“Small wins accumulate to one massive win. You look back down the mountain and realize you made it to the peak.” 

Who They Brought In 

At the time of this recording, Garrett Ragland-Helf was serving as a CISO Advisory Analyst at Apollo Information Systems, working primarily with public sector organizations across state, local, and education sectors to mature their security postures, build roadmaps, and navigate the unique resource constraints that come with operating in environments where budgets are thin and staff wear many hats. He also volunteers with the Center for Internet Security’s Leadership Mentor Program, connecting cybersecurity leaders across the northeast to collaborate, share challenges, and help each other grow. He serves in the military at the Army War College at Carlisle Barracks, which gives him a front row seat to how national security thinking is evolving alongside the civilian cybersecurity landscape. His approach throughout this episode is less about tools and more about the discipline, mindset, and foundational work that makes any tool actually useful. 

What Got Loud 

• Why tackling a 1,200-page CIS benchmark is exactly like climbing Mount Everest, and why the only way to do it without breaking everything is to go modular, one small section at a time 
• The most dangerous thing you can do with a SIEM is deploy it out of the box with zero tuning, zero baseline, and nobody who knows how to read it 
• AI is a force multiplier for resource-constrained public sector organizations, but only if you stay within governance guardrails and treat it as a starting point, not a finished product 
• If your foundation is made of sand, any shift in the threat landscape will bring the whole castle down. The basics have to be strong before the fancy tools mean anything 
• Collaboration is the actual force multiplier. Siloed organizations in the same sector are making themselves collectively easier to attack  

The Rundown 

Garrett’s Mount Everest framework is the throughline for the entire episode. When you look at a 1,200-page CIS benchmark or a full CMMC implementation and try to do it all at once, the size of the task creates paralysis. His answer is the same answer that applies to every large security initiative: break it into modular chunks, start with a small subset of controls, get comfortable with those, and then move to the next section. The small wins accumulate. The progress compounds. And when you look back after a year of doing it that way, the distance covered is significant in a way that a sprint never produces. Melissa’s experience confirmed it directly. She tried to implement the Windows Server 2022 CIS benchmark in a couple of days and had to roll everything back. The mountain does not care how fast you want to climb it. 

The foundation conversation is where Garrett gets most direct. He is not against advanced tools. He is against organizations acquiring advanced tools before they have the basics locked down. A next-generation SIEM deployed out of the box with no tuning, no baseline, and no one who knows how to operate it is not a security asset. It is noise. Or silence. Neither helps. Garrett’s framework is to start with what you have, squeeze every bit of value out of it, make sure it is fine-tuned to your environment, and only then add the next layer. That sequencing, basics first, tools second, is what separates organizations that survive incidents from the ones that do not. 

The public sector resource problem runs through the entire episode. These organizations are not failing because they do not care. They are failing because they are understaffed, underfunded, and often operating with IT people who have cybersecurity added to a job description that already had no room for it. Garrett’s answer is sweat equity: use every free or state-subsidized resource available, use AI to generate documentation starting points and then finish them properly, use community and peer networks to share knowledge and compress learning curves. The creativity required to do security well with almost nothing is its own skill set, and Garrett treats it as such rather than dismissing it. 

The collaboration section lands the hardest at the end of the episode. If one organization in a sector gets compromised, the attacker is now knocking on the doors of every similar organization nearby. Siloed security in interconnected sectors is not just a local problem. It is a collective vulnerability. Garrett’s answer is community: ISACs, peer groups, word of mouth, conferences, virtual or otherwise. The organizations that share knowledge and learn from each other’s incidents are harder to attack collectively than the ones that treat security as something they figure out alone.   

Real Talk 

If you are waiting until you have the perfect stack before you start securing your environment, you are already behind. Start where you are with what you have. Tune it. Baseline it. Understand it. Then add the next piece. 

If your Microsoft 365 environment hasn’t been reviewed lately, let’s fix that before someone else does it for you. Visit www.SOCSoter.com