ISACA Podcast

There are genuine and useful insights buried in here - the FedRAMP 20X catch-22 for startups, the specific cost reduction, and the binary API vs. full data-flow distinction are non-obvious - but they are substantially diluted by repetitive analogies (Instagram, the car, the sweatshirt), meandering soapboxing, and re-stating the same 'compliance is broken' thesis multiple times.

“FedRAMP traditionally was an outlay of between two and five million... FedRAMP20X will not cost you $5 million. it will cost you an auditor fee, which is probably between $100,000 to $200,000”

“instead of actually asking the question and giving you an answer green or red I going to bring all the data in And in doing that I going to show complete variance”

'Compliance is broken' is an extremely well-worn take in the GRC space, and the guest is largely explaining Pete Waterman's existing framework rather than generating novel thinking himself; the binary vs. data-flow API framing is the freshest idea here, but even that is a product distinction as much as an intellectual one.

“compliance is an engineering problem”

“I don't need an ISO or a SOC 2 or even a FedRAM control set. I just need to say, here's all my data. Tell me if you're comfortable”

Jake Bernardes is a real practitioner who went through the FedRAMP 20X pilot first-hand, which gives him legitimate standing; however, he is the CISO of the episode's sponsor (Anecdotes), creating an unacknowledged conflict of interest that makes much of his commentary function as vendor marketing rather than independent expertise.

“we entered the moderate pilot... we engaged in January and submitted for FedRAM compliance, initially at low and now working towards moderate. And we did that within about a six-week period prior to audit. The audit period was about three weeks”

“There's AniDose, Drada, Levanta, Hyperproof, you could name a ton of them, right?”

The episode delivers meaningful concrete data - specific cost ranges, timelines from the guest's own pilot, named vendors with specific pricing implications - which is above average; it falls short of a high score because several claims remain hand-wavy and the first-hand evidence conveniently doubles as product promotion.

“FedRAMP traditionally was an outlay of between two and five million... it will cost you an auditor fee, which is probably between $100,000 to $200,000”

“Snowflake will double your price for FedRAMP. Wiz will double your price for FedRAMP”

The host asks nothing but open-ended softballs with zero follow-up, never challenges the guest's obvious conflict of interest as sponsor-CISO, and essentially functions as a teleprompter for a prepared monologue; there is no probing, no pushback, and no productive tension anywhere in the conversation.

“Can you elaborate a little bit on that?”

“This sounds like a great buzzword, but what are they actually measuring?”