Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / The Zero Trust Lie In Modern Enterprise Security
Transcript
- Lucas: I have been looking at the latest reports from the Identity Security Consortium for the third quarter of twenty twenty six, and there is one number that keeps me up at night. It is not the total dollar value of losses, which is already staggering, but the percentage of breaches that originated from compromised credentials. Lucas: It is sitting at seventy three percent. Seventy three percent of all successful intrusions this year started with a stolen password, a reused credential, or an MFA bypass. And here is the kicker: almost all of those companies had zero trust architecture deployed on paper. Luna: So they bought the license, installed the software, and still got walked right through the front door because someone clicked a link last Tuesday? That sounds less like a technology problem and more like a process collapse. Lucas: Exactly. The issue is that most CISOs are treating zero trust as a product purchase rather than a fundamental rewiring of how identity works. They are putting up digital fences around specific applications while leaving the underlying identity fabric wide open. It is like building a fortress around a single room while ignoring the fact that the key to the entire house is under the mat. Luna: But isn't the vendor argument always that these platforms unify visibility? If you can see everything, you can secure everything, right? Lucas: Visibility is not control. That is the trap. You can have perfect visibility into every login attempt across your global workforce and still fail to enforce least privilege. I spoke with a security director at a mid-sized logistics firm last week. They had spent four million dollars on a unified identity platform. They could see who logged in, from where, and on what device. Lucas: But when I asked them how many employees had admin rights to their core ERP system, he paused for a long time. Then he said, 'About forty percent.' Forty percent of the staff has the keys to the kingdom. That is not zero trust. That is zero vigilance with expensive monitoring tools. Luna: Forty percent seems absurdly high for operational necessity. Do they really need full admin access to run daily invoices or check inventory levels? Lucas: No, they do not. But IT teams are terrified of breaking workflows. So they grant broad permissions upfront and then try to police it afterward with alerts. By the time an alert fires, the attacker has already moved laterally. The defense is reactive, but the offense is immediate. This is why we see such massive ransomware payouts now. The initial compromise is trivial. Luna: So the real bottleneck is cultural resistance from IT ops who just want things to work, even if it means lowering the security bar? Lucas: Precisely. And it gets worse because leadership treats this as an IT ticket rather than a business risk. When you ask the CFO why they approved that budget for identity governance without asking about the reduction in actual risk exposure, they shrug. They think they are buying insurance. But it is not insurance. It is just a very expensive ledger of failures waiting to happen. Luna: That is a brutal way to put it. But if visibility isn't enough, what actually stops the lateral movement once that first credential is used? Lucas: Micro-segmentation driven by behavior, not just roles. Most companies segment by department. Finance talks to finance. HR talks to HR. But attackers don't care about your org chart. They care about data flow. A legitimate finance user should only be able to access financial records, nothing else. If that same user starts querying the engineering database, the system should block it instantly, not after a SOC analyst reviews a log file three hours later. Luna: Real-time blocking based on anomalous behavior rather than static role definitions. That requires a huge shift in how you configure those identity providers. Lucas: It does. And most vendors sell you the static part easily. The dynamic part is hard. It requires continuous authentication. Not just checking your password at login, but constantly verifying your context. Where are you logging in from? Is your device behaving normally? Are you accessing files at unusual times? If any of those signals drift, you get challenged or blocked. Luna: Continuous authentication sounds like it would drive employee productivity through the floor with all the friction. Lucas: Only if implemented poorly. The trick is invisible verification. Biometrics, behavioral analysis, device posture checks happening in the background. The user should rarely feel anything other than a slight delay if something looks wrong. But right now, most enterprises are stuck in step-one zero trust. They require multi-factor authentication for everything, but they still give everyone admin rights. That is like requiring a keycard to enter the building but handing out master keys to everyone anyway. Luna: I keep hearing about 'just-in-time' access as the solution here. Is that actually being adopted at scale, or is it still just buzzword bingo? Lucas: It is moving, but slowly. Just-in-time access means you don't have standing privileges. You request access, it is granted for a two-hour window, and then it revokes automatically. No permanent seats. No dormant accounts holding onto old permissions. It forces discipline. But it requires workflow automation that most legacy IT departments simply do not have. Luna: So the gap is not just technology, it is the absence of automated workflows to support the tighter controls? Lucas: Absolutely. You cannot implement zero trust on top of manual approval processes. If an engineer needs temporary access to fix a server, and they have to email a manager, wait for a reply, get a code, and then apply for the token, nobody will use it. They will just share passwords or find a workaround. Security becomes a speed bump instead of a guardrail. Luna: Right, so if it slows down work too much, people will bypass it. You have to make the secure path the easiest path. Lucas: Exactly. The best zero trust implementation feels like magic to the user. They log in, they work, and the system knows exactly who they are and what they need without constant interruptions. But behind the scenes, it is aggressively validating every action. It is a paradox. High security requires low friction. Which means you need incredibly sophisticated backend logic. Luna: And that sophistication costs money. We talked earlier about the budget traps. Are companies willing to pay for that level of backend complexity, or are they still looking for cheap point solutions? Lucas: They are looking for cheap solutions, which is why the market is flooded with fragmented tools. One tool for endpoint detection, another for cloud access, a third for identity governance. None of them talk to each other effectively. You end up with blind spots everywhere. The cost of managing five different security consoles is often higher than the cost of integrating a few robust ones, but the perceived upfront price tag is lower. Luna: So you save ten thousand dollars today and spend a hundred thousand dollars next year cleaning up the integration mess and fixing the breaches. Lucas: Something like that. And the insurance carriers are starting to notice. We are seeing premium hikes for companies that cannot demonstrate granular access controls. Insurers are demanding proof that you are actually using least privilege, not just claiming you are. If you cannot show them the logs proving that admin rights are revoked automatically, they assume you are lying. Luna: That changes the calculus completely. It stops being an IT debate and becomes a finance negotiation. If your cyber insurance rates go up because your security posture is vague, that hits the bottom line directly. Lucas: It does. And it forces the C-suite to take ownership. You can no longer hide behind 'we have a firewall.' The insurers are asking for evidence of identity hygiene. This is good pressure. It forces clarity. But it also exposes the lazy implementations. Companies that built their security on layers of guesswork are suddenly exposed. Luna: So what is the first concrete step a company should take if they realize they are stuck in this middle ground? Do they rip out everything? Lucas: No, never rip out everything. Start with the admins. Identify every single account with elevated privileges. Review them monthly. Revoke any that haven't been used in ninety days. Enforce just-in-time access for the rest. It is a boring, unglamorous task. But it cuts the attack surface by half overnight. You do not need AI or blockchain to start. You need discipline. Luna: Discipline over dazzle. I like that. It sounds like the industry has been selling us magic wands when we needed brooms. Lucas: Well said. Magic wands are fun to demo. Brooms are hard work. But the broom is what actually cleans the house before the burglar arrives. And in cybersecurity, the burglar is usually already inside, waiting for you to leave a door open. Luna: If these conversations are useful for what you're building or running, please consider supporting the show directly. We deliberately don't run ads on these episodes to keep the focus tight and independent. If you want to help sustain that model, the link is buy me a coffee dot com slash fexingo — that's F. E. X. I. N. G. O. Lucas: Yeah, and Luna is right. It keeps the signal clear. Without that listener support, we would have to chase clicks or sponsors, and we want to stay focused on the actual mechanics of how this stuff works. Luna: Thanks for keeping the conversation honest. Now back to the technical side of things. Lucas: Let's talk about measurement. How do you know if your zero trust efforts are actually working? Most dashboards show you compliance percentages. 'Ninety percent of devices are patched.' 'Eighty percent of users have MFA enabled.' Those are vanity metrics. Luna: Because compliance doesn't mean safety. A company can be fully compliant and still get breached if the design is flawed. Lucas: Correct. You need to measure risk reduction, not compliance adherence. Look at your mean time to detect lateral movement. Look at the number of privileged accounts active per day. Look at the frequency of unauthorized access attempts that were successfully blocked. These are leading indicators. Compliance is a lagging indicator. It tells you what happened yesterday. Risk metrics tell you what might happen tomorrow. Luna: So shift the reporting from 'we followed the rules' to 'we stopped the threats.' That is a completely different narrative for the board. Lucas: It is. And it aligns security with business outcomes. The board does not care about your patching cadence. They care about whether your revenue systems are safe. If you can show them that your identity controls have reduced the potential impact of a breach by eighty percent, that is a metric they understand. It ties security directly to asset protection. Luna: Which makes the investment case much easier to justify. It moves from cost center to value preservation. Lucas: Exactly. Once you frame it that way, the conversation changes. It stops being about buying more tools and starts being about building better resilience. And that is where the real work begins. It is not easy. It requires constant tuning, constant review, and constant vigilance. But it is the only way to stay ahead of attackers who are constantly evolving. Luna: So the lesson is: stop chasing the perfect zero trust label and start enforcing strict, automated least privilege today. Lucas: Start today. The attackers are not waiting for your perfect architecture. They are exploiting the gaps in your current reality. Close the gaps. Make the identity fabric tight. And measure your progress by how much harder you make it for them to move. Luna: Tighten the fabric, measure the friction for the bad guys. Simple advice, but hard to execute consistently. Lucas: Harder than it sounds. Because it goes against human nature to restrict access. We like sharing. We like convenience. But in cybersecurity, convenience is often the enemy of survival. The question for every leader this week is: how convenient is your security, and how dangerous is that convenience?