WEBVTT
00:00:02.999 --> 00:00:05.940
Zero Trust is the best -selling security idea
00:00:05.940 --> 00:00:10.640
that nobody actually owns. In 2026, roughly two
00:00:10.640 --> 00:00:12.859
-thirds of organizations say they've adopted
00:00:12.859 --> 00:00:16.480
it. About one in 10 have actually built it, and
00:00:16.480 --> 00:00:19.559
you still can't buy it. One expert put it perfectly.
00:00:20.000 --> 00:00:22.579
You can't walk into Walmart and say, give me
00:00:22.579 --> 00:00:25.359
a Zero Trust box, I'm ready to go. This is tech
00:00:25.359 --> 00:00:28.460
updates, Zero Trust, past the buzzword. Let's
00:00:28.460 --> 00:00:31.059
start with what it actually is, because the marketing
00:00:31.059 --> 00:00:34.420
buried it. The authority is an NIST document,
00:00:34.579 --> 00:00:39.179
800207, and it's clear. Zero trust is an architecture
00:00:39.179 --> 00:00:42.039
and a set of principles, not a product you buy.
00:00:42.679 --> 00:00:46.479
The mantra is never trust, always verify. Being
00:00:46.479 --> 00:00:49.530
inside the firewall means nothing. strip away
00:00:49.530 --> 00:00:52.130
the vendor packaging, and it collapses to four
00:00:52.130 --> 00:00:55.270
ideas. Assume you're already breached, verify
00:00:55.270 --> 00:00:58.090
every request explicitly, grant the least privilege
00:00:58.090 --> 00:01:01.409
possible, and recheck continuously. Everything
00:01:01.409 --> 00:01:04.209
a salesperson adds on top of that is wrapping
00:01:04.209 --> 00:01:07.890
paper. One stat before we move on, and it's the
00:01:07.890 --> 00:01:11.689
whole episode. In 2023, fewer than 1 % of large
00:01:11.689 --> 00:01:14.769
enterprises had a mature, measurable zero trust
00:01:14.769 --> 00:01:18.250
program. Gartner's optimistic projection for
00:01:18.250 --> 00:01:23.269
2026? 10%. That's the revolution, from basically
00:01:23.269 --> 00:01:27.489
0 to 1 in 10. Meanwhile, 82 % of organizations
00:01:27.489 --> 00:01:31.370
call zero trust essential, and about 63 % say
00:01:31.370 --> 00:01:34.170
they've adopted it. Adoption is nearly universal
00:01:34.170 --> 00:01:37.629
in name. Maturity is a rounding error. That gap
00:01:37.629 --> 00:01:40.069
between saying it and building it is where every
00:01:40.069 --> 00:01:43.049
failed project lives. So does it even work against
00:01:43.049 --> 00:01:47.010
the 2026 attacks? Partly. And the honest answer
00:01:47.010 --> 00:01:50.650
matters. Zero Trust crushes lateral movement
00:01:50.650 --> 00:01:53.650
and broad credential replay. Fishing resistant
00:01:53.650 --> 00:01:57.950
MFA alone blocks over 99 % of identity attacks.
00:01:58.370 --> 00:02:01.030
But here's what walked right around it. Scattered
00:02:01.030 --> 00:02:04.069
Spider didn't defeat Zero Trust. They called
00:02:04.069 --> 00:02:07.290
the help desk, impersonated an employee, got
00:02:07.290 --> 00:02:10.590
an MFA reset, and were handed a perfectly legitimate
00:02:10.590 --> 00:02:15.199
token. No malware, no exploit. Zero trust can't
00:02:15.199 --> 00:02:18.340
fix a weak recovery workflow. Identity became
00:02:18.340 --> 00:02:21.120
the perimeter. And the perimeter has a phone
00:02:21.120 --> 00:02:23.620
number. Here's the networking shift underneath
00:02:23.620 --> 00:02:27.539
it and it's network plus gold. The old VPN gives
00:02:27.539 --> 00:02:30.280
you broad network level access with implicit
00:02:30.280 --> 00:02:33.360
trust the moment you connect. A flat highway
00:02:33.360 --> 00:02:37.680
for lateral movement. ZTNA, zero trust network
00:02:37.680 --> 00:02:41.550
access, flips that. per application access, granted
00:02:41.550 --> 00:02:44.930
by identity and device posture, rechecked every
00:02:44.930 --> 00:02:47.169
session with the rest of the network staying
00:02:47.169 --> 00:02:50.669
dark. Gartner says most new remote access deployments
00:02:50.669 --> 00:02:54.069
are already ZTNA. It rolls up into the frameworks
00:02:54.069 --> 00:02:56.930
you'll see on the exam, SACE and its security
00:02:56.930 --> 00:03:00.270
-only sibling, SSE. The flat tunnel is dying.
00:03:00.530 --> 00:03:03.110
Learn its replacement. What about the mandate
00:03:03.110 --> 00:03:06.659
everyone points to? In 2022, the White House
00:03:06.659 --> 00:03:09.599
ordered federal civilian agencies to reach zero
00:03:09.599 --> 00:03:13.240
trust by the end of fiscal 2024. That deadline
00:03:13.240 --> 00:03:16.199
came and went. The order's still in effect, just
00:03:16.199 --> 00:03:18.539
unfinished. Gartner predicted three quarters
00:03:18.539 --> 00:03:21.400
of agencies would miss it. The Pentagon is on
00:03:21.400 --> 00:03:25.080
a harder track, a target level by 2027, and a
00:03:25.080 --> 00:03:28.159
new zero trust strategy coming that extends it
00:03:28.159 --> 00:03:32.139
to operational technology, not just IT. The lesson
00:03:32.139 --> 00:03:35.169
for everyone else. Zero Trust isn't a deadline
00:03:35.169 --> 00:03:37.990
you hit. It's a capital project that never quite
00:03:37.990 --> 00:03:41.150
ends. Now the skeptics section, because it's
00:03:41.150 --> 00:03:44.030
earned, vendors slap Zero Trust on everything.
00:03:44.550 --> 00:03:46.889
Firewalls, identity tools, whatever's in the
00:03:46.889 --> 00:03:49.729
catalog, and sell you a sliver of the architecture
00:03:49.729 --> 00:03:52.550
as the whole thing. Call it Zero Trust washing.
00:03:52.939 --> 00:03:56.159
The real reason maturity sits near 10 % isn't
00:03:56.159 --> 00:03:59.860
technical. It's that true Zero Trust is an organization
00:03:59.860 --> 00:04:03.319
-wide re -architecture across identity, devices,
00:04:03.620 --> 00:04:06.740
network, apps, and data. A scope and money problem,
00:04:07.180 --> 00:04:10.219
not a product gap. Which is why the most repeated
00:04:10.219 --> 00:04:13.639
line in the field is also the truest. Zero Trust
00:04:13.639 --> 00:04:16.920
is a journey, not a product. So what do you do
00:04:16.920 --> 00:04:20.139
Monday and what's on the exam? Start with identity,
00:04:20.439 --> 00:04:23.879
not the network, phishing -resistant MFA, pass
00:04:23.879 --> 00:04:27.959
keys, kill text message codes. 99 % of identity
00:04:27.959 --> 00:04:30.959
attacks are password -based. Harden the help
00:04:30.959 --> 00:04:33.819
desk with out -of -band verification. That's
00:04:33.819 --> 00:04:37.240
the 2026 lesson. Micro -segment the crown jewels
00:04:37.240 --> 00:04:41.180
first, and for the exam, know that micro -segmentation
00:04:41.180 --> 00:04:44.620
is not the same as a VLAN. Know your PDP and
00:04:44.620 --> 00:04:47.879
PEP, policy decision and enforcement points.
00:04:48.300 --> 00:04:52.259
And know ZTNA versus VPN cold. Security Plus
00:04:52.259 --> 00:04:55.079
and Network Plus both test all of it. Here's
00:04:55.079 --> 00:04:58.699
the close. Zero Trust isn't broken. Most companies
00:04:58.699 --> 00:05:01.420
just do it wrong. It was never a box you buy.
00:05:01.779 --> 00:05:05.060
It's a soon breach, verify explicitly, leased
00:05:05.060 --> 00:05:07.879
privilege, done continuously across everything
00:05:07.879 --> 00:05:10.819
you own. And its next frontier isn't the human
00:05:10.819 --> 00:05:13.870
logging in. It's the AI agent acting on that
00:05:13.870 --> 00:05:16.069
human's behalf, which is the whole reason the
00:05:16.069 --> 00:05:19.129
last several episodes led here. Verify everything,
00:05:19.550 --> 00:05:22.430
especially the machines. That's the show, and
00:05:22.430 --> 00:05:24.829
that wraps our run for now. Thanks for spending
00:05:24.829 --> 00:05:26.870
it with us. We're back next week with more tech
00:05:26.870 --> 00:05:28.069
updates. Stay sharp.
00:00:02.999 --> 00:00:05.940
Zero Trust is the best -selling security idea
00:00:05.940 --> 00:00:10.640
that nobody actually owns. In 2026, roughly two
00:00:10.640 --> 00:00:12.859
-thirds of organizations say they've adopted
00:00:12.859 --> 00:00:16.480
it. About one in 10 have actually built it, and
00:00:16.480 --> 00:00:19.559
you still can't buy it. One expert put it perfectly.
00:00:20.000 --> 00:00:22.579
You can't walk into Walmart and say, give me
00:00:22.579 --> 00:00:25.359
a Zero Trust box, I'm ready to go. This is tech
00:00:25.359 --> 00:00:28.460
updates, Zero Trust, past the buzzword. Let's
00:00:28.460 --> 00:00:31.059
start with what it actually is, because the marketing
00:00:31.059 --> 00:00:34.420
buried it. The authority is an NIST document,
00:00:34.579 --> 00:00:39.179
800207, and it's clear. Zero trust is an architecture
00:00:39.179 --> 00:00:42.039
and a set of principles, not a product you buy.
00:00:42.679 --> 00:00:46.479
The mantra is never trust, always verify. Being
00:00:46.479 --> 00:00:49.530
inside the firewall means nothing. strip away
00:00:49.530 --> 00:00:52.130
the vendor packaging, and it collapses to four
00:00:52.130 --> 00:00:55.270
ideas. Assume you're already breached, verify
00:00:55.270 --> 00:00:58.090
every request explicitly, grant the least privilege
00:00:58.090 --> 00:01:01.409
possible, and recheck continuously. Everything
00:01:01.409 --> 00:01:04.209
a salesperson adds on top of that is wrapping
00:01:04.209 --> 00:01:07.890
paper. One stat before we move on, and it's the
00:01:07.890 --> 00:01:11.689
whole episode. In 2023, fewer than 1 % of large
00:01:11.689 --> 00:01:14.769
enterprises had a mature, measurable zero trust
00:01:14.769 --> 00:01:18.250
program. Gartner's optimistic projection for
00:01:18.250 --> 00:01:23.269
2026? 10%. That's the revolution, from basically
00:01:23.269 --> 00:01:27.489
0 to 1 in 10. Meanwhile, 82 % of organizations
00:01:27.489 --> 00:01:31.370
call zero trust essential, and about 63 % say
00:01:31.370 --> 00:01:34.170
they've adopted it. Adoption is nearly universal
00:01:34.170 --> 00:01:37.629
in name. Maturity is a rounding error. That gap
00:01:37.629 --> 00:01:40.069
between saying it and building it is where every
00:01:40.069 --> 00:01:43.049
failed project lives. So does it even work against
00:01:43.049 --> 00:01:47.010
the 2026 attacks? Partly. And the honest answer
00:01:47.010 --> 00:01:50.650
matters. Zero Trust crushes lateral movement
00:01:50.650 --> 00:01:53.650
and broad credential replay. Fishing resistant
00:01:53.650 --> 00:01:57.950
MFA alone blocks over 99 % of identity attacks.
00:01:58.370 --> 00:02:01.030
But here's what walked right around it. Scattered
00:02:01.030 --> 00:02:04.069
Spider didn't defeat Zero Trust. They called
00:02:04.069 --> 00:02:07.290
the help desk, impersonated an employee, got
00:02:07.290 --> 00:02:10.590
an MFA reset, and were handed a perfectly legitimate
00:02:10.590 --> 00:02:15.199
token. No malware, no exploit. Zero trust can't
00:02:15.199 --> 00:02:18.340
fix a weak recovery workflow. Identity became
00:02:18.340 --> 00:02:21.120
the perimeter. And the perimeter has a phone
00:02:21.120 --> 00:02:23.620
number. Here's the networking shift underneath
00:02:23.620 --> 00:02:27.539
it and it's network plus gold. The old VPN gives
00:02:27.539 --> 00:02:30.280
you broad network level access with implicit
00:02:30.280 --> 00:02:33.360
trust the moment you connect. A flat highway
00:02:33.360 --> 00:02:37.680
for lateral movement. ZTNA, zero trust network
00:02:37.680 --> 00:02:41.550
access, flips that. per application access, granted
00:02:41.550 --> 00:02:44.930
by identity and device posture, rechecked every
00:02:44.930 --> 00:02:47.169
session with the rest of the network staying
00:02:47.169 --> 00:02:50.669
dark. Gartner says most new remote access deployments
00:02:50.669 --> 00:02:54.069
are already ZTNA. It rolls up into the frameworks
00:02:54.069 --> 00:02:56.930
you'll see on the exam, SACE and its security
00:02:56.930 --> 00:03:00.270
-only sibling, SSE. The flat tunnel is dying.
00:03:00.530 --> 00:03:03.110
Learn its replacement. What about the mandate
00:03:03.110 --> 00:03:06.659
everyone points to? In 2022, the White House
00:03:06.659 --> 00:03:09.599
ordered federal civilian agencies to reach zero
00:03:09.599 --> 00:03:13.240
trust by the end of fiscal 2024. That deadline
00:03:13.240 --> 00:03:16.199
came and went. The order's still in effect, just
00:03:16.199 --> 00:03:18.539
unfinished. Gartner predicted three quarters
00:03:18.539 --> 00:03:21.400
of agencies would miss it. The Pentagon is on
00:03:21.400 --> 00:03:25.080
a harder track, a target level by 2027, and a
00:03:25.080 --> 00:03:28.159
new zero trust strategy coming that extends it
00:03:28.159 --> 00:03:32.139
to operational technology, not just IT. The lesson
00:03:32.139 --> 00:03:35.169
for everyone else. Zero Trust isn't a deadline
00:03:35.169 --> 00:03:37.990
you hit. It's a capital project that never quite
00:03:37.990 --> 00:03:41.150
ends. Now the skeptics section, because it's
00:03:41.150 --> 00:03:44.030
earned, vendors slap Zero Trust on everything.
00:03:44.550 --> 00:03:46.889
Firewalls, identity tools, whatever's in the
00:03:46.889 --> 00:03:49.729
catalog, and sell you a sliver of the architecture
00:03:49.729 --> 00:03:52.550
as the whole thing. Call it Zero Trust washing.
00:03:52.939 --> 00:03:56.159
The real reason maturity sits near 10 % isn't
00:03:56.159 --> 00:03:59.860
technical. It's that true Zero Trust is an organization
00:03:59.860 --> 00:04:03.319
-wide re -architecture across identity, devices,
00:04:03.620 --> 00:04:06.740
network, apps, and data. A scope and money problem,
00:04:07.180 --> 00:04:10.219
not a product gap. Which is why the most repeated
00:04:10.219 --> 00:04:13.639
line in the field is also the truest. Zero Trust
00:04:13.639 --> 00:04:16.920
is a journey, not a product. So what do you do
00:04:16.920 --> 00:04:20.139
Monday and what's on the exam? Start with identity,
00:04:20.439 --> 00:04:23.879
not the network, phishing -resistant MFA, pass
00:04:23.879 --> 00:04:27.959
keys, kill text message codes. 99 % of identity
00:04:27.959 --> 00:04:30.959
attacks are password -based. Harden the help
00:04:30.959 --> 00:04:33.819
desk with out -of -band verification. That's
00:04:33.819 --> 00:04:37.240
the 2026 lesson. Micro -segment the crown jewels
00:04:37.240 --> 00:04:41.180
first, and for the exam, know that micro -segmentation
00:04:41.180 --> 00:04:44.620
is not the same as a VLAN. Know your PDP and
00:04:44.620 --> 00:04:47.879
PEP, policy decision and enforcement points.
00:04:48.300 --> 00:04:52.259
And know ZTNA versus VPN cold. Security Plus
00:04:52.259 --> 00:04:55.079
and Network Plus both test all of it. Here's
00:04:55.079 --> 00:04:58.699
the close. Zero Trust isn't broken. Most companies
00:04:58.699 --> 00:05:01.420
just do it wrong. It was never a box you buy.
00:05:01.779 --> 00:05:05.060
It's a soon breach, verify explicitly, leased
00:05:05.060 --> 00:05:07.879
privilege, done continuously across everything
00:05:07.879 --> 00:05:10.819
you own. And its next frontier isn't the human
00:05:10.819 --> 00:05:13.870
logging in. It's the AI agent acting on that
00:05:13.870 --> 00:05:16.069
human's behalf, which is the whole reason the
00:05:16.069 --> 00:05:19.129
last several episodes led here. Verify everything,
00:05:19.550 --> 00:05:22.430
especially the machines. That's the show, and
00:05:22.430 --> 00:05:24.829
that wraps our run for now. Thanks for spending
00:05:24.829 --> 00:05:26.870
it with us. We're back next week with more tech
00:05:26.870 --> 00:05:28.069
updates. Stay sharp.
