DoD aims to streamline its procurement process to maintain pace and safeguard against attacks. In the session “DoD Software Modernization Senior Steering Group,” speaker Sean Brady, Senior Lead for Software Acquisition Enablers at the Office of the Undersecretary of Defense (Acquisition and Sustainment), explained that there are two key drivers to this transformation. The first is mission objectives; software should be tailored to allow the DoD to adapt its systems to rapidly changing threats. The second is access to commercial innovation, which allows the DoD to access products in weeks or months rather than years.  

Digital Transformation for Operational Effectiveness 

Digital transformation in the DoD is crucial for maintaining pace with an increasingly technology-driven security environment. Thomas W. Simms, Principal Deputy Executive Director for Systems Engineering and Architecture at the Office of the Under Secretary of Defense for Research and Engineering, discussed the major digital transformation efforts within the DoD. 

The main four are: 

  1. Modular Open Systems Approach (MOSA), a congressional requirement that integrates technical and business strategies to promote acquisition and drives modular designs 
  1. The DoD’s Digital Engineering Instruction, which requires programs to use digital engineering in their design process 
  1. Application Program Interfaces (APIs), a ruleset that allows communication between software applications and is driven by the DoD’s API guidebook, which enables the DoD to become more data-centric   
  1. The DoD’s System Engineering Guidebook, which is currently undergoing an update to incorporate guidance from the Secretary of Defense’s latest memos  

By modernizing legacy systems and enabling the DoD to acquire the newest and greatest in IT, these initiatives enhance operational effectiveness and improve decision-making speed.

Fast-Tracking Authority to Operate (ATO) 

In the defense industry, technology must be approved to mitigate security risks. The Software Fast Track (SWFT), a process that expedites software verification within the U.S. Government, is changing the way the DoD manages risks and conducts Authority to Operate (ATO). Contractors can get involved with the latest software acquisition and risk management changes by participating in the three recently released requests for information (RFIs).  

These RFIs, which close May 20th, are: 

Katie Arrington, the Acting DoD Chief Information Officer (CIO), also discussed the Software Fast Track (SWFT) set to launch on June 1st of this year. The initiative will replace the traditional Authority to Operate (ATO) structure and add a few requirements, such as third-party Software Bill of Materials (SBOM), third-party risk assessments and the population of Enterprise Mission Assurance Support Service (eMASS) with artifacts. Once these guidelines are in place, contractors will gain a Provisional ATO. 

Ms. Arrington attests that these changes will revolutionize the Risk Management Framework (RMF) by allowing industry experts to provide feedback to the DoD. Paper compliance isn’t enough anymore, Ms. Arrington says. The DoD is looking for “continuous monitoring, red-teaming and people to continually evaluate their capability.”  

She also added that the DoD will be sunsetting the Approved Products List (APL). Additional sponsor additions are no longer being accepted. Instead, the SWFT initiative will take over, establishing a “trust, but verify” procedure, promoting both security and swift ATO action.

Using Interoperability to Pitch to DoD 

As operations increasingly move online, interoperability becomes increasingly important to efficiency and accessibility. Venice Goodwin, the outgoing CIO for the Department of the Air Force, offered advice to industry professionals on navigating changes within DoD. Goodwin recommends that the industry practice “extreme teaming;” rather than service each department individually: vendors should focus on servicing the DoD as a whole. As the DoD prioritizes capabilities that have cross-departmental benefits, industry experts should demonstrate the effectiveness of their capabilities and solutions in every domain across land, sea, air and space. With this collaboration, both the Private and Public Sector can get the results they need.

The digital transformation journey within the Department of Defense represents not just an evolution of systems, but a commitment to defending interests at home and abroad. Acquisition, ATO and Zero Trust are all valuable assets to maintaining pace with the current, constantly evolving technological climate, ensuring the United States carries out its mission of protecting the nation. 

To learn more about mission-critical technology, visit Carahsoft’s defense portfolio to explore solutions showcased at TechNet Cyber. For additional research into the key takeaways that industry and Government leaders presented at TechNet Cyber, view Carahsoft’s full synopsis of key sessions from the tradeshow.