Sarah Waldner

Today marks Six months in as SOCPAC CTO, and it somehow feels like both yesterday and six years ago. When I stepped into this role, we were behind the curve. Legacy systems, siloed data, and slow processes held us back. In just half a year, we’ve laid a Foundational Technical Architecture that gave us a modern backbone for data, AI, and autonomy. Since then, we’ve: 1. Unified our digital foundation for secure, scalable operations 2. Embedded AI and LLMs into daily workflows to speed decisions 3. Deployed containerized AI agents across all networks 4. Integrated autonomy at the edge, moving toward true man–machine teaming 5. Shifted our culture from cautious adoption to championing innovation The result? We’re no longer catching up, we’re setting the pace. What once felt like a distant goal is now part of our daily reality. All of this happened in six months, which is why it feels so surreal. It took countless late nights, cross-functional sprints, and the relentless dedication of an amazing team. I'm humbled by the trust the organization placed in me to drive this transformation, and I'm grateful to every person who rolled up their sleeves to make it real. This was truly a team effort, from the junior analysts using our new AI tools to the senior leaders who empowered us to take bold risks. And we’re just getting started. The foundation is in place, but now we get to build on it. In the next chapter, we'll be refining and scaling these capabilities, drilling deeper into AI-enhanced decision-making, and pushing the envelope on autonomous operations. The technology will keep evolving, and so will we. Our goal remains the same: give our operators a decisive edge, making it an extension of the warfighter and keep innovating responsibly. I’m humbled by what the team accomplished in such a short time, and excited for what’s next. The foundation is in place. Now we build on it. Six months down, and the journey is just beginning.

170

19 Comments

After years of leading security through scaling challenges, I'm sharing the mental models that have worked really well for me! If you're a security leader, you've probably hit this wall: your team can't keep up with security review requests, compliance work is consuming everything, and the traditional playbook to hire more people isn't solving the problem. I've lived this at NASA, at startups that went through acquisitions, and now at GitLab helping secure one of the world's largest DevSecOps platforms. What I I have learned in all these years is that there's no one-size-fits-all security strategy. What works for a cloud-native startup fails spectacularly at an enterprise with decades of legacy systems. So I built something different => the Software Factory Security Framework (SF²) which is a strategic positioning model that helps security leaders figure out what's actually appropriate for their organization, not someone else's. The 60-second version:  - Two-axis model: assess your operational complexity + operational readiness  - Four strategic positions with different playbooks (not everyone needs "enterprise" security)  - Honest timelines (yes, some transformations really take 3-5 years)  - Works alongside frameworks you already use (NIST, OWASP, etc.)  - Focuses on sustainable scaling vs. endless manual work A few things I believe:  - Supply chain security became #1 priority when adversaries evolved to automated discovery at scale  - Context matters more than "best practices"  - Realistic timelines beat wishful thinking every time  - Security scales through strategic investment, not just headcount Why I'm sharing this openly: This is my personal work (not an official GitLab framework), but these mental models do inform how I approach security strategy at GitLab. I'm making it fully open source (CC BY 4.0) because I believe our industry gets stronger when we share strategic thinking, not just tactical checklists.  What I need from you:  - Read it and tell me what I got wrong  - Contribute real-world examples  - Share it with security leaders who might find it useful  - Challenge the frameworks where your experience differs This isn't finished, it's a living framework that gets better with community input. If you've scaled security at organizations from 10 to 10,000 engineers, you have perspective that can make this better. Check it out: 📖 Website: https://sf2framework.com 💻 GitLab Repo: https://lnkd.in/e56ijVTy Whether you agree or disagree with the approach, I'd love to hear from you. Security leadership is hard enough; we should help each other navigate it honestly.

652

38 Comments

Picking software with the Gartner Magic Quadrant? You’re doing it wrong. I authored an MQ, and 90% of people misunderstand the research. First off, the top right corner (leader) does not mean it's the "best solution on the market". The Gartner MQ doesn't say that, at ALL. Secondly, yes, I realize it coming off that way is Gartner's fault. But heck, the MQ **isn't even a product evaluation**. Soak that in for a sec, lol. it obviously doesn't tell you which product is best in market! The MQ ranks vendors, not individual products. and it ranks them on two axes: "vision" and "ability to execute" (which includes things like brand strength, financial health, marketing reach, and strategy). The point of it is to provide a snapshot of vendor performance. How well the VENDOR is doing in the market is secondary info for your purchase decision so you know the tool is safe and will get investment. Whether the tool is built to solve your use case should be your PRIMARY purchasing decision and the MQ doesn't help with that. The MQ is a good resource, but... not the key factor for deciding what tool to buy. 👉 What actually matters when you’re picking software: If you’re a Gartner subscriber, the real treasure is the Critical Capabilities report. The MQ’s sister report evaluates actual product capabilities, feature-by-feature and split into use cases, so you can rank vendors based on what matters to your needs. Once you do that, the narrative shifts. Some “Leaders” actually fall to the bottom for your needs. Some niche players rise to the top as the best-fit. so check out the vendor ranking in the CC doc! Your decision gets way clearer. (And so does your ROI, btw). ----- Bottom line: Magic Quadrant = shiny brand paint, confidence metrics, vendor positioning. It is not a product review. It's good for knowing the vendor strength over time (it's a great report, but it is also misunderstood) Critical Capabilities = your buyer's guide. This is the product review. it's real, actionable insight into what solves your problem. next time someone says “let’s just buy the MQ Leader,” tell them that's NOT EVEN WHAT GARTNER RECOMMENDS. (other tips, or questions? throw them in the comments)

184

38 Comments

A multi-billion dollar public enterprise just ripped out their previous Azure Document Intelligence, Textract, and a patchwork of open-source frameworks and moved their entire document pipeline to Pulse. They had spent years stitching those tools together. It worked for simple files, but broke down on the workloads that mattered: long reports, filings, and massive spreadsheets / presentations. Their data engineering teams were burning hundreds of hours fixing misaligned tables, broken charts, and missing data for downstream applications They gave Pulse a try. We just handed them an API key and told them to throw their hardest files at it. Week 1: operations tested side by side. Pulse finished in seconds where their old stack took minutes, with far fewer errors. Month 1: compliance pulled in thousands of filings and reported accuracy levels they had never seen before. Months 3–6: infosec and legal completed reviews and deployment began. The results showed millions in annual ROI from faster turnaround, reduced cleanup, and teams able to focus on higher value work. Instead of battling errors, their team now trusts the outputs and moves faster. Enterprises do not switch core infrastructure often. But when the pain is universal and the alternative finally works, the choice becomes obvious.

43

4 Comments

Our first server crashed twice a week. Now we have 99.999% uptime. Eight years ago, we were a handful of folks with free AWS credits, praying it wouldn't go down during demos. Spoiler alert: It did. Constantly. Today, we serve thousands of users across six continents with infrastructure that just works. The difference? We learned that reliability isn't a feature; it's the foundation everything else is built on. Every crash taught us something. Every outage made us stronger. Every frustrated customer email forced us to get better. The companies that survive aren't the ones that never fail. They're the ones that fail fast, learn faster, and build systems that prevent the same failure twice. What's the most important lesson a system failure taught your business?

43

2 Comments

The EnFi, Inc team just launched another major customer! I’m still amazed seeing in action what production-level Agentic Architecture unlocks for both customers and platforms. What it means in practice: No more months of ETL. Connect, understand, act, day one. Immediate value: Immediate ~30%+ time and efficiency compression through automation across the process. Step-function jump: Application processing from 1–2 days ➜ ~7–10 minutes. In software terms, that’s wild. Flexes to new use cases. We’re no longer stuck in the rinse-and-repeat of onboarding ➜ product ➜ engineering to ship value. Feedback is built-in. Agents and users surface issues in flow; improvements feed straight into the pipeline. Fixes in days or weeks, not months or release cycles. That’s PLG, the way it should be. Super excited for what’s next, and incredibly grateful to our earliest customers for seeing (and shaping) what’s possible. We are live, this is real, and we are scaling a digital workforce for credit. And it makes me realize, Agentic is the new paradigm for software and product led growth. #AI #Agentic #Fintech #Lending #PLG #Automation #TimeToValue

76

3 Comments