About
Brandon Gates — 25 years making systems work when the consequences are real.
Retired U.S. Army Warrant Officer. CISSP. PMP. Defensive cyber operations, federal program delivery, and now AI automation for the small and mid-sized firms that keep the DMV economy running.
The background
The Army taught me why processes exist
I came up through Army IT and defensive cyber operations and finished as a Warrant Officer — the technical authority role, the person who has to be right about the system. I have supported and defended networks for organizations where failure is not a quarterly write-off: AT&T, NSA, the Army, the Navy, the New York Department of Education.
In those environments a process exists because improvising has a cost somebody has already paid. You document it. You assign an owner. You measure whether it worked. When it fails, you know within minutes, not at the end of the month.
That is the exact discipline small firms are missing when they try to adopt AI — and it is why most of them get nothing measurable out of it.
Why I moved to AI automation
I watched capable, well-run DMV firms buy AI licenses and get nothing. Not because the technology failed — because they layered it on top of processes nobody had ever actually designed. The tool was fine. The process underneath it was undefined, unowned, and unmeasured.
Those are program management problems. I have spent two decades solving them under federal scrutiny, where "we think it's working" is not an acceptable answer.
So I trained directly in the Harvard HDSI program and built the practice around the A.G.E.N.T. framework — audit, gauge, engineer, navigate, track. Then I made every engagement fixed-scope and fixed-price, because the consulting industry's favorite business model is the one where your problem never quite gets solved.
Strategy before software. Always.
Why the cybersecurity background matters here
Most automation consultants can connect two systems. Far fewer can tell you what happens to your client data in transit, which workflows should never leave your authorized boundary, or how to answer a prime contractor's questionnaire about AI use on their contract.
I hold an active TS/SCI clearance and multiple GIAC certifications alongside the CISSP. My background includes PII reduction and privacy work at federal scale. When a workflow touches CUI, PII, PHI, or client-confidential material, the classification and boundary decisions happen before tool selection — not after a finding.
That is the difference between an automation that works and one that works and survives an audit.
Credentials
- U.S. Army (Ret.) — Warrant Officer, IT & Defensive Cyber Operations
- CISSP — Certified Information Systems Security Professional
- PMP — Project Management Professional
- Multiple GIAC certifications
- Active TS/SCI clearance
- Harvard HDSI — A.G.E.N.T. framework & OpenClaw Intensive
- NIST AI RMF 1.0 practitioner
Served
Over two decades supporting and defending systems for AT&T, NSA, the U.S. Army, the U.S. Navy, and the New York Department of Education — plus the small DMV firms that make up the practice today.
How I work
Core values
Carried over from the Army, and the reason clients tend to send me their peers.
Objectivity
I have no vendor relationships and take no referral fees. If the honest answer is "don't automate this," you will hear it from me while you are still holding your money.
Courage
Telling an owner their pet project is the wrong first workflow is uncomfortable. Letting them spend $30,000 finding out is worse.
Insight
The workflow people describe is rarely the workflow that runs. Finding the gap between the two is most of the value in the audit.
Empathy
The people who perform the workflow are the ones who know where it breaks. They are also the ones most afraid of what automation means. Both get addressed.
Open-mindedness
Sometimes the answer is a $40/month tool and a changed handoff. I will tell you that even though it is not an engagement.
Precision
Fixed scope, fixed price, named end date, four metrics. Vague commitments are how consulting engagements quietly become annuities.
Where I work
The DMV, and the firms that supply it
Based in Virginia. Serving Washington DC, Northern Virginia, and Maryland, with secondary coverage in Richmond, Baltimore, and southern Pennsylvania.
The region's economy runs on federal-adjacent small business — contractors, staffing firms, the accountants and lawyers and property managers who serve them. These firms face compliance complexity that generic AI vendors do not understand and lean bidding pressure that leaves no room for waste. That combination is exactly where disciplined automation pays, and exactly where undisciplined automation creates findings.
It is also home. I would rather build a practice among people I will run into at the grocery store.
Free — no call required
Strategy Before Software: The SMB AI Readiness Kit
Five working tools, not a whitepaper. The same instruments I use in the first two weeks of a paid engagement — scoring sheets, a policy template you can adopt as written, and the vendor questions that end bad deals early.
- Workflow Triage Scorecard — score 3 workflows on 8 weighted criteria, find the one worth automating first
- The Autonomy Ladder — the 4 levels, and how to pick one per workflow instead of company-wide
- One-Page AI Acceptable Use Policy — fill-in-the-blank, NIST AI RMF-aligned, adoptable this week
- The Four Metrics Sheet — cycle time, unit cost, quality, capacity unlocked
- 12 Vendor Due-Diligence Questions — plus the 7 workflows you should never automate first
Send me the Kit
18 pages. Delivered in under a minute.
Let's look at one workflow together.
No deck, no discovery fee, no sequence. Thirty minutes on the process your team complains about most.
30 minutes. One workflow. You leave with a plain answer on whether it is worth automating — whether or not you hire me.