/resource%20-%20forge%20institute/forge%20logo.png?width=500&height=161&name=forge%20logo.png)
"Forge works with a lot of small businesses in the defense industrial base, and they don't always have their own IT or cybersecurity folks. They need plug-and-play options, and Virtru is a great solution for small businesses that need to quickly turn on this type of capability."
Lee Watson
Chairman and CEO
"Forge Institute was started for two main reasons," explains Chairman and CEO Lee Watson. “First, to help people and organizations understand the dangers of new cyber and emerging technologies. Second, to look at how these technologies could also help businesses become more efficient, grow, and boost the economy, while still managing the risks involved."
Founded in late 2018 in Little Rock, Arkansas, Forge Institute embodies its founding mission through three areas: workforce development, applied research/startup innovation, and resiliency and collective defense. As an organization focused on public-private partnerships, they make thoughtful, intentional choices about their technology vendors—choices that reflect their deep understanding of cybersecurity and their commitment to practicing what they preach.
So when they needed to secure sensitive communications while meeting the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) compliance requirements, they chose Virtru to provide protection that works seamlessly for partners of all technical capabilities.
Forge Institute was created with a dual mission: helping organizations understand cyber risks while simultaneously identifying economic growth opportunities in the technology sector. "Forge Institute is all about public-private partnerships," Watson explains. Their work spans workforce development, applied research, startup innovation, and collective defense—all areas where secure communication is a must.
As an organization working at the intersection of government, military, critical infrastructure, and private enterprise, Forge Institute regularly handles personally identifiable information (PII) from military personnel transitioning to civilian careers, defense contractors, and participants in their cybersecurity training programs. Simultaneously, as they expanded their work with defense contractors, they needed to meet the stringent requirements of the Cybersecurity Maturity Model Certification (CMMC) 2.0—a Department of Defense framework that verifies the cybersecurity practices of companies within the defense industrial base.
"We were looking for a way to send more secure emails with PII and other information while becoming CMMC compliant," explains Watson. This dual requirement—protecting sensitive personal data while meeting formal compliance standards for defense work—led them to evaluate various security solutions. After careful consideration, they determined that "the only way to meet those two objectives with secure email is Virtru."
For the team at Forge Institute, security is never just about meeting minimum requirements. While they rely on Google Workspace for their operations, they recognized the limitations in Google's default security when it comes to protecting their most sensitive communications.
"Google is secure by default. It's using TLS encryption, which is just encryption in transit—just that secure pipe we call it," explains Watson. "As it's traveling, it's secure. Where we see gaps is once it gets to the recipient, how do we know what level of security they have, and how do we know what they're doing with that information?"
This understanding of Gmail's encryption standard beyond the transmission phase led Forge Institute to seek a solution that would provide complete protection of data throughout the entire data lifecycle.
"With Virtru, you can ensure that information sent is encrypted at all points, not just in transit. It's encrypted at rest in your recipient's inbox, and you also have visibility and control over that information. So you can worry less about what's happening with it once it leaves your organization," Watson continues.
This philosophy—that compliance alone doesn't ensure adequate protection—guided their security decision-making. "Sometimes you have a legal duty to protect information, and sometimes you have a moral obligation to protect certain information," notes Watson. "While you might be technically “in compliance” with any sort of set of controls like CMMC, that doesn't always mean that you're doing your duty to protect certain types of data."
Naturally, the Forge team was particularly mindful of how security affects their partners—especially smaller organizations with limited technical resources. It’s why in addition to Virtru for Gmail, Forge Institute chose Secure Share as an agnostic file-sharing solution for its ad-hoc use cases.
"We've all had banking relationships or insurance relationships that use these terrible secure file transmission services. And you have to create these accounts and use it one time," says Watson, acknowledging the friction that poor security implementations can create.
By contrast, "The Secure Share Virtru product is easy for our customers and our partners to use." Virtru Secure Share provides a simple way for partners to securely send files without creating accounts or remembering passwords, streamlining the exchange of sensitive information.
This usability advantage is especially important for Forge Institute's work with small businesses entering the defense sector. "Forge works with a lot of small businesses in the defense industrial base, and they don't always have their own IT or cybersecurity folks," explains Watson. "They need plug and play type options, and Virtru is a great solution for small businesses that need to quickly turn on this type of capability."
Through their selection of Virtru, Forge Institute demonstrates their commitment to helping smaller organizations navigate the complexities of defense industry security requirements.
"There are small businesses that we've talked to that we have helped support on their journey to doing more government contracting work," Watson shares. "They need to be compliant with CMMC. But they also need to be thoughtful about who they're communicating with, where those people are and what they do, and Virtru allows you to step that up to the next level."
This approach aligns perfectly with Forge Institute's founding mission: not just mitigating risks, but identifying opportunities for growth and development in the technology sector. By helping small businesses implement appropriate security measures, they're opening doors to government contracting opportunities that might otherwise be inaccessible.
At its core, Forge Institute's selection of Virtru reflects their understanding that security is fundamentally about building and maintaining trust.
"When you're involved in public-private partnerships, trust is everything," Watson emphasizes. "Being able to send communications securely, and being able to provide a link for your customer or your partner to send you docs securely, really helps maintain operational trust with your partners."
This trust-centered approach to security mirrors Forge Institute's broader mission of strengthening cooperation between government agencies, military organizations, and private businesses. By implementing Virtru, they've strengthened a foundation for secure collaboration that supports all aspects of their work.
/shenandoah-case-study.webp)
.jpg)
