First Annual User Conference ArmorText Customers & Invited Guests NEW YORK CITY

Post Field Notes

By:

Ground truth from teams who stayed operational.

Stories, patterns, and playbooks from the teams who built them.

Held May 27, 2026

New York City · Classic Car Club Manhattan

Thank you to the operators, builders, and security leaders who filled the room. Session clips from the day are being released here as speakers approve them — the first sets are live now.

Watch the Recap Stay in the Loop for 2027

WHY IT MATTERED

What the day delivered

The sessions were half of it. The operator-to-operator conversation was the rest.

How peers actually did it

OT cyber alerts, CTI workflows, and identity verification delivered directly into responder threads — securely, in context. Not slides about the product. Implementations from the field.

Patterns you can use

Field-tested approaches for routing, governance, escalation, and secure ingestion. The Secure Gateway Integrations Library — a customer-contributed reference set of real patterns and configurations — is now taking shape.

The builders behind real deployments

Decisions, tradeoffs, and rollout approaches, compared in the room by peers who’ve done it. The clips below bring some of that conversation back.

About the Conference

A user conference built around what customers actually built

Field Notes brought practitioners together to share the patterns they discovered in the field: secure alert delivery, context-rich telemetry, verified coordination. All of it routed directly into ArmorText conversations so teams can act fast without exposing the playbook.

Sessions featured customers who built integrations that bring high-fidelity data into the moments that matter, while keeping the channel end-to-end encrypted and auditable. Real work. Shared with peers. No vendor pitches.

The afternoon closed with the ArmorText Off-the-Record Happy Hour — the discussion continuing off the record, with no attribution.

How the room works

Invite-only, in person, and off the record.
ArmorText customers and invited ecosystem guests only. No vendor pitches from the stage.
No press. No quotes attributed to individuals or organizations.
Clips released after the event are limited to material speakers have approved for public sharing.
Field-tested patterns, shared with peers.

Bring the builders and operators. Not just the approvers.

THE SESSIONS

What attendees heard

One keynote, six customer-led sessions, and a closing — all operator-to-operator.

Opening Keynote

Why This Community Exists (and What We're Building Together)

Jon Schlegel — a Navy cryptologist turned C-suite leader, now CSO of CLEAR — opened Field Notes with the threat arc teams most often overlook: compromised comms channels, and why, with AI-accelerated attacks, out-of-band operational resilience isn’t a future problem. It’s today’s.

Jon Schlegel, CSO CLEAR

#01

SIEM Alerts IT Security

Starting Simple: A First Integration That Delivers Real Value

Not every Secure Gateway deployment starts with complex architecture. Pilot Flying J began with a straightforward SIEM alert integration — routing high-priority notifications to the right people with more context than their previous channel allowed. A practical on-ramp that showed how low the barrier to entry really is.

Zach Randall, IT Security Engineer, Pilot Flying J.

#02

OT Cyber Alerts OT Cyber

Better Alerts, Lower Cost, Higher Reliability — SolarWinds & ArmorText

LS Power’s previous alerting solution was expensive, delivered less context, and — they later discovered — was dropping messages. After routing OT alerts from SolarWinds through ArmorText Secure Gateway, on-call responders received more alerts, with richer detail, at a fraction of the cost.

JD Barosh, Supervisor, OT Network Security, LS Power

#03

Native Integration Splunk

From Stuck to Shipped: A Native Splunk Integration, Built in Days

Hoosier Energy wanted a native Splunk add-on to push alerts, search results, and rendered PDFs directly into ArmorText conversations. Building it by hand stalled. With the right reference material and an AI assist, they shipped a full-featured integration in days.

Dan LaCour, IT Security Analyst, Hoosier Energy

#04

AI & Threat Intelligence Academic / Research

CTI Triage → TTP Extraction → Actionable Playbooks

AI-assisted prioritization workflows that extract TTPs and run CISA’s Playbook-NG to generate vetted eviction strategies — delivered directly into ArmorText conversations with CTI analysts for fine-tuned prioritization.

Project Grimace

#05

Identity Verification Customer Implementation

Out-of-Band Identity Verification

Verified identity checks to reduce impersonation risk and ensure the right people are on the right channel during high-pressure moments. A customer-led implementation built on CLEAR identity infrastructure, running on ArmorText Secure Gateway.

Navroop Mitter, CEO, ArmorText | Jon Schlegel, CSO, CLEAR

#06

OT Security Honeypot Detection Collective Defense Panel

The Watcher Problem: A New Proposal for OT Honeypot Telemetry Sharing

What if organizations running OT honeypots could share what they detected — across sector boundaries, securely, in near real time? ArmorText proposed exactly that. The panel explored the collective-defense case, what members might owe each other, how liability and SLAs could work, and whether it fits inside existing ISAC structures or needs a new kind of sharing entity.

Moderated by Navroop Mitter, CEO, ArmorText

Panelists: Brad Stephenson, Southern Company | Tim Chase, Manufacturing-ISAC | Zach Randall, Pilot Flying J | Matthew B. Welling, Holland & Knight.

Closing

Closing Remarks

Connecting the dots across the day’s sessions, the roadmap ahead, and our gift to the community.

Navroop Mitter, CEO, ArmorText

THE AUDIENCE

Built for the people who own continuity

Field Notes was invite-only — ArmorText customers, the teams who’ve built integrations on the Secure Gateway, and the security leaders who understand why E2EE integration pathways matter when primary channels can’t be trusted.

Want to be in the room next year?

Get notified about Field Notes 2027

Bring the builders and operators. Not just the approvers.