https://www.youtube.com/watch?v=wN6iWyLCxtA

ASSYST, a trusted innovator in Cybersecurity, Cloud, and AI solutions for government, today announced the launch of Athena Agentic AI - https://www.assyst.net/athena-ai. 

This next generation platform empowers agencies to think, decide, and act faster through intelligent collaborative agents.

Athena is not a chatbot; it’s a context-aware ecosystem of interoperable AI agents that plan, reason, and collaborate across enterprise systems. Built on ASSYST’s Green Accelerator Framework, Athena enables teams to automate knowledge driven processes, strengthen compliance, and enhance decision intelligence, all within a secure and auditable environment.

“Athena reimagines how mission teams work with AI,” said Vinay Shirke, CIO at ASSYST. “It acts as an intelligent teammate, one that understands mission context, anticipates user needs, and works alongside people to accelerate outcomes responsibly.”

Unlike traditional AI models that operate in isolation, Athena uses the Model Context Protocol (MCP) to connect reasoning agents across structured and unstructured data sources. These agents, such as Planner, Validator, and Reporter, collaborate to interpret policies, summarize complex findings, and recommend next steps, bridging the gap between data and mission execution.

Designed for Trust and Transparency

Athena integrates seamlessly with enterprise systems and AI models, ensuring alignment with federal security, privacy, and interoperability standards. Its built-in explainability and role-based access controls uphold Human-Centered Design (HCD) and ethical AI principles, keeping human judgment at the center of every decision.

“The future belongs to mission ready AI systems that learn, adapt, and collaborate,” added Mr. Shirke. “Athena reflects our belief that AI should amplify human expertise, not replace it.”

About ASSYST

ASSYST is the one-point source for excellence in Cybersecurity, Cloud, DevSecOps, and AI, with over three decades of experience supporting 40+ Federal, State, and Local agencies. As the GSA Federal AI Hackathon First Place winner, ASSYST helps organizations innovate with AI, modernize securely, and intelligently. From continuous ATO automation to AI-driven data interoperability, ASSYST delivers technology that moves missions forward. Discover how to Win with ASSYST -  www.assyst.net/win-with-assyst 

“Leadership isn’t defined by technology alone; it’s defined by the courage to imagine something better and build toward it every day. Vinay embodies that courage.”- Shyama Mandal, CEO, ASSYST 
 

🟢 ASSYST is delighted to celebrate Vinay Shirke, CIO, as one of this year’s GOVTECH CONNECTS ACCELERATE 125 Honorees; a distinction honoring leaders who are reshaping the future of federal IT and driving measurable mission impact.

🔴 GovTech Connects is bringing together Federal, Military, and Industry Health IT leaders for a high-energy look at the next era of digital transformation. Expect bold ideas, Generative AI and hashtag#AgenticAI insights, and forward-thinking modernization priorities shaping 2026. The ACCELERATE 125 Health IT Awards will spotlight innovators driving real impact across hashtag#AI, hashtag#data, hashtag#cyber, hashtag#quantum, and hashtag#UX. It’s an afternoon to celebrate, connect, and accelerate what’s possible in government technology.

Date: Tuesday, December 9, 2025
Time: 2 – 5 pm EDT
Where: Carahsoft Innovation and Conference Center, 11493 Sunset Hills Road, Reston, VA 20190

Join us for an Unforgettable Celebration!

https://lnkd.in/gWxUvd63

The conversation in state and local IT has changed. Artificial Intelligence is no longer experimental; it’s operational. According to the National Association of State Chief Information Officers (NASCIO) 2025 State CIO Survey (https://www.nascio.org/resource-center/the-2025-state-cio-survey/), 90 percent of states are piloting AI projects, and 82 percent report employees already using generative AI tools. That momentum is redefining not only what governments do with data, but who they need to do it.

From Data Clerks to AI Catalysts

Over the past decade, job titles have mirrored technology’s evolution. Early digital programs relied on Data Entry Clerks, Database Administrators, and System Operators. As data volumes grew, we saw the rise of Data Analysts, Business Intelligence Specialists, and Visualization Developers who transformed spreadsheets into insights.

Today, the landscape looks very different: Data Engineers, Machine Learning Specialists, AI Model Developers, Data Governance Leads, and AI Solution Architects. Each new title signals a shift from task-based execution to mission-driven problem-solving. The professionals succeeding in this environment blend policy understanding, ethical awareness, and the curiosity to make AI serve people, not just processes.

From Tools to Transformation

When I first started building data teams, we hired for SQL, Python, and Power BI skills. Today, those are table stakes. The differentiator is mindset, professionals who connect how data serves citizens, not just systems.  NASCIO reports that only 4 percent of states rate their data governance as “very mature,” indicating the next frontier isn’t technology; it’s culture.  Agencies need people who can turn compliance checklists into integrated, insight driven programs.

Spotting Mindsets, Not Just Skillsets

The best candidates talk about outcomes, not outputs. They describe how a predictive model helped reduce emergency response time, how data integration improved equity in public housing programs, or how autonomous actions for permitting systems. That language reveals empathy, systems thinking, and purpose —qualities that set strong technicians apart from future AI leaders. Adaptability, curiosity, and mission focus consistently outlast any single tool or platform.

The Human–AI Partnership

Automation can accelerate analysis, but judgment remains uniquely human. Data professionals who understand both machine learning and accountability are now essential to every modernization effort. ASSYST teams pair deep technical expertise with Human-Centered Design to ensure every model and workflow supports transparency, explainability, and citizen trust. AI isn’t replacing humans, it’s amplifying their ability to make informed, ethical decisions at scale. Our AI solutions, such as Athena Agentic AI, Collab AI, and ComplySyncATO, take a human-centered approach and function as role-based productivity accelerators.

Building an AI-Ready Workforce

Technology investments succeed only when people can adapt them. That’s why our Green Accelerator Program develops data engineers, analysts, and architects into AI-ready professionals fluent in governance, compliance, and mission outcomes. When I connect candidates to these opportunities, I’m not just filling positions; I’m aligning purpose, innovation, and public impact. 

The Bottom Line

The NASCIO 2025 Survey confirms it: states are accelerating their AI adoption, but the real differentiator will be people.
The most valuable data professionals combine technical fluency with public-service intent. They understand models and meaning — turning data into trust, and algorithms into action.

This level of transition is natural and easily implemented in the commercial sector, yet it remains a sensitive subject within state and local government. That’s why we recommend implementing Green Accelerator solutions in states and localities facing workforce shortages while still carrying the mandate to serve their citizens.

The second opportunity lies in supporting programs that lack citizen engagement or are understaffed. By introducing AI-augmented data solutions in these areas, agencies can relieve capacity constraints, enhance responsiveness, and ensure service continuity — without compromising trust, accountability, or human oversight.

At ASSYST, that’s where our mission begins: enabling state and local agencies to harness AI responsibly, bridge workforce gaps, and deliver on their promise of better government for every citizen.

As Account Manager, Matthew Lee (LinkedIn) supports ASSYST’s Master Contracts with the State of Texas (ITSAC) and the State of Florida IT Staff Augmentation Programs. He partners with state technology and program leaders to deliver high-impact IT talent and solutions. He supports resourcing needs for key departments such as Texas DIR, HHSC, DFPS, TxDOT, TEA, and Florida DOH, DMS, DCF, AHCA, and DFS, aligning staffing and delivery with modernization priorities in Cybersecurity, AI, Data, and Interoperability.

Sterling, VA — ASSYST Inc. has been recognized among OrangeSlices AI’s 2026 Elev8 GovCon Honorees, celebrating companies that exemplify innovation, partnership, and excellence across the federal contracting community.

The Federal GovCon sector continues to be one of the most complex and competitive marketplaces in the world, and the consistent, long-term winners are those that deliver not only efficient and effective solutions but also cultivate a corporate culture that demonstrates their own excellence, becoming a beacon for talent, partners, and clients alike.

ASSYST’s recognition reflects its leadership across the eight Elev8 dimensions: Good Partner, Growing Talent, Exemplifying Innovation, Philanthropy, Industry Engagement, Efficiency, Sustainability, and Continuous Improvement.

“This recognition is a reflection of our people and partners who drive innovation with purpose,” said Ram Prasad, Executive Vice President – Business Solutions, ASSYST. “ We are committed to helping our government customers strengthen missions through collaboration, accountability, and forward-thinking solutions that meet today’s needs and anticipate tomorrow’s challenges.”

ASSYST delivers mission-driven outcomes across Healthcare, Defense, National Security, Regulatory, and State and Local agencies, empowering modernization, compliance, and transformation. Its work strengthens cybersecurity for systems serving millions of healthcare beneficiaries at CMS; modernizes shared financial systems at PSC for greater efficiency; advances FDA regulatory systems that protect public health; supports ONC’s efforts to enhance health-data interoperability and quality of care; and enables DHRA’s initiatives to strengthen language and culture preparedness vital to national security. Beyond these engagements, ASSYST continues to drive innovation across emerging domains, including AI governance, data modernization, and secure multi-cloud infrastructure, helping agencies build sustainable, intelligent operations for the future.

Through investments such as the Green Accelerator Framework and commercial solution offerings including Collab AI, ComplySyncATO, Hephaestus, and Athena Agentic AI, ASSYST is advancing sustainable, intelligent modernization across government enterprises, aligning people, platforms, and policy to deliver measurable mission outcomes.

Welcome to ASSYST OnPoint xChange, exploring next-generation DevSecOps in GovTech. Eugene Goldlust, speaking with Vinay Shirke, CIO of ASSYST. They are discussing how AI, automation, and innovative platforms such as ASSYST’s Argus are shaping secure software delivery.

Eugene: Vinay, thank you for taking the time to chat. Federal agencies are under pressure to deliver software faster and more securely. To start, what do you see as the future of DevSecOps and secure software delivery in the federal landscape?

Vinay: It’s an exciting time. We’re seeing DevSecOps really take hold across federal organizations. In fact, the Department of War now has several software factories using DevSecOps to push code into production—and they’re already seeing faster deployment cycles, enhanced security, higher software quality, and better outcomes for users. That kind of success is encouraging civilian agencies to follow suit. The future of federal DevSecOps will involve scaling these “software factory” models across departments, breaking down silos, and ingraining security into every step of the software lifecycle. Security isn’t a box to check at the end anymore; it’s becoming a built-in foundation for speed and innovation. As one industry expert put it, modern missions require security that powers velocity rather than slows it down. Agencies can’t afford to trade off speed for security; they need both for mission success.

Eugene: Right, the stakes are incredibly high. A system failure in government isn’t just a business issue; it impacts mission assurance, national security, citizen safety, and public trust. So DevSecOps is about balancing that responsibility with the need to innovate quickly. How are agencies ensuring that balance holds, especially as they adopt new technologies like AI?

Vinay: They’re evolving their mindset. The agencies that succeed treat security and compliance not as roadblocks but as strategic enablers of faster delivery. We see leadership support for DevSecOps by investing in automation and cultural change. For example, some agencies now embed security experts from day one of a project, even starting the ATO (Authority to Operate) at kickoff, so security requirements run in parallel with development. This “compliance-as-code” approach means things like vulnerability scans, configuration checks, and governance policies are automated in the pipeline. It’s continuous monitoring and continuous authorization, rather than big-bang audits at the end. With DevSecOps, compliance and risk management become ongoing activities that strengthen mission assurance while development continues. And importantly, agencies are keeping a human-centered focus. Barbara Morton from the VA said it well: “You can’t automate empathy, so even as we automate processes, we ensure the end-user’s needs and experience stay front and center. That mindset is crucial for public trust.” Quote from Meritalk.com                (https://www.meritalk.com/articles/va-official-ai-can-boost-efficiency-but-you-cant-automate-empathy/ )

AI’s Role in Software Testing and QA

Eugene: Let’s dive into AI. There’s a lot of buzz around AI transforming software testing and quality assurance. How do you see AI changing the game for federal software QA?

Vinay: AI is a game-changer for testing, no doubt. Traditional testing can be a bottleneck, but AI helps us test smarter and faster. For instance, generative AI can now automatically generate test cases and datasets, even simulating complex user interactions – greatly reducing the manual effort for QA teams. We’re essentially letting AI handle repetitive or highly complex test design work. That means broader test coverage in less time. AI can also detect anomalies and predict high-risk code areas to focus testing where it matters most. And when it comes to security, AI-driven tools in a DevSecOps pipeline can continuously perform real-time code analysis, dependency scanning, and compliance monitoring. The result is higher-quality software delivered more quickly, with fewer security gaps – exactly what NIST has been advocating. In fact, NIST’s DevSecOps guidance notes that using AI in development “improves work efficiency” and yields “higher quality software in a more timely manner”. So, the future of QA will heavily feature AI assistants working alongside human testers.

Eugene: It sounds like AI can supercharge continuous testing. But what about the human element? How do we ensure AI-driven testing still aligns with human-centered design and doesn’t become a black box?

Vinay: Great point. We always pair AI with human oversight and HCD principles. AI can crunch data and suggest tests, but humans still set the testing goals and validate critical scenarios. We ensure that the user experience – including accessibility and usability – is part of the test criteria. Interestingly, AI tools can even assist here: some automation platforms use AI to simulate screen readers or check color contrast, helping catch accessibility issues early. But ultimately, testers and designers review those results to ensure applications are truly user-friendly and equitable. In short, AI handles the heavy lifting and repetitive tasks, while humans focus on empathy, strategy, and creative problem solving. That combination lets us meet HCD goals and mission needs without slowing down.

Strategic Value of an AI-Enabled Test Automation Platform, Argus?

Eugene: Vinay, ASSYST has been progressively building an AI-enabled test automation platform. For our audience of CIOs and tech leaders, what is the strategic value of this platform? How does Argus help agencies deliver secure software faster or better?

Vinay: Argus is all about accelerating quality at scale. Strategically, it provides an enterprise-wide test automation platform that enables agencies to standardize and expedite testing across multiple teams and projects. Under the hood, it’s cloud-based and highly extensible. That means it can integrate with your existing dev tools, continuous integration (CI/CD) pipelines, and even with enterprise test data or requirements systems. By centralizing automated test scripts in a common repository, Argus promotes reusability; you write a test once and reuse it across many applications. This not only improves efficiency and consistency in testing but also lowers the total cost of ownership for quality assurance.

Eugene: And it’s AI supported, correct? How is AI built into Argus?

Vinay: Yes, that’s a key differentiator. We’ve embedded AI capabilities to make the platform smarter and more proactive. For example, Argus can use AI to analyze user stories or requirements and automatically generate test cases aligned with them. It’s like having a co-pilot for your QA team. The platform’s AI can also prioritize tests based on risk or past defect patterns, and it learns over time. Another aspect is AI-driven visual verification: Argus can visually execute test scripts and verify UI elements, helping catch visual or layout issues that traditional scripts might miss. All this means QA teams can cover more ground in less time, with greater confidence in software quality. Strategically, an AI-enabled Argus shortens release cycles (since testing is no longer a bottleneck) and embeds security and compliance checks into tests by default. In other words, it helps deliver high-quality, federal-compliant software from day one. 

Eugene: I like that it aligns with compliance needs automatically – that’s huge for federal programs. So Argus promotes team collaboration, boosts quality and speed, and ensures things like security scanning and even accessibility are baked in. It essentially acts as a quality guardian across the DevSecOps pipeline.

Vinay: Exactly. We sometimes call it a “QA Platform-as-a-Service” for the enterprise. And because it’s cloud-based and modular, it’s easy to adopt for new projects. Teams can onboard quickly, configure it to their tech stack (it’s technology-agnostic for web, API, etc.), and start getting immediate feedback on each build. In the long run, the strategic value is continuous improvement – the more you use Argus, the smarter it gets, and the more your overall software delivery gains a reputation for reliability and trust.

AI Generated Code Testing 

Eugene: Vinay, how is the rise of AI-generated code, including prompt-based development methods like “vibe coding”, impacting testing and quality assurance in federal software delivery? 

Vinay: Great question, Eugene. AI-generated code, even “vibe coded” applications, is dramatically accelerating development cycles. But we’ve also heard horror stories of folks deploying vibe-coded apps only to watch them collapse under load or get compromised due to overlooked quality attributes. So, while I’m excited about the productivity gains, I remain cautious. We must apply the same – if not greater – rigor in testing and QA for AI-produced code as we do for human-written code.

Eugene: Vinay, what risks do you see, such as hallucinated logic in AI outputs, and how should we adapt our validation and continuous testing processes? 

Vinay: One major risk is hallucinated logic. Generative AI can produce code that looks plausible but is subtly wrong or nonsensical. We’ve seen cases where an AI coding assistant generates functions that don’t compile, uses convoluted algorithms that contradict themselves, or even invents calls to non-existent APIs. If such issues slip through, they can introduce hidden bugs or security vulnerabilities. In a federal context, that’s especially dangerous – flawed AI-generated code might create compliance gaps or security holes that undermine our mission. Validation is key! Every AI-generated snippet needs thorough review and testing. In practice, that means we treat AI-written code like any other code in our DevSecOps pipeline. Teams should continue to submit pull requests and conduct peer code reviews, even if an AI generates the code. We leverage all our QA controls – robust linting and static analysis (SAST) tools in CI, unit, and integration test suites – as a safety net to catch AI’s mistakes. It’s tempting to trust the AI’s confident output, but we must enforce quality gates. A mature DevSecOps pipeline remains essential: every commit (whether AI- or human-driven) triggers automated tests, and code is promoted only after passing all checks. This way, hallucinations or errors are caught early, long before any release.

Eugene: How can AI enabled platforms like Argus help us maintain software quality and compliance in a DevSecOps and HCD-focused environment?

Vinay: We need continuous test adaptation to keep up with AI’s rapid, iterative development style. AI can refactor or generate new code in seconds, so our testing approach has to be just as agile. This is where AI-enabled QA platforms like Argus come into play. A platform uses AI to generate test scripts automatically from plain English requirements or user stories. It eliminates much manual test scripting by allowing even non-programmers to create tests in natural language. More importantly, Argus features self-healing tests that adapt when the application’s UI or logic changes. For example, if an AI-generated update alters an element ID or workflow, the automation can intelligently adjust the test script on the fly. This kind of continuous adaptation means our tests won’t break every time the AI introduces a change – the test suite evolves with the codebase. By ensuring automation is resilient, we drastically reduce maintenance overhead and can keep pace with the high velocity of AI-driven releases. And because Argus integrates seamlessly with our CI/CD pipelines, we’re executing a broad battery of tests on each build (across functionality, API, UI, etc.), enabling continuous testing and early bug detection even as the code rapidly evolves. The result is we catch critical issues sooner and support faster, safer releases.

Critically for software, these AI-driven testing practices help us always maintain quality and compliance standards. Modern QA isn’t just about finding bugs – it’s about ensuring the software and its components (SBOM) meet all security and regulatory requirements from the start. We can embed compliance checks into our automated test suites. For instance, a cloud-based test automation solution can include computerized checks for security controls, privacy rules, and compliance with coding standards, so any AI-generated code is immediately vetted against federal requirements. If AI inadvertently introduces insecure code, our integrated security tests (such as vulnerability scanners and policy-as-code checks) will flag it early. The same goes for accessibility and other regulations: we have tools to automatically validate against Section 508 and WCAG accessibility guidelines, ensuring new features remain inclusive and legally compliant. In fact, by incorporating usability and accessibility testing into the CI/CD workflow (as part of our HCD approach), we uphold human-centered design principles throughout development. That means every iteration of the software is not only secure and functional, but also user-friendly and accessible – all continuously verified. This blend of DevSecOps and HCD ensures that security, usability, and compliance get equal priority early on, rather than being afterthoughts. It builds user trust and makes achieving things like Authority to Operate much smoother, since we’re generating real-time evidence of compliance with each release.

Eugene: Vinay, any guidance for the workforce on the future of AI in QA?

Vinay: Looking forward, I see AI changing the role of our engineers rather than replacing them. Generative coding tools handle grunt work, but the human experts stay in the driver’s seat. Our developers and testers are becoming more like quality governors and product stewards, guiding the AI, setting the right prompts, and then rigorously verifying the outputs against mission needs. As one industry expert noted, coding is “slowly becoming a QA and product definition heavy job,” where the developer’s goal is to understand patterns, master testing methods, and clearly articulate the business objectives for the code. That mindset is exactly what federal CIOs and engineering leaders are adopting. By pairing AI-powered development with AI augmented testing and DevSecOps discipline, we get the best of both worlds: high-velocity delivery and high-assurance software. In sum, prompt-based AI coding can be a game-changer for productivity, but only when we anchor it with strong QA practices, continuous test adaptation, and platforms like Argus to automatically uphold our quality and compliance standards at every step. This approach lets us innovate faster while still “shifting left” on security, quality, and user-centric design, which is ultimately what drives successful federal IT outcomes.

Continuous Innovation with Compliance and HCD in Mind

Eugene: Vinay, to wrap up, paint us a vision. How do you see product engineering and testing evolving so that agencies can continuously innovate while still meeting compliance mandates, mission assurance, and human-centered design goals?

Vinay: I see a future where these goals are not in conflict but in harmony. We’re moving toward a model where compliance is continuous and largely automated. Imagine real-time dashboarding of security and compliance posture for every app release, with AI flagging issues instantly. DevSecOps will make “compliance as code” the norm, so meeting regulations is just a natural outcome of the pipeline. That frees up teams to focus on mission functionality. For mission assurance, the key will be building robust feedback loops. In the future, every deployment will include telemetry and user feedback that feed directly into planning. This means products quickly adapt to any issues, ensuring reliability and performance for mission-critical systems. AI will help here too, predicting potential failure points or performance bottlenecks before they impact the mission.

On the innovation side, I envision fusion teams of developers, security, ops, and UX designers working together from the start (a true DevSecOps/DevSecDesignOps culture). They’ll use platforms like our Argus and Green Accelerator, so they’re not bogged down by manual tasks or siloed tools. With those mundane parts automated, the teams can spend more time on creative solutions and user-centered improvements. And HCD remains front and center: we’ll continue testing with real users, incorporate accessibility, and design for the human experience. DevSecOps complements this by encouraging iterative development and frequent user feedback – as we saw in agencies that emphasize a human-centered approach in their DevSecOps practices.

Ultimately, I think the vision is of software factories that continuously innovate engines – producing updates that are secure, compliant, and user-friendly by default. When security and compliance become built-in quality attributes rather than afterthoughts, you get faster innovation with greater trust. Federal programs can then deliver on their missions with agility and earn the public’s confidence. The technology (AI, automation, platforms) is enabling this, but it’s the cultural shift, embracing DevSecOps and human-centered thinking, that will truly make continuous innovation possible.

Eugene: Well said. It’s a future where speed, security, and empathy go hand in hand. This has been a thoughtful discussion – thank you, Vinay, for sharing your insights. I’m sure our readers gained a valuable perspective on leveraging AI and DevSecOps to meet the public sector’s unique needs.

The GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act), signed in July 2025, marks a turning point in digital asset regulation. It requires stablecoins to be fully backed, audited, and transparent—while setting expectations for consumer protections and financial surveillance.

For government cybersecurity programs, this law underscores a new dual mandate. Agencies may have to oversee crypto asset ecosystems—validating reserves, ensuring compliance, and protecting privacy. They may also have to strengthen their internal cryptographic infrastructure—maintaining lifecycle governance, enabling crypto-agility, and preparing for post-quantum security.

To unpack what this means in practice, Eugene Goldlust, Senior Account Executive, speaks with Vijay Narasimhan, CTO of ASSYST.

Eugene:

Vijay, thank you for meeting with me today to discuss an important topic as we head into the 2025 cybersecurity awareness month. As you know, the GENIUS Act sets tough expectations for stablecoin issuers. What do you foresee agencies will now have to do in terms of stablecoin oversight?

Vijay:

Agencies may have to acquire technical capabilities to verify reserve disclosures using cryptographic proofs—checking signatures, hashes, and timestamps for authenticity. They may also need to monitor blockchain transaction ecosystems for AML/KYC compliance, utilizing analytics tools linked to cryptographic audit trails.

Critically, agencies will have to enforce privacy controls. Financial surveillance is mandated, but privacy-preserving cryptography—like zero-knowledge proofs or selective disclosure credentials—will be key to protecting individuals. We are thinking of delivering these capabilities utilizing ASSYST’s ComplySyncATO and Athena Agentic AI to support potential future use cases across crypto oversight, blockchain applications, and quantum-aware infrastructure. ComplySyncATO is standards-ready, meaning you can feed it tomorrow’s security controls to evaluate today’s compliance.

Eugene:

That covers the external side. Internally, what may agencies have to do with their own cryptographic infrastructure?

Vijay:

Internally, agencies may have to:

• Maintain a cryptographic inventory across all systems. Many agencies began by implementing hardened, tamper-resistant devices such as Hardware Security Modules or HSMs, then shifted to cloud vaults—but these often fall short for blockchain and post quantum cryptography (PQC) needs. The next step is clear: extend crypto-agile architecture inventory and crypto governance to cover traditional IT, blockchain, and quantum-safe algorithms without gaps.

   

• Enforce lifecycle governance, ensuring invalidated, expired, or superannuated information assets or deprecated algorithms don’t undermine mission continuity.

   

• Enable crypto-agility so that systems can pivot from RSA/ECC to post-quantum algorithms like CRYSTALS-Kyber, CRYSTALS-Dilithium, or SPHINCS+ without major rework.

   

• Integrate cryptographic telemetry into SIEMs, turning crypto events—like cipher downgrades, expired certs, or points where asymmetric public keys are used—into actionable security signals.
   

Without these steps, internal systems won’t be resilient enough to meet the same level of rigor the GENIUS Act demands externally.

Eugene:

Quantum often gets treated as “tomorrow’s” issue. In this context, how should agencies prepare and what can they do right now to ensure future resiliency?

Vijay:

Agencies may have to act as if quantum is already here. Specifically:

• Identify quantum-vulnerable assets, especially those protecting long-lived financial records, citizen data, or audit logs. 
   
• Run hybrid deployments, combining classical and PQC algorithms to prepare for a staged transition.
   
• Upgrade PKIs in two phases: first, enable issuance of PQC-compatible certificates using the current NIST selections—CRYSTALS-Kyber or CRYSTALS-Dilithium—at least for mission-critical systems. Later, extend support to Falcon once NIST finalizes its standard, balancing performance on verification and key size.
   
• Test PQC workflows, evaluating performance impacts in real-world systems—like constrained IoT devices or high-volume transaction platforms.

The threat isn’t just future decryption—it’s the “harvest now, decrypt later” risk. Agencies may have to treat every encrypted record today as if an adversary is already saving it for tomorrow’s quantum computers.

Eugene Goldlust:

Vijay, post-quantum security isn’t only about technology. What should the folks who run cybersecurity programs do to prepare for these changes?

Vijay:
Crypto algorithms are evolving—and so must the workforce. Cybersecurity programs may have to adapt to these changes and prepare their people accordingly. That means:

• Redefining ISSO roles into crypto assurance officers, with responsibility for monitoring cryptographic telemetry, ensuring blockchain-based infrastructure compliance, and driving PQC readiness.
   
• Upskilling engineers to design crypto-agile systems, integrate PQC libraries, and validate blockchain applications that protect the resilience of agency services and the citizens they support.
   
• Equipping program managers to treat cryptographic milestones as formal deliverables tied to funding and reporting, rather than back-end technical chores. This elevates crypto governance to a programmatic requirement.
   
• Introducing new roles such as Quantum Readiness Officer, Cryptographic Risk Manager, and Privacy Engineering Specialist—positions that bridge technical expertise with compliance and mission assurance.

And let me emphasize—we welcome these new technologies and are standing ready to support agencies as they adapt to them.

Eugene:

So for Cybersecurity Awareness Month 2025, what’s the bottom line?

Vijay:

Cybersecurity Awareness Month is the right moment to acknowledge this shift and act. The path forward is clear: oversee external crypto responsibly, govern internal cryptography rigorously, and prepare for quantum today.

The message here is that crypto governance is mission governance. By adopting standards-ready tools like ComplySyncATO, maintaining crypto inventories, integrating telemetry, planning for PQC, and evolving the workforce, agencies will be prepared to meet the dual challenge of regulation and resilience.

The GENIUS Act is more than financial regulation—it’s a signal that governments must lead in cryptographic assurance. Agencies may have to act on both fronts: enforcing trust in external markets and protecting the cryptography inside their own systems.

Embedding security, automation, and compliance into the heart of federal application delivery

Background

The National Institute of Standards and Technology (NIST) Office of Information Systems Management (OISM) Application Systems Division (ASD) develops and maintains a wide portfolio of mission-critical information systems. The ASD plays a crucial role in ensuring NIST’s internal and external systems are kept operational, secure, and compliant—a responsibility that NIST team members and external stakeholders depend on to securely and consistently access essential tools and data. To strengthen ASD’s Application Lifecycle Management (ALM) and Software Configuration Management (SCM) capabilities, NIST launched an ambitious modernization initiative focused on DevSecOps transformation.

ASSYST partnered with NIST’s Infrastructure Services Division (ISD), IT Security & Networking (ITSND), and Platform Services (PSD) to deliver this transformation, leveraging decades of experience in federal secure cloud modernization. The initiative advanced software delivery capabilities while aligning directly with FISMA, FedRAMP, Executive Order 14028 on Zero Trust, and OMB M-21-31 logging and observability mandates, ensuring compliance with national cybersecurity priorities. By embedding security and automation into the development lifecycle, the effort created a standards-aligned model for federal DevSecOps modernization.

Challenge

NIST’s goal was to transition from legacy, manual processes to a modern DevSecOps framework—with continuous integration, continuous deployment, automated validation checks and vulnerability scans, and containerization—while operating within strict security protocols.

The challenge was not just modernization, but proving how security could be embedded across the entire software delivery lifecycle, in alignment with NIST’s own standards and evolving federal cybersecurity directives.

Solution

Based on our understanding of the challenges, it was clear that streamlining and automating the development and operations processes for faster software release cycles in a secure cloud environment were the key requirements. ASSYST’s proposed solution was flexible, reliable, scalable, and offered great computing power; it was easy to use and cost-effective. ASSYST’s approach included a solution stack comprising a combination of cloud services and open-source technologies that addressed all the above challenges. ASSYST designed, developed, and deployed a secure, automated DevSecOps pipeline in the NIST AWS environment:

• Infrastructure as Code (IaC): Provisioned AWS infrastructure with Terraform, ensuring consistency, reproducibility, and auditability.
• CI/CD Pipeline Automation: Configured GitLab pipelines for containerized and non-containerized applications, reducing deployment friction and error rates.
• Integrated Security & Compliance: Embedded Clair vulnerability scans into ECR repositories for continuous monitoring, ensuring compliance with Zero Trust principles.
• Third-Party Integration: Integrated GitLab and SonarQube into AWS EKS Fargate, establishing automated quality checks and feedback loops consistent with NIST secure coding guidance.

Features

• IaC for automated, version-controlled environments
• CI/CD pipelines for standardized, repeatable deployments
• Continuous vulnerability scanning on every image push and nightly cycle
• Built-in compliance alignment with EO 14028, OMB M-21-31, and NIST DevSecOps guidance

Outcomes

This modernization delivered lasting improvements to NIST’s application delivery and security environment:

• Accelerated Deployment Cycles: Application releases moved from weeks to hours, with greater reliability and repeatability through automation.
• Flexible and Easy to use/configure/implement: ASSYST’s approach provided secure, resizable compute capacity in the cloud. The proven cloud computing containerized environments provide complete flexibility and freedom in managing computing resources and costs, ensuring and extracting maximum computing power. It was very easy and less time-consuming (minutes) to obtain and boot new pods and cloud services, compared to an on-premises or server instance model.
• Repeatable: Having optimized the CI/CD process, the entire codebase, scripts, and instructions were tested at each environment before being promoted, and faults and errors were quickly spotted and remediated.
• Scalable (Auto-Scaling): The ability to quickly scale capacity, both up and down, depending on the load and volume, was seamless.
• Security: Encryption set in transit and at rest. In addition to TLS encryption, in-transit encryption was successfully completed using the Java Cryptography Extension (JCE) for each part before storing the sensitive files in the cloud storage. Access to the data was easily controlled and managed.
• Parallel Processing: The processing time of large data submissions was drastically reduced due to parallel processing.
• Storage: In a cloud environment, storage is offered in different classes, depending on how frequently the data is accessed (for example, EBS, S3, Glacier, etc.). The cost benefits compared to an on-premises model for storing huge data were relatively low by using this model. The cloud Storage service also meets regulatory compliance standards, including PCI-DSS, HIPAA/HITECH, FedRAMP, and FISMA.
• Strengthened Security Posture: Vulnerabilities were detected earlier in the development lifecycle, effectively shifting security left and reducing production risk.
• Continuous Compliance: Automated controls ensured ongoing alignment with Zero Trust principles, FedRAMP, EO 14028, OMB M-21-31, FISMA guidelines, and NIST DevSecOps guidance.
• Operational Efficiency: Manual, time-intensive processes were eliminated, enabling teams to focus on mission-driven innovation.
• Replicable Model for Agencies: The initiative established a standards-aligned DevSecOps framework that other federal organizations can adopt—demonstrating ASSYST’s ability to deliver secure, automated, and compliant modernization at scale.

In defense operations, the communications infrastructure must perform without hesitation. Whether enabling secure video, voice, or data exchange, the systems that support coordination, training, and real-time decision-making are foundational to mission success.

ASSYST continues to support U.S. Department of Defense (DoD) agencies in building modern, resilient communications environments aligned with operational tempo, cyber posture, and evolving multi-domain requirements.

VTC as a Core Operational Asset

Video Teleconferencing (VTC) has become essential to mission execution—not simply a productivity tool. For one DoD installation, ASSYST delivered a complete overhaul of a legacy VTC environment that had become unreliable during critical operations.

The upgraded infrastructure now supports secure, encrypted sessions daily, fully integrated with DoD Global Video Services (GVS), SIP/H.323 protocols, and Microsoft Teams. The system architecture incorporates accessibility, redundancy, and compliance with Section 508 and STIG standards, ensuring operational continuity at all classification levels.

Modernization Without Disruption

Legacy telecommunication systems often present operational risks, particularly when they rely on analog technologies. At a federal agency with thousands of voice endpoints, ASSYST led a full VoIP modernization effort while ensuring uninterrupted mission delivery.

This effort included comprehensive cabling audits, risk-informed migration planning, CAC authentication integration, and close coordination with cybersecurity and network teams to meet all RMF and Authority to Operate (ATO) requirements. The result was a seamless transition to secure, standards-aligned infrastructure capable of supporting future technologies and mission growth.

Built on Standards and Operational Discipline

All modernization efforts are grounded in federal and DoD standards. ASSYST solutions are designed to align with:

• DISA’s Unified Capabilities Approved Products List (APL)
   
• DoDIN and IPv6 transition requirements
   
• NIST SP 800-53 and SP 800-171 control baselines
   
• STIG compliance and documentation
   
• RMF-based lifecycle security frameworks
   

This standards-driven approach ensures that systems are operationally effective, cyber-resilient, and audit-ready—without introducing risk to continuity or collaboration.

C4ISR Depends on Infrastructure That Performs

C4ISR (Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance) environments rely on dependable communications platforms. As DoD programs move toward cloud, AI, and edge architectures, these systems require a secure foundation to enable interoperability, rapid decision-making, and information dominance.

ASSYST continues to support this evolution by deploying:

• Lightweight, mobile-ready VTC kits
   
• Automated diagnostics and monitoring
   
• Voice, video, and data systems optimized for disconnected, intermittent, and low-bandwidth scenarios
   
• Tools like ComplySyncATO to streamline ATO processes for telecom assets

These capabilities form the backbone of mission assurance in dynamic, data-driven environments.

Mission Confidence Begins with Communication Readiness

Communication infrastructure remains one of the most critical—and often underestimated—components of defense readiness. Every briefing, every call, every operational update relies on systems designed to meet the mission’s demand in real time.

ASSYST’s work across defense and national security programs reflects a sustained commitment to ensuring these systems are not only functional but dependable under pressure. The focus is not simply on technology, but on trust—ensuring that when a connection is needed, it works the first time, every time.

ASSYST has been honored with a prestigious award at the ACCELERATE 2025 Summit, hosted by GOVTECH CONNECTS, for our groundbreaking ComplySyncATO Solution Offering.

I accepted the award on behalf of all of us, but this recognition belongs to every member of #TeamASSYST.  ASSYST's expertise, innovation, and teamwork have made ComplySyncATO a trusted name in secure AI adoption and federal digital transformation. This win is also shining a spotlight on our Green Accelerator — the very innovation engine that’s powering solutions like ComplySyncATO. 

The Green Accelerator is quickly gaining attention across the federal tech community for how it: Integrates AI, Zero Trust, and security-by-design into mission-critical systems from day one. Accelerates compliance automation and enables agencies to stay ahead of evolving regulations. Transforms digital services by allowing rapid, standards-driven, and interoperable solutions that adapt as fast as challenges emerge. 

Together, we’re not just delivering technology — we’re reshaping how agencies innovate securely, making them more agile, resilient, and ready for the future.

Congratulations to all the winners! Let's work together to make government missions successful.

Joe Anderson, COO, ASSYST, Inc.

In my latest Qk Bits, I met Sneha Belur, a Technical Project Manager at ASSYST, who discusses her approach to modern project management, which she describes as blending agility, AI, and human-centric principles. She explains that the core challenge, whether working in retail or with federal agencies, is to build scalable solutions that people will actually use, without letting process get in the way of progress. Belur notes that AI tools have made planning more nuanced, as they can handle boilerplate tasks while human judgment remains essential for understanding security policies and team dynamics. She advises project managers to "learn fast, lead slow," emphasizing the importance of letting teams explore new technologies while maintaining a strategic perspective and questioning traditional "best practices."

Watch the full interview on LinkedIn