Brian Reed: Eliza, long week — you ready to argue about cybersecurity?
Eliza Ward: Always. What are we arguing about?
Brian Reed: Whether 'zero-trust' means anything anymore. That's today — the gap between what the term is supposed to mean and what organizations are actually doing with it.
Eliza Ward: The 88-63 split.
Brian Reed: That's the one. Eighty-eight percent of organizations implementing zero-trust say they're hitting significant obstacles. Sixty-three percent say they've already adopted it. Let me sit with that for a second — those are not populations that can fully overlap if 'adopted' means what NIST SP 800-207 says it means.
Eliza Ward: Right — and NIST's definition is not fuzzy. Every access request, any user, any device, explicitly authenticated and continuously verified. That's the baseline.
Brian Reed: So someone is lying, or at least — no, 'lying' is too strong — someone is using the word very generously. And that matters because the whole SolarWinds story is built on the premise that zero-trust is the necessary response. Attackers inside trusted corporate and government networks for months, undetected. Castle-and-moat failed. Zero-trust required. That's the narrative.
Eliza Ward: You don't buy it?
Brian Reed: I buy that detection failed. I'm less convinced that the perimeter concept itself was the cause. Hang on — if you had continuous monitoring inside the walls, behavioral analytics flagging unusual lateral movement, maybe SolarWinds gets caught in week two, not month nine. That's not zero-trust, that's just... not being blind inside your own network.
Eliza Ward: Wait, so your version is: SolarWinds proved internal visibility was bad, and zero-trust became the answer because it was expedient, not because it was the only answer?
Brian Reed: That's the question I want you to convince me out of. Because if that's true, the whole framing — that zero-trust is now the universal architectural replacement for perimeter security — that's doing a lot of work on shaky ground.
Eliza Ward: Okay. I'll try. But I think the answer is messier than either version.
Brian Reed: Messier how? Because I need the plain version before we get to messy.
Eliza Ward: Okay, so — imagine a building. Old model: you show your badge at the front door, security waves you through, and now every room inside is open. Conference rooms, server closets, the CEO's office. You're in the building, you're trusted. Zero-trust says: every single door checks your badge again. Every time. And it only opens the specific room you actually need right now.
Brian Reed: That's — yeah. That landed.
Eliza Ward: And the contractor scenario makes it concrete. Someone on a home network, 9 p.m., needs to pull something from a development database. Under the old model she's outside the moat entirely — blocked, or she's fighting a VPN that's doing one check at login and then... nothing. Under zero-trust, the system is checking her identity, checking whether her device has been compromised, watching the behavioral context of the request in real time. And it grants access to exactly that database — not the whole internal network, not adjacent systems. Just the thing she needs.
Brian Reed: So that's least-privilege access doing the scoping — the IAM layer is saying 'this identity gets this resource, nothing adjacent.'
Eliza Ward: Exactly that. IAM is the control plane. MFA is the identity check. Micro-segmentation is what stops her from accidentally — or maliciously — moving laterally to the production database two hops over. And the continuous monitoring piece is the part most people underestimate. Authentication isn't a one-time event at login. If her session starts doing something anomalous mid-access, the system catches it then, not at the next login.
Brian Reed: Which is the actual gap SolarWinds exposed — not the perimeter, but the nothing-after-login part.
Eliza Ward: Right, and — wait, that's the point I want to tighten. The perimeter failed because there was no verification after entry. Zero-trust collapses that distinction. Location stops being the trust signal. Identity is the trust signal, and it's checked continuously.
Brian Reed: So never trust, always verify isn't a slogan, it's literally the mechanism — every request, every time, regardless of whether you're inside or outside.
Eliza Ward: That's the NIST SP 800-207 baseline, verbatim essentially. And BeyondCorp is the proof that it works at scale — Google moved its entire workforce off VPN-dependent perimeter access using exactly this model. Before NIST had even written the standard.
Brian Reed: Hang on — before the standard?
Eliza Ward: Years before. BeyondCorp was an internal Google initiative. They built and deployed it, and it became the most cited real-world precedent for zero-trust precisely because they'd already done what everyone else was theorizing about.
Brian Reed: BeyondCorp worked because Google had the engineering depth to build and maintain something like that — the bench to keep it running. Most organizations don't have that. So when you say zero-trust is the standard now, are you describing what most enterprises can actually do, or what Google could do?
Eliza Ward: That's the structural crack, right — BeyondCorp works, but BeyondCorp is Google. And NIST SP 800-207 doesn't care whether you have Google's engineering bench. The standard doesn't grade on a curve.
Brian Reed: Which is why CISA published the Zero Trust Maturity Model. Five pillars — identity, devices, networks, applications, data — and progressive capability levels inside each one. The government looked at 800-207 and said, okay, that's the destination, but we need a roadmap because nobody is going to get there in one deployment.
Eliza Ward: Wait — so the maturity model is CISA admitting zero-trust isn't a single state?
Brian Reed: That's exactly what it is. It's not a pass/fail. It's a direction. And here's where I want to press on something — if the government's own framework says 'you can be partially zero-trust and that's fine,' who decides when the label is actually warranted? Because right now it sounds like the answer is: whoever's filling out the survey.
Eliza Ward: I mean — that's not wrong. But the maturity model was designed precisely for that reality. It's not a loophole, it's a feature. You start with high-value assets, you layer in micro-segmentation where you have the inventory to support it—
Brian Reed: Okay, stop there. Inventory. That's the thing I don't think gets enough air. Micro-segmentation requires you to know exactly what you're segmenting. Every device, every service, every data flow. Continuously maintained. And Mahmud Hasan's 2024 paper frames IAM, micro-segmentation, and behavioral analytics as integrated pillars — they're supposed to work together. But if your asset inventory is incomplete or stale, the segmentation is segmenting a map that doesn't match the territory.
Eliza Ward: No, that's right. That's the prerequisite problem. The framework assumes hygiene that most enterprises haven't reached.
Brian Reed: So Cisco packages NIST, CISA, and DoD guidance into an enterprise product — and I'm not dismissing that, it extends the compliance baseline into actual tooling — but are they selling a standard or are they selling a direction with a price tag on it?
Eliza Ward: Probably both? And I think that's — actually, no, I want to be more precise. The DoD framework, CISA's maturity model, 800-207 — they're all pointing the same direction. Cisco is operationalizing that. But operationalizing a direction isn't the same as operationalizing a finish line.
Brian Reed: Which means most organizations calling themselves zero-trust are somewhere on a maturity curve, not at the end of it. And the least-privilege enforcement piece — that's the part that's supposed to limit blast radius if something does get through — that also requires the asset inventory to be accurate. You can't grant minimum permissions if you don't have a complete picture of what permissions exist.
Eliza Ward: Right, and — wait, this is the honest answer. Hybrid and transitional configurations are going to be the reality for most organizations for the foreseeable future. CISA's model accommodates that. But the label 'zero-trust' doesn't.
Brian Reed: That's the problem stated plainly. The label has outrun the reality. And it's going to get more complicated — because the next layer involves delegating continuous verification decisions to AI-driven behavioral analytics, which sounds like a solution until you ask whether you've actually resolved the trust problem or just moved it somewhere else.
Eliza Ward: Yeah — and that's the part we need to get into, because I think it breaks the framework in a different direction than anyone's advertising.
Brian Reed: Because when AI is doing the continuous verification — behavioral analytics, dynamic policy decisions, flagging anomalous sessions in real time — you haven't eliminated the need to trust something. You've just moved what you're trusting. From a network location to a model.
Eliza Ward: And the model is a black box.
Brian Reed: Often, yeah. So picture this — a security analyst in a hospital, 11 p.m., pulling patient record access logs to investigate a billing anomaly. The AI flags her session as anomalous because the access pattern looks unusual at that hour and terminates it. Was that right? Maybe. Was it wrong? Also maybe. But who reviews that decision, and how fast?
Eliza Ward: And the audit trail — does NIST SP 800-207 say anything about that? Because I don't think it does.
Brian Reed: It doesn't. 800-207 defines the architecture — the pillars, the verification requirements. But it was written before AI-driven authorization was a real implementation layer. And CISA's Maturity Model is the same — it's structured around identity, devices, networks, applications, data. The AI sitting above all five pillars making real-time call decisions? That's not in the framework.
Eliza Ward: Wait — so the current standards literally have no auditability requirement for the AI decision layer?
Brian Reed: Not yet. Which is — I mean, that's not a small gap. If the AI wrongly denies access during an active incident response, or worse, wrongly grants it because the attacker has learned to mimic the behavioral baseline, the framework currently has no answer for who's accountable.
Eliza Ward: Okay, but — actually, that second failure mode is the one I'd stress more. An AI that gets gamed. Because sophisticated attackers can learn a behavioral baseline and operate inside it. That's not hypothetical — that's a more patient version of exactly what SolarWinds demonstrated inside trusted networks for months.
Brian Reed: So you've replaced 'I trust this network location' with 'I trust this behavioral pattern' — and an attacker who's studied the pattern is inside again. Displaced trust, not eliminated trust.
Eliza Ward: Which is the honest version of where the architecture actually lands. Zero-trust got the direction right — least-privilege, micro-segmentation, continuous verification, those things genuinely shrink blast radius compared to castle-and-moat. BeyondCorp proved that holds at scale. But every enforcement layer we add to automate verification introduces a new trust assumption. And the frameworks haven't caught up to what that means when the decision engine is a model you can't fully interrogate.
Brian Reed: The architecture works. The trust problem just moved upstairs.
Eliza Ward: And the thing to watch is whether NIST or CISA closes that gap — because right now, adding an AI layer to a zero-trust stack is adding an unaudited decision-maker to a framework built around the assumption that every decision can be verified.
Brian Reed: Sixty-three percent say they've adopted it. CISA's own Maturity Model says there's no finish line, by design. And now the cutting edge is delegating the actual trust decisions to an AI that no current standard knows how to audit. So what — what exactly are we certifying when an organization says it's zero-trust, and it's somewhere on that maturity curve, and the system making authorization calls in real time is a model nobody can fully interrogate?
Eliza Ward: I mean — I don't have a clean answer to that.
Brian Reed: I don't think there is one. Not yet. And I'm not sure the industry is willing to say that out loud — because saying it out loud means admitting that the label is doing more work than the framework behind it.
Eliza Ward: The direction is right. I do think that — least-privilege, continuous verification, micro-segmentation, those genuinely matter. But whether any of that adds up to something you can certify? With an AI decision layer sitting above all five of CISA's pillars and no auditability standard for it? That's... I don't know. That's the question I'm still holding.
Brian Reed: Yeah. Me too.
