The Five Pillars help make Zero Trust decisions, but the cross functions keep those decisions visible, consistent, and governed. In this post, we look at Visibility and Analytics, Automation and Orchestration, and Governance as practical operating functions for a functional Zero Trust Architecture. The goal is not a fully automated security ecosystem on day one. The goal is to prove trust decisions, implement controls consistently, reduce policy drift, and measure whether ris

Zero Trust works best when we stop trying to fix everything at once and start with one meaningful protect surface. This post explains how to choose that first surface, avoid common pitfalls, and use a practical checklist to make Zero Trust manageable with the tools and capabilities you already have.

Grab a cup of coffee and pull up a chair. This post kicks off a new series for ZT Foundations where we will walk through some of the key ideas from my new book, ZT Foundations: Building Zero Trust with the Tools You Already Have. My goal for this series is simple: take the mystery out of Zero Trust, talk about it in plain language, and show how it can be built from practical decisions instead of shiny buzzwords. Over the next few weeks, we will compare traditional security st

Zero Trust is one of the clearest signals that we’re moving past the expectation that standards will provide the roadmap for implementation. In a Zero Trust world, ‘minimum requirements’ are not a destination. They are a baseline. They tell you where the floor is, not where the ceiling should be. And no longer can we rely on what we defined on Monday being adequate for what may happen on Friday

People who know me well have a running theory that I never sleep. After spending my “free time” working through Anthropic’s Claude Mythos system card (all 200+ pages), I’m not sure I have strong evidence to refute that hypothesis. Occasionally something lands in the AI world that makes even seasoned security folks sit up a little straighter. Anthropic’s Claude Mythos Preview is one of those moments. Below is a grounded, security-minded take on what the model is, what it isn’