Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Zero Trust Architecture Is Reshaping Enterprise Security
Transcript
- Lucas: So we talk a lot about breaches on this show, and usually we focus on the thing that went wrong. But I want to flip that today and talk about a framework that's supposed to stop breaches before they start. Zero trust architecture. Luna: I feel like 'zero trust' has become one of those buzzwords that gets thrown around so much it's almost lost meaning. What does it actually mean in practice? Lucas: Yeah, it's definitely a term that's been marketing-ized. But the core idea is pretty simple: never trust, always verify. Traditionally, corporate networks worked like a castle. You build a strong wall at the perimeter — firewalls, VPNs — and once you're inside, you're trusted. The problem is that attackers have gotten very good at getting inside, either through phishing or compromised credentials. And once they're in, they can move laterally because nothing inside is checking who you are. Luna: So zero trust says, treat every access request as if it's coming from an untrusted network, even if it's from inside the building. Lucas: Exactly. And that's a huge shift. It means no device, no user, no application is inherently trusted. Every single request for access has to be authenticated, authorized, and continuously validated. And it's not just about who you are — it's about the context. What device are you on? What time is it? Where are you connecting from? Is your security software up to date? Luna: That sounds like it could really slow things down. I mean, every time I want to open a file, I have to prove who I am? Lucas: That's the tension. But modern implementations are designed to be seamless for the user. The authentication happens in the background using certificates, tokens, and continuous monitoring. You don't get prompted every time. But if something looks off — like you're logging in from a new city at 3 AM — the system might block access or require step-up authentication. Luna: Okay, so give me a concrete example of where this has actually made a difference. Lucas: One of the most cited cases is the 2023 Okta breach. Okta is a major identity provider — they handle single sign-on for thousands of companies. The attackers got in through a support engineer who had logged into their personal Google account on a company laptop. From there, they were able to access Okta's internal systems. Now, if Okta had had strict zero trust controls — like microsegmentation and continuous authentication — that compromise might have been contained. Instead, the attackers had broad access because once you were on the internal network, trust was assumed. Luna: So Okta essentially got bit by the castle and moat model. Lucas: Exactly. And the irony isn't lost on anyone — a security company that got breached because of a trust model they probably advise against. Since then, Okta has publicly committed to a zero trust architecture internally. Luna: But is zero trust really a new idea? I mean, the term was coined by Forrester back in 2010, right? Lucas: The term has been around for a while, but adoption really accelerated after the SolarWinds breach in 2020 and then the Biden executive order in 2021 — which mandated zero trust for all federal agencies. That was a huge catalyst. By 2024, Gartner estimated that over 60 percent of large enterprises had either adopted or were planning to adopt zero trust principles. Luna: So it's not just a buzzword anymore — it's becoming a regulatory requirement for some. Lucas: Right. And that's driving a lot of spending. The zero trust security market was valued at around $30 billion in 2025 and is expected to grow at over 15 percent compound annual growth rate for the next few years. Luna: Who are the big players? Are we talking about CrowdStrike, Palo Alto Networks, that crowd? Lucas: Those are definitely in the mix, but the zero trust stack includes a lot of different categories. You have identity-centric players like Okta and Microsoft with Azure AD. Then you have network segmentation vendors like Illumio, and secure access service edge — or SASE — providers like Zscaler and Cloudflare. And then there's the endpoint detection side with CrowdStrike. The point is, zero trust is not a single product. It's a framework that requires coordination across multiple layers. Luna: So if I'm a CISO at a mid-size company, where do I even start? Lucas: Most experts recommend starting with identity. You need to know who your users are and what they should have access to. Then you map out the data flows and apply the principle of least privilege — give users only the access they need to do their job and nothing more. Then you implement microsegmentation, which divides the network into small zones so that even if an attacker gets into one zone, they can't move laterally. Luna: And that's a huge lift for companies that have been running traditional networks for decades. Lucas: It is. And that's why adoption has been slower than the hype suggests. A lot of companies are still in the pilot phase. The Department of Defense, for example, has been working on their zero trust implementation since 2022 and they're still not fully there. It's a multi-year journey. Luna: Is there a risk of vendor lock-in? If you buy into one vendor's zero trust ecosystem, are you stuck? Lucas: That's a real concern. Some vendors offer a 'zero trust platform' that essentially locks you into their stack. But the better approach is to adopt open standards like those from the National Institute of Standards and Technology, or NIST. Their zero trust architecture framework provides a reference model that allows you to mix and match best of breed solutions. Luna: So it's about architecture, not products. Lucas: Exactly. And that's a hard sell internally because it requires organizational change, not just a check to a vendor. You need buy-in from IT, from the business units, from executive leadership. And the ROI is not always obvious until after a breach — or a near miss. Luna: I've also heard that zero trust can actually improve user experience in some cases. How? Lucas: Because it enables secure remote access without needing a clunky VPN. With a zero trust approach, you can connect users directly to the specific applications they need, without putting them on the corporate network. That means faster connections, less friction. And it works better for cloud applications, which most companies are already using. Luna: So the move to remote work has actually been a tailwind for zero trust adoption. Lucas: Absolutely. The pandemic forced companies to support a distributed workforce, and the old VPN model couldn't scale. Many organizations realized they needed a more granular, identity-based approach. That's when zero trust went from a nice to have to a must-have. Luna: Let's talk about the cost. Is zero trust only for big enterprises with deep pockets? Lucas: It's not cheap, but the cost has come down. A lot of the technology is now available as a service — you pay per user per month. For a mid-size company, you might be looking at $10 to $20 per user per month for a basic zero trust access solution. But the real cost is in the professional services — the architecture design, the policy mapping, the integration work. That can run into the hundreds of thousands. Luna: So the barrier is more expertise than technology. Lucas: Exactly. And that's where managed security service providers come in. They offer zero trust implementation as a service. So even a smaller company can get started without hiring a full-time security architect. Luna: What about the argument that zero trust is just a marketing term? Some critics say it's basically just good security hygiene. Lucas: There's some truth to that. The principles of least privilege and segmentation aren't new. But the difference is the scale and the enforcement. In the past, you might have had a written policy that said 'only HR can access payroll data.' But there was no technical control preventing a salesperson from accessing it if they knew the file path. Zero trust makes that policy enforceable at the network level. It's about moving from a trust but verify model to a never trust always verify model. Luna: And that's a fundamental shift in mindset. Lucas: It is. And it's not without its challenges. One of the biggest is alert fatigue. When you're constantly verifying, you generate a lot of data. You need a good SIEM system to analyze that data and surface real threats. Otherwise, you're just drowning in logs. Luna: So what's the future? Do we eventually reach a point where zero trust is just how things are done? Lucas: I think so. In five to ten years, the castle and moat model will be seen as archaic, like using a single password for everything. We're already seeing that with cloud-native companies — they're born with zero trust because they don't have a legacy network to protect. For the rest of us, it's a journey. But the direction is clear. Luna: And it's a journey that has a lot of companies spending a lot of money. Sounds like a good business to be in. Lucas: It is. And we'll be watching to see which vendors can deliver on the promise without just rebranding their old products. That's the real test.