5 Questions for Gregg Garrett on Modern Cybersecurity 

Evolver Chief Operating Officer and Chief Innovation Officer Gregg Garrett has spent his career advancing cybersecurity and technology innovation across government and commercial sectors. A retired U.S. Air Force officer with more than 20 years of service, Gregg has held senior cybersecurity leadership positions across the government contracting industry. He also serves on the advisory board of George Mason University’s Cybersecurity Resilience Center. 

In this Q&A, Gregg draws on his decades of experience to examine five pressing challenges in modern cybersecurity, from post-quantum threats and agentic AI to the evolving role of security analysts and new approaches to cybersecurity compliance. 

I think the first place most organizations need to start with is education and awareness — really understanding the nature of the attacks and also understanding that, in the world of post-quantum cryptography, we’re seeing attacks today with the plan to harvest it now and decrypt it later. 

And so that presents sort of a different spin on the equation because a lot of people think, “Hey, if we don’t have advanced quantum computers today, it’s not really a threat today.” But as nation-states adopt this harvest now, decrypt later philosophy, that becomes a concern both today and tomorrow. 

So what most organizations are trying to do is first understand the advanced cybersecurity threats that quantum computers pose. Then, they’re trying to understand and assess their current level of encryption, where they have data that’s unencrypted or encrypted at a lower level of security, and where they need to make advancements or enhancements in their overall lifecycle encryption management. 

Those are the kinds of actions that we see most government agencies and many Fortune 500 companies taking today. And I honestly think most of them aren’t very far down that path. I think there’s a need for some real concern in that area. 

The simple answer is agentic AI. 

The advancements in artificial intelligence, going from relatively early AI and machine learning capabilities to generative AI, then evolving over the last couple of years into agent-based capabilities, and now into agentic AI, have created an exponential challenge for cybersecurity defenders. 

Because the reality is that now you go from things taking days or hours to plan and implement an attack to literally minutes and seconds. And the level of agentic AI capabilities allows people who are less well-funded and less sophisticated to conduct more sophisticated and more robust cyberattacks using AI-powered tools. 

It places cyber defenders at a real disadvantage because you’re trying to protect everything, while cyberattackers are only looking for the most vulnerable aspects of your network, your software, or your supply chain. And when they have the power of agentic AI to implement attacks in seconds, it makes it extremely hard for defenders to detect and respond at the same speed. 

It almost gets to a point where cyber defenders have to implement agentic AI-based tools for their detection, response, and remediation so they can respond at the same level of speed and, hopefully, accuracy that we’re now seeing on an attack basis. It’s really AI fighting AI because humans just can’t operate at that rate of speed. 
 

Through our Evolver Innovation Center, we’ve focused on identifying leading commercial technologies to help cyber defenders in government agencies and Fortune 500 companies enhance their capabilities against adversarial AI. 

And we want to do it in a way that there’s still appropriate human controls and ethical guardrails for the AI to operate within, but also to enhance the time to response and the ability to remediate quickly. We’re also very mindful of the ability to reduce operations and maintenance costs associated with Security Operations Centers. 

One of those technologies is our SPECTRA solution, which combines our SOC professional services with self-learning AI from MixMode to reduce noise and false alarms and help analysts rapidly prioritize threats. Likewise, our SOAR solution, developed in partnership with Swimlane, leverages agentic AI to orchestrate cybersecurity tools and automate incident response through more than 2,000 playbooks. Together, these capabilities help analysts detect threats, prioritize attacks, and respond much faster. 

So being able to deploy those two tools in concert with one another, leveraging artificial intelligence, really takes AI detection and response to a whole other level of operation. It also reduces the cost of operations and maintenance for our government customers and Fortune 500 customers. 
 

I think it’s helpful to look at the bigger picture. On any given day of the week, we have hundreds of thousands of open cybersecurity positions in the United States that we literally can’t fill because we don’t have enough qualified people to do it. 
 
When I’ve talked to SOC analysts, which I do fairly regularly, they’re always delighted to have technology that integrates, orchestrates, and automates, that makes their jobs better, faster, and easier. 

What they don’t like is another tool that’s not properly integrated, that they haven’t received adequate training on, and that requires them to go across multiple systems. Those are sort of non-value-added tools. 

Having technology that saves time and effort and requires fewer people to operate doesn’t necessarily eliminate jobs. It allows you to do that work more efficiently with smaller staff. I like to take it away from the negative sort of spin that some people put on it and look at the positive. AI allows us to do more with the resources that we have.  

And that’s what we want. We want humans in the center, doing the critical analysis, focused on the zero-days and the really tough-to-fix problems, and allowing automation and artificial intelligence to deal with all of the noise and the known exposures and vulnerabilities. 
 

Well, I’d like to say that I’ve seen all government agencies move to a highly automated, risk-based vulnerability management software platform, but that wouldn’t be accurate. 

A lot of them are still operating largely manually or with semi-automated processes and tools. And that’s very challenging. It’s time-consuming, and it’s difficult to prioritize all the different risks and vulnerabilities coming in from so many different tools because a lot of them, candidly, haven’t invested appropriately in security orchestration and automated response capabilities. 

And so it’s still a pretty manual, time-intensive, labor-intensive process of prioritization, developing Plans of Action and Milestones, or POA&Ms, trying to track them, and then pulling together all the evidence-based documentation and conducting the appropriate testing to support Authorizations to Operate, or ATOs. It continues to be an ongoing challenge for government agencies and many Fortune 500 companies. 

Now, the good news is that there are some really, truly powerful tools that have been developed. And we’re fortunate to partner with one of those companies, Nucleus Security, and we’ve developed an Evolver integrated technology solution called GUARDIAN. We’re extremely proud of this partnership because Nucleus Security has developed what I consider to be the most robust risk-based vulnerability management software tool. 

It’s a tremendous tool that can save countless hours of time, engineering costs, and testing costs, as well as help with prioritization, the development of POA&Ms, and the documentation for the ATO process. 

I’m hopeful that more government agencies are going to adopt more automation and artificial intelligence to help facilitate that process.