Marty Whitfield

Senior Advisor, Cybersecurity & Risk

Let's Connect

“The best technology strategy converts investment into outcomes as the threat landscape changes.”

Marty Responds to Key Questions

You've led security programs at DARPA, the FBI, and the Pentagon. What does that experience give organizations outside of government?

When you’ve seen how nation-state actors operate, how organized crime syndicates structure attacks, and how insider threats actually manifest — not in theory, but in real incidents — you develop an instinct for what actually matters versus what just looks like security. Most security teams are defending against threats they’ve only read about. I’ve responded to them in classified environments where failure wasn’t an option. When I work with organizations now, the first conversation is always about what matters most to the business and what’s at stake if it’s compromised.

You hold the Lead CMMC Certified Assessor credential. What's the most common mistake you see organizations make when preparing for CMMC?

The most common mistake is treating CMMC as a documentation project instead of a security program. Organizations spend months writing policies, building System Security Plans, and assembling evidence binders and very little time actually fixing the underlying controls. They’re preparing for an audit instead of building a defensible environment. Assessors see through that quickly.

AI security and governance is on every executive's radar. Where do you see organizations getting it wrong?

The biggest mistake is governing AI like it’s just another IT project.  Most organizations bolt AI governance onto existing IT risk frameworks and call it done. But AI introduces failure modes that traditional IT governance wasn’t designed to catch — model drift, training data poisoning, hallucinated outputs driving real decisions, and shadow AI deployments that procurement and security never approved. A standard change management process doesn’t account for any of that.

Supply chain and third-party risk keep showing up on executive risk registers. Why is it so hard to get right?

Many organizations struggle because they manage vendors with spreadsheets and good intentions. They send a security questionnaire during onboarding, file the response, and never revisit it. Meanwhile the vendor’s environment changes and the controls they attested to may no longer exist.

At WMATA, I reduced third-party vendor risk by 40% through structured assessments and governance. The approach was straightforward: establish clear requirements, verify compliance, and build a review cadence that catches drift before it becomes exposure.

The difference between managing risk and documenting it comes down to whether anyone follows up after the signature.
Meet More Team Members