Software Engineering Institute (SEI) Webcast Series

Many organizations are discovering, as they accelerate adoption of artificial intelligence (AI), that business and operational success with AI depends on far more than deploying AI models or experimenting with generative AI tools. Successful AI adoption occurs at the intersection of software engineering practices, the realities of system and enterprise architecture modernization, governance, cyber...

AI is rapidly changing how software is produced but not the need to engineer software to meet business and mission goals. AI is enabling developers to move from idea to implementation at incredible speeds. However, this fast pace has implications that teams must manage. Product quality does not come for free, and there is some tendency for AI to accelerate the accumulation of technical debt. In ad...

Metrics are about more than just compliance. They ground you in fact, enable informed decision making, and help your team understand performance while providing insight into program health. By understanding the why, what, and how behind metrics, your team can move from "just collecting data" to using metrics that enable better decision making, improve program outcomes, and deliver mission value. G...

Artificial intelligence (AI) systems offer tremendous potential, but compared to traditional software, they introduce novel safety and security risks. System theory provides a powerful lens for understanding these risks and developing effective mitigations. In this webcast, we'll introduce System Theoretic Process Analysis (STPA), a system-theory-based approach to safety analysis. We'll explain ho...

Building an effective security operations capability such as a security operations center (SOC) has always been a challenging endeavor. Balancing the need to successfully integrate the people, processes, and technologies required to support your mission requires a deep understanding of your network and your threat landscape. New AI tools and technologies present both challenges and opportunities....

Are you confused about what should be in your Software Acquisition Pathway program's Capability Needs Statement (CNS)? You are not alone! One of the most frequent requests we receive is for a sample CNS. If only it was that easy! Never fear; our recently released Tactical Guide called Cracking the CNS Code will provide you with the practical insight you need to develop a CNS that will be effective...

Software management is too frequently ignored or addressed piecemeal in systems. Cyber threat actors take advantage of gaps and errors in their attacks, which they can accomplish throughout the lifecycle. Exploiting these gaps and errors allows them to compromise processes, practices, and procedures that touch a system's design, component development, and supply chain to bypass controls and levera...

AI is transforming both the threat landscape and our defensive capabilities. What does cyber mission readiness mean in this new environment? A researcher from the CERT Division of Carnegie Mellon University's (CMU's) Software Engineering Institute (SEI) describes the current challenges and emerging solutions that individuals and teams can use to build and sustain their cyber and AI-readiness. The...

Is your program really ready to adopt the SWP? Next in the Software Acquisition Go Bag series, we'll walk you through our new Tactical Guide called SWP: Ready, Set, Go! This guide provides proven techniques to assess the project's readiness to adopt the SWP; identify any shortfalls; and obtain the resources, information, and support needed for success. What Will Attendees Learn? • How to know if y...

Many organizations practicing DevSecOps have collapsed under the weight of their own tooling. These organizations tried to solve delivery problems by stacking Kubernetes, Helm, GitOps controllers, scanners, and templating systems until no one can explain their own deployment path. This webcast cuts through that complexity and shows how right-sizing DevSecOps—reproducible environments, deterministi...

This webcast offers a solution to the problem of poorly defined requirements in system design that can lead to software flaws, cost and time overruns, and stakeholder dissatisfaction. We will tell you how to use a structured process called the ATAM (architectural tradeoffs analysis method) to develop a system design by eliciting requirements, scenarios, and priorities from stakeholders. Then, we w...

The SEI contributed its expertise to the development of the Software Acquisition Pathway (SWP), which the Department of Defense (DoD) issued in 2020 as DoD Instruction 5000.87. Since the SWP's issuance, SEI researchers have collaborated with DoD program teams and policy owners to effectively implement the pathway in different program contexts, identify barriers and challenges, and monitor outcomes...

Experts agree that quantum computing will likely become powerful enough to break modern-day encryption within the next 10–15 years on "Q Day." Once encryption is defeated, the computing world will never be the same. Organizations need to identify the correct courses of action to take today so that the sudden onset of quantum computing does not threaten their critical assets. In this webcast, Brett...

Finding and fixing weaknesses and vulnerabilities in source code has been an ongoing challenge. There is a lot of excitement about the ability of large language models (LLMs, e.g., GenAI) to produce and evaluate programs. One question related to this ability is: Do these systems help in practice? We ran experiments with various LLMs to see if they could correctly identify problems with source code...

Often, agile implementations are a struggle. Dedicated agile teams focus hard and deliver value on a regular cadence. But when results are tallied, the value teams produce may not fit neatly into the expectations of senior stakeholders. Why? In this webcast, Peter Capell addresses the importance of a practical vision to express outcomes, so that the program's "target picture" is clear to all parti...

Finding and growing AI and Data talent is essential for mission success, but many skilled workers remain unseen because they lack traditional credentials. This session introduces practical strategies and prototype tools that help individuals demonstrate what they know while helping managers identify and evaluate emerging talent in these fields. Attendees will explore micro-assessments reflecting r...

Threat modeling is intended to help defend a system from attack. It tops the list of techniques recommended by the National Institute of Standards and Technology (NIST) to secure critical systems. In a world where people with malicious intent have deadlier tools at their disposal, defenders need to take advantage of Model-Based Systems Engineering (MBSE) to form mitigation strategies effective fro...

DevSecOps generates a lot of data valuable for better decision making. However, decision makers may not see all they need to in order to make best use of the data for continuous improvement. The SEI open source Polar tool unlocks the data, giving DevSecOps teams greater capability to automate, which in turn means they can innovate rapidly – without lessening quality or reducing security. What Atte...

Organizations looking to build and adopt artificial intelligence (AI)–enabled systems face the challenge of identifying the right capabilities and tools to support Machine Learning Operations (MLOps) pipelines. Navigating the wide range of available tools can be especially difficult for organizations new to AI or those that have not yet deployed systems at scale. This webcast introduces the MLOps...

DevSecOps practices foster collaboration among software development, security, and operations teams to build, test, and release software quickly and reliably. A high-stakes, high-security environment has challenged the implementation of these practices within the Department of Defense (DoD). The DoD Chief Information Officer (CIO) organization partnered with the Software Engineering Institute (SEI...

Did you know there are 500 million tweets per day? 3 billion monthly active Facebook users? 1 billion LinkedIn members? Are you one of them? In this webcast, Destiney Marie Plaza reveals how a hacker can use seemingly benign public information to customize an attack on a victim by showing a scenario-based attack and demo (using free and open-source tools). Additionally, you will learn how hackers...

Today, we have seen our national security organizations working to adopt modern software practices, particularly Agile methods and DevSecOps practices, efforts challenged by a mismatch of tempos between operational needs and development processes. The newly mandated Software Acquisition Pathway helps to align those tempos. However, to sustain a competitive advantage through software, we need to se...

An organization's cyber risk management practices must be rooted in organizational goals to be truly effective. In this webcast, Matt Butkovic, Greg Crabbe and Beth-Anne Bygum explore how best to align business and resilience objectives.

The Defense Industrial Base (DIB) is a core element of the national security ecosystem. This point of intersection between private industry and the Department of Defense is a perpetual target for the Nation's adversaries. In this Intersect, Matthew Butkovic and John Haller explore the development, and implementation, of the Cyber Maturity Model Certification (CMMC) as a means to better protect the...

When it comes to recognizing threats, cybersecurity professionals may become distracted by big promises or ignore some obvious inspections. New claims made by the latest and greatest new apps draw attention away from network situational awareness best practices—like a dog distracted when it spots a squirrel. We also may deviate from making routine inspections that point toward further investigatio...