"This Is Fine" with Hunter Strategy

Summary:In this episode, Kevin Long, Jeff Segal, and Kevin Belanga explore the nuances of federal procurement challenges, including code challenges, oral assessments, and alternative procurement methods. They discuss how these approaches impact vendor evaluation, government decision-making, and the importance of aligning evaluation methods with project scope and complexity.Key Topics:Differences between in-room and take-home code challengesThe value and limitations of oral assessmentsThe role of external evaluators and source selection boardsBalancing cost, complexity, and procurement methodsThe importance of aligning evaluation methods with project scopeChallenges of evaluating technical competence remotelyInnovative approaches to vendor vetting, including pair programmingThe impact of procurement methods on small and large businessesEpisode Chapters:00:00 Introduction to Federal Procurement Challenges02:01 Different Types of Code Challenges in RFPs03:55 Evaluating Technical Competence Remotely05:53 The Role of External Evaluators and Source Boards07:56 Balancing Cost and Complexity in Procurement09:48 Innovative Vetting Methods: Pair Programming11:47 The Value of Oral Assessments13:57 The Theater of In-Person and Virtual Challenges16:01 Challenges for Small Businesses in Procurement18:14 Alternative Approaches to Traditional RFPs19:58 Simplifying Vendor Vetting with Pair Programming22:06 The Cost and Time of Code Challenges24:00 The Utility of Oral Presentations26:11 Media and Video in Vendor Evaluation28:13 Guarding Against Bait and Switch30:09 The Future of Federal Procurement Strategies

Matt Triner talks with PMO leaders Monique Williams and Tom Arnold about what separates a project management office that actually helps from one that's just overhead in government IT. They dig into the gap between mission goals and what the systems can really do, how to deal with tech debt, and what happens when siloed stakeholders keep stalling delivery. Later in the episode they get into agility, earning buy-in, and building trust on hybrid teams. Worth a listen if you're standing up a new PMO or trying to fix the one you've got.Episode Chapters:00:00 The Role of PMOs in IT Initiatives01:14 Critical Competencies of Effective PMOs06:09 Understanding Technical Aspects in PMOs10:45 Balancing Stakeholder Needs and Project Goals16:20 Measuring PMO Effectiveness20:58 Evaluating Good vs. Bad PMOs23:45 Agility in Project Management28:11 Engagement in a Hybrid Workforce34:38 Trends in PMO Operations41:06 Key Recommendations for Establishing a PMO

Cloud and code don't sit in separate lanes anymore, and neither do their vulnerabilities. Dan Beller (Director of Cloud Solutions) and Greg Vanore (Director of Software Development) join This Is Fine to dig into what secure software development actually demands once the checklist runs out. They cover the widening blast radius of cloud misconfigurations, the quiet risk of open source dependencies that lose their maintainers, and why "shift left" stays a slogan until contracts actually fund it. A detour through JavaScript's messy history makes the case that unchecked abstraction is its own security problem, tooling included. They also dig into why government agile adoption keeps colliding with government security posture, and what the NIST SSDF gets right about treating security as a mindset rather than a gate. It's a candid, occasionally cursed (RIP JScript) conversation about building software that survives contact with reality.Episode Chapters: 00:00 Introduction and Podcast Production00:44 Exploring Secure Software Development01:43 The Changing Threat Landscape03:05 Impact of Open Source Software04:55 Infrastructure Security and Open Frameworks05:57 Balancing Tooling and Understanding06:53 The Evolution and Challenges of JavaScript10:22 The Stabilization of UI Frameworks12:18 Challenges in Government Cloud Environments15:01 Agility and Security in Government16:40 Reconciling Agile Processes with Security22:35 Embedding Security in the Development Process24:55 The Scope of Secure Software Development

Everyone claims their testing tool does AI now, and Jay Newlin (Director of Quality Assurance) has the flooded inbox to prove it. He and Greg Vanore (Director of Software Engineering) join host Matt Triner to talk about cutting through that noise, why customers still don't believe automation is worth paying for, and the readable, declarative test frameworks that actually change their minds. Then things get personal with the two worst legacy code handoff stories you'll hear this year, one on burned CDs, one on three-ring binders of printed source code, and what disciplined test automation looks like when you inherit either one.Episode Chapters:00:00 Introduction00:07 Automated Quality Assurance Testing in Software Development01:22 Challenges in Assessing Tools for Automation Testing02:42 The Importance of Automation in Testing03:50 Educating Customers on the Value of Automation Testing04:41 Expanding Testing Techniques Beyond Traditional Methods05:48 Customer Perception of Automated Testing07:09 The Future of Automated Testing15:57 Balancing Rapid Deployment and Quality16:58 The Importance of Unit Test Coverage17:56 Maintaining Test Automation During Rapid Deployment20:41 The Role of Tooling in Government Environments22:56 Deliverables and Documentation in Government Contracts25:12 Testing Legacy Systems27:56 Considerations for Legacy Systems in Test Automation34:43 The Future State of Automated Testing

Ask 5 people to define threat intelligence and you'll get 5 different answers, and that's exactly where this episode starts. Will Elchert (Senior CTI Analyst, Hunter Strategy) and Jake Williams (VP of R&D, Hunter Strategy) join host Matt Triner alongside two clients living this from the buyer's side: Keith McCartney, SVP of Security and IT at DNA Nexus, and Billy Martin, CTSO at Vigor. Together, they break down what separates a threat intel program that actually drives decisions from one that's just, as Jake puts it, "cyber story time with the CTI team." The conversation covers where AI genuinely helps in CTI workflows and where it falls flat, how red and blue teams each get value out of the same intelligence, and what metrics actually prove a security program's worth to leadership.Episode Chapters: 00:00 Introduction to Cyber Threat Intelligence02:51 Defining Threat Intelligence05:41 Stakeholder Engagement in Cybersecurity08:34 Risk Management and Cyber Threat Intelligence11:36 Industry-Specific Approaches to Threat Intelligence14:25 The Importance of Context in Threat Intelligence17:07 Integrating Cybersecurity Functions19:51 Actionability of Threat Intelligence25:24 The Evolution of Cyber Threat Intelligence28:58 AI's Role in Cybersecurity32:19 Data Analysis and AI Integration37:14 Challenges and Opportunities with AI41:27 Human Element in Cyber Threat Intelligence49:57 Red Team vs Blue Team Dynamics52:28 Red Team vs Blue Team: Who Leverages CTI Better?55:02 Funding and Capability Development in Cybersecurity58:11 The Importance of Communication and Collaboration01:01:14 Metrics for Measuring Threat Intelligence Effectiveness01:09:45 Building a Cybersecurity Program from Scratch