Devices used to mean laptops and phones. Now they mean containers, microservices, and AI agents that can act on their own. This week's Zero Trust Foundations post runs the AAVI model through the Device pillar, with real 2026 breach headlines showing what happens when device and workload trust gets skipped, whether the "device" in question has a keyboard or not.

Identity is where Zero Trust starts, but it cannot stand alone. In this post, we run AAVI through the Identity pillar by documenting transaction flows, writing Zero Trust policy statements, enforcing MFA, retiring legacy authentication, and showing how visibility, automation, and governance keep identity decisions honest.

Zero Trust is one of the clearest signals that we’re moving past the expectation that standards will provide the roadmap for implementation. In a Zero Trust world, ‘minimum requirements’ are not a destination. They are a baseline. They tell you where the floor is, not where the ceiling should be. And no longer can we rely on what we defined on Monday being adequate for what may happen on Friday

Zero Trust is an architecture and a set of outcomes, not a shopping list. Decide what “good” looks like for you , then pick tools that earn a place in that design. We say we want a “security strategy,” but a lot of the time what we really have is a pile of product decisions made in the moment; because an alert was scary, a headline was loud, or a demo was chef’s kiss . And honestly? Historically we’ve treated cybersecurity tooling like drunk teenagers dating the next pretty t