Shared risks, collective action: ARC's doug Lemott on cyber resilience. Douglas "Doug" Lemott Jr.'s cybersecurity career has taken him from protecting the Marine Corps Enterprise Network to helping safeguard the financial systems Americans rely on every day. The domain has changed, but his sense of mission hasn't: disruptions can affect families, businesses and confidence in essential institutions. After 27 years as a Marine Corps officer and leadership roles at VMware and SAP National Security Services, Lemott now serves as head of cybersecurity programs and chief information security officer at the Analysis and Resilience Center for Systemic Risk. There, he brings institutions together to address a shared challenge: the cloud platforms, software and technology providers that connect them can also expose them to risks no organization can solve alone. In this Q&A, Lemott discusses turning collaboration into practical improvements in resilience, preparing for emerging AI threats, the mentors who shaped his career and why working on classic cars offers a welcome change of pace. Can you briefly describe your professional background and career progression? I have spent more than three decades leading technology, cybersecurity, and operational resilience initiatives across the military, government, and private sector. I served 27 years as a U.S. Marine Corps officer, ultimately leading large-scale cyber operations and the organizations responsible for protecting the Marine Corps Enterprise Network. I also advised senior Department of Defense leadership on cybersecurity, cloud modernization, artificial intelligence, and enterprise technology strategy. After retiring from the Marine Corps, I joined VMware, where I led cybersecurity and compliance initiatives across government, education, and healthcare. I later moved to SAP National Security Services, serving first as Vice President of Secure Cloud Engineering, Delivery, and Operations and then as Vice President of Security Operations and Deputy CISO. Today, I serve as Chief Information Security Officer and Head of Cybersecurity Programs at the Analysis and Resilience Center for Systemic Risk. The role brought together the major themes of my career: public service, cybersecurity, critical infrastructure protection, executive leadership, and collaboration across complex organizations. Why was this the path you chose, and how influential was it to your career? My path was shaped by a desire to serve and to contribute to missions larger than myself. I initially enlisted in the Marine Corps to develop discipline and earn the GI Bill, but an opportunity to attend the U.S. Naval Academy changed the trajectory of my life. It gave me an exceptional technical education, a foundation in leadership, and the confidence to take on increasingly complex responsibilities. Cybersecurity became a natural extension of that journey. Throughout my career, I have been entrusted with protecting networks, information, missions, and people. Each role reinforced the importance of disciplined execution, continuous learning, and calm decision-making under pressure. That foundation has influenced how I lead, how I assess risk, and how I align people, technology, and resources around mission outcomes. Absolutely. Although I no longer wear a uniform, I still view my work through the lens of service and stewardship. During my military career, I helped protect systems essential to national defense. Today, I help strengthen the resilience of critical financial functions that support economic stability and national security. The financial system touches every American. A disruption can affect families, businesses, markets, and confidence in our institutions. Protecting that ecosystem therefore feels deeply personal. The domain has changed, but the purpose remains consistent: safeguard critical infrastructure, anticipate consequential risks, and help institutions remain resilient when the stakes are highest. What are your current top priorities and responsibilities? How do these relate to ARC's overall mission and growth strategy? My responsibilities span two complementary areas. Internally, I oversee ARC's cybersecurity strategy, technology infrastructure, governance, and secure collaboration capabilities. Externally, I lead cybersecurity programs that bring member institutions and technology partners together to identify, assess, and reduce systemic cyber and technology risk. Our priorities include operationalizing ARC's Cybersecurity and Technology Risk Framework, advancing sector-wide risk identification, addressing software supply-chain and third-party dependencies, and helping member institutions prepare for emerging risks associated with frontier AI and sophisticated nation-state actors. These priorities directly advance ARC's mission. Our value comes from convening institutions around risks that no single organization can solve independently and translating collaboration into measurable improvements in resilience. Where do you and your team see growth opportunities, and what do you anticipate will be your customers' top pain points? The greatest opportunity is to move systemic cyber risk management from periodic discussion to sustained, operational collaboration. Dependencies on shared cloud platforms, software components, technology providers, and AI ecosystems create efficiencies, but they can also create concentrated risks that propagate across institutions. Key risk areas include limited visibility into upstream dependencies, third- and nth-party concentration risk, rapid AI adoption, the accelerating pace of vulnerability discovery, and the challenge of coordinating action across highly regulated organizations. The opportunity is to provide common risk taxonomies, trusted information-sharing mechanisms, actionable frameworks, and scalable pathways that allow institutions to respond collectively while preserving their individual governance responsibilities. How are you and your team planning to address and prepare for these opportunities? We are focused on converting strategic frameworks into repeatable and measurable action. That includes strengthening governance through the CISO Committee and supporting working groups, developing a sector-level cybersecurity and technology risk register, and concentrating resources on initiatives with clear member sponsorship and measurable resilience outcomes. We are also expanding engagement with technology providers and government partners, improving shared threat intelligence and risk visibility, and developing the team capacity needed to sustain these programs. Our objective is not simply to produce analysis. It is to create trusted operating models, practical implementation pathways, and durable partnerships that help members manage interconnected risks at scale. How important are mentorship and networking? Were they influential to your career? Mentorship and networking are essential because the most difficult challenges cross organizational and sector boundaries. Technical expertise matters, but trusted relationships often determine whether leaders can align stakeholders, exchange insights, and turn good ideas into action. Mentors have been enormously influential throughout my career. They challenged me to exceed my perceived limitations, expanded my perspective, and advocated for me when opportunities arose. Networking also helped me navigate the transition from military service to industry and understand new business environments without losing my sense of mission. I now consider it a responsibility to pay that investment forward by mentoring veterans, emerging cybersecurity professionals, and future leaders. What is something most people do not know about you personally? Most people do not know that I enjoy working on classic cars. It gives me an opportunity to step away from the digital environment and solve problems with my hands. I also make family time and physical fitness priorities, whether that means watching my children pursue their interests, taking a road trip, sharing a quiet dinner, or getting in a workout. Those activities help me recharge, maintain perspective, and return to the mission with greater clarity. Staff Writer WashingtonExec celebrates the people, programs, and milestones shaping the Washington, D.C. government contracting community. Join 30,000+ leaders who start their day with The Daily. Our latest executive profiles, council news, and GovCon headlines - every morning.

Broadcom introduced VMware HyperArmor on October 13, 2026, a software tool that protects the VMware ESX hypervisor in VMware Cloud Foundation from cyber attacks. It requires no downtime, software upgrades, or agents inside guest virtual machines. HyperArmor targets stolen root credentials and unpatched vulnerabilities, the two causes of most hypervisor attacks. It supports ESX 8.x and later. The tool offers three protections: virtual patching that blocks malicious actions before flaws can be exploited, a baseline that blocks unauthorised executables and scripts, and multi-factor authentication on SSH logins. "Reactive detection and patching are no longer enough," said Paul Turner, Broadcom's chief product officer for the VMware Cloud Foundation Division. HyperArmor allows only what is "known good" to run on the host.