Leaders from the Department of War (DoW), civilian agencies, and the intelligence community came together at the Federal Cybersecurity Executive Summit, hosted by Optiv + ClearShark. Following the summit, Government Technology Insider had the opportunity to speak with Bart Larango, Strategic Industry Advisor, Federal at Splunk to discuss what the conversations revealed about the path forward. Three themes emerged: a shift from volume-based compliance to decision-quality security outcomes, AI’s role in managing data velocity, and how agencies can modernize without disrupting the legacy systems they still depend on.
From Volume to Decision Quality
With so much data and so many places to store data, federal agencies often don’t have a clear picture of what data they have, where it lives, or how it’s being protected. “Agencies breaking through the data problem all share one defining characteristic,” Larango explained. “They’ve made a deliberate decision about what data serves a decision and built their architectures around that intent.”
Agencies still working through this challenge inherited an approach from the previous federal logging mandate, M-21-31, that rewarded volume over utility. This approach consumed significant resources without delivering the detection and response outcomes agencies needed.
The recently announced OMB mandate M-26-14 represents a deliberate policy correction. It moves the focus to decision-quality outcomes, such as continuous event monitoring, threat hunting, investigation, response, and forensics, rather than measuring compliance by the amount of data retained.
A crucial tension emerges here. While the OMB mandate applies primarily to federal civilian agencies, DoW and intelligence community requirements reflect and reinforce the same crucial tension: the data that makes compliance functional isn’t the same data that makes operators effective. Normalized, schema-aligned data is required for compliance. But analysts running threat hunts need original high-fidelity telemetry. Successful agencies resolve this by using architecture that satisfies both.
Where AI Delivers Value
When federal leaders talk about “real-time visibility” and “machine-speed operations,” they are referring to the ability to process data faster than manual methods allow. AI’s value lies in triage and initial investigation, enabling the sorting of thousands of alerts more quickly than human capabilities.
Each federal community has unique challenges. For instance, the intelligence community cannot waste bandwidth on triage; civilian agencies struggle with workforce scarcity, and the military needs defenders inside the adversary’s decision cycle. While the challenges are unique, the answer is the same: AI manages volume and velocity so that human judgement still remains for decisions that genuinely require it.
Modernizing Without Disruptions
In federal agency environments, modernizing while simultaneously keeping legacy systems operating comes at a cost. Because agencies work within acquisition frameworks and Authorization to Operate (ATO) processes that limit agility, DoW program managers are unable to provision tools in a matter of weeks. The approach that works is “data first, architecture parallel” that deploys telemetry collection against legacy systems in ways that don’t require changes or introduce new attack surfaces.
This telemetry layer becomes the connective tissue between the current and future state architecture. Instead of being disruptive, modernization becomes evolution, and risk decreases.
The Clock Starts Now
What stood out most to Larango from the summit was “the quality of operational specificity in the room.” The participants weren’t just observers, but the people responsible for outcomes. For DoW programs and civilian agencies managing tight budget cycles, M-26-14, along with Zero Trust, post-quantum cryptography, and AI mandates, has started implementation mandates that require architecture decisions now.
These implementation windows require a unique combination: platform capacity with the authorization posture and classified coverage to operate where the mission lives, combined with advisory and implementation depth that understands how federal programs actually move, and the human relationships between program offices and the authorization officials that determine whether architecture is deployed or remains on the whiteboard.
“The Federal Cybersecurity Executive Summit mattered because the federal cybersecurity environment right now is uniquely demanding,” Larango reflected. “The agencies that navigate that [the current environment] successfully will be the ones that invest in a data platform that works across old and new environments, deploys AI with human oversight built in, and that have the right implementation partner to bridge strategy and execution.”