Navigating the DOGE Landscape

00:04 Welcome to another episode of SYNAC Unplugged. I'm Blake Thompson Hoyer, head of communications at SYNAC, and I'm joined today by Dina Saleh, federal solutions architect who's, really been on the front lines navigating some of these civilian and military agency Doge challenges. And for those who, maybe have been living under a rock in recent weeks, DOGE stands for the Department of Government Efficiency. Dina, how has Doge impacted some of the work you're doing with federal clients? Yeah. No. I I I think that's a great question. I think, you know,

00:34 the way that I like to think of it is Doge has kind of thrown a wrench into everything. So, for example, I've been working with customers for a while now, and I've been building that traction and, you know, which has been a few months, and we're slowly building up to a potential timeline and, poof, they're just gone. Right? It's not even them. Their entire teams and projects have just been, you know, evaporated overnight. And, yeah, from our perspective, these were folks who were true mission drivers. They were, you know, leading the charge and trying to bring in change, within their organization.

01:05 And so similar to them, we've also had to adapt and navigate this kind of unknown right, right alongside them. And so I always tell my customers, like, I know everything's super chaotic right now. I know you're still trying to hit, you know, your cyber objectives. And even if you're working with a super, you know, slim budget and you're down to, like, three people, how can we help you? How can we support you without adding any more overhead? And I think that mess message now is really resonating with with folks because it's not fluff. It's not just something kind to say,

01:35 but it's real genuine support, especially right now at a time where teams are shrinking and expectations shouldn't be. Right. Well, efficiency in and of itself is obviously a a laudable goal. We all wanna take the fastest route to get to point a to point b and whatnot. But what are some of the security risks that can potentially be introduced or around when efficiency becomes one of the top priorities? Yeah. No. As a former pen tester, I go into, like, red flag mode. And and look, I'm all for cutting waste and streamlining operations. But when you apply that logic to mission critical systems and, you know,

02:06 you're treating your red teams like a checkbox or telling people to streamline testing, what you're really doing is you're opening yourself up to blind spots. And that's because you're losing that nuance. You know? You're gonna miss vulnerabilities. You're gonna make snap decisions. And, yeah, it's gonna look great on a dashboard, but, ultimately, you're leaving yourself open and susceptible to risk. And so I've seen folks, you know, who've just been told recently to pause pen test, to merge their red teams and blue teams together. I even heard and and this, you know, makes me shake in my boots. It's like, hey. Just use a scanner and call it a day.

02:36 And, honestly, cutting corners like that is just an open invitation to attackers. And the way I say it is you cannot automate away risk. It's it's simply just not that simple. You need real world exploitation. You need folks who know how to break things the exact same way the attackers do. And so what I've been doing is I've been trying to help teams figure out, you know, how they can still get that level of coverage even if their staff's been cut and they're kinda flying blind. And I think the biggest takeaway is if you're not, you know, bringing in that human insight into the mix, as much as I hate to say it,

03:06 it's almost as if you're just moving in the wrong direction. Just to push back on that a little if I may, though. I mean, you mentioned AI. Automation's getting a lot better. Right? AI tools are getting really powerful at some of this. Where does AI fit into this discussion? That that is a huge question. I mean, look. Everyone and their grandmas are talking about AI. AI being within to, you know, every policy and every mandate. You know, it's what right now, what's kind of, you know, causing an issue are people learning how to kinda navigate around that. And I'll I'll bring a story I just had recently. A, a a red team lead just recently asked me.

03:36 It's like, hey, man. I don't see how AI is gonna be helping my team. I don't want them to replace my team. And I was like, look. AI is not meant to replace any team. It's meant to give your team time back. Meaning, let AI kind of deal with the boring repetitive stuff so your team can focus on really matters. Again, if you're working with the red team, they wanna go ahead and break things and actually do the fun aspect of it. Let automation go in and handle things at scale. And the way that SYNNEC is able to do that is, yeah, we handle automation at scale, but we still have, you know,

04:06 human researchers who are still really pushing your security stack to the limit. And that way, again, your bread team can focus on what they really wanna do, and that's where AI belongs, right, to make sure that we're not that we're not replacing a team, but that we're supporting the teams. Have you seen any success stories from the federal space even amid all the Doge related upheaval? Yeah. Absolutely. And and, again, there's a lot of success stories coming out of this kind of unweary time. For example, I had a customer that I work with, and they were just stellar. They they they had an entire red team who just were just phenomenal.

04:38 But, unfortunately, the Doge cuts kinda came in and and took most of those those team members away. And to their credit, they didn't just give up and kinda put their hands up in the air and be like, I don't know what to do. They reached out to us. And because we were kind of still, you know, kind of communicating and chatting with them before, we were able to kinda move very fast. They they told us straight up what they wanted. They wanted coverage. They wanted visibility, and they wanted confidence because, you know, they didn't want anything to fall through the cracks, and they still want to make sure that they're complying with old and and upcoming mandates. And so here at Synack, we were able to come in guns blazing.

05:09 We jump in. You know? We got our our our boots on the ground, and we gave them automation at scale. We gave them human led validation, and we did it all in a very quick turnaround. And even when the testing started, it was it was seamless. Right? Because it's fixed price, we're fed at moderate. It's a low lift. They didn't need, you know, to fight, tooth and nail for any extra budget or approvals. And so within weeks, you know, I had my champion going into a leadership meeting with actual data that they can show them. And it was it was beautiful to see that because, you know, we took what should have been a a fire drill moment, so to say,

05:42 and we turned it into a successful solid plan. And, you know, as a as a solutions architect, that's that's what I live for. Well, is there anything else that you wanted to add on this topic as long as I've got you on the line here, Dina? Absolutely. I just wanna say as, you know, a closing statement is like, look. Like, I get it. Everyone sees it. It's chaotic out there. Doge is definitely shaking up organizations and kind of rearranging things. And, yes, AI is out there. We're still dealing with legacy systems that we all hate, and that are just somehow still powering, you know, mission critical processes.

06:12 But just remember that with all this change, the goals remain the same. We have to secure the systems. We have to protect the mission, and we have to ensure that we're staying ahead of attackers. And that's what's the next year to do.