George Finney, CISO at The University of Texas System and author of Project Zero Trust, asserts Zero Trust isn’t just a strategy, it’s the “only strategy when it comes to cybersecurity.”

Like all good researchers, we went straight to Reddit to see what people were really saying about Zero Trust. Turns out, a lot of teams were over it. They were tired of gatekeepers who slowed everyone down. Sure, plenty of Redditors could riff on principles like least privilege, but most were focused on what they already knew, not the bigger picture that makes Zero Trust not only work, but actually work seamlessly for teams shipping code under tight deadlines.

What Zero Trust is (and isn’t)

George sets the record straight on Zero Trust, tackling the most common misconceptions.

* Zero Trust isn’t about not trusting people. Collaboration still matters. John Kindervaag, the creator of Zero Trust, describes it as “a strategy for preventing or containing breaches by removing the trust relationships we have in digital systems.” Listen to John Kindervaag break down Zero Trust principles in 60 seconds.

* It’s not a product you can buy. There’s no one-size-fits-all architecture. Zero Trust is a strategy, not a tool. If a vendor tells you they “do Zero Trust,” the real question is: how will they integrate, secure data, and prove they’re trustworthy?

* Least privilege is the how, Zero Trust is the what. Least privilege, separation of duties, and role-based access control are just building blocks. Zero Trust is the strategy that defines the desired end state.

* The four Zero Trust design principles outlined in Project Zero Trust are simple, but powerful.

* “Define business outcomes.

* Design from the inside out. Start with data.

* Determine who or what needs access.

* Inspect and log all traffic.”

* You may already be asking “What can go wrong?” But what must go right? Security teams often use threat modeling to anticipate failures. Zero Trust requires teams to model the critical business success path: the systems, access, and safeguards that have to stay intact no matter what.

* Yes, Zero Trust can feel painful. But that’s a design problem, not a strategy problem. If Zero Trust makes one team the bottleneck for every permission request, the issue isn’t Zero Trust, it’s poor automation and governance. Good Zero Trust reduces friction.

* Zero Trust and AI are inseparable. George uses a restaurant analogy: you have ingredients (data), recipes (models), system components (kitchen equipment), and end users (diners). You need to protect the ingredients, recipes, and different parts of the system. And diners should probably be kept out of the kitchen. If you think about AI this way, George says, it can help your focus on “securing trust relationships where different systems interact.”

About George Finney

George Finney is the Chief Information Security Officer at the University of Texas System, Co-Chair of the CSO Strategic Advisory AI Safety Committee at the Cloud Security Alliance, and Founder of Well Aware Security. He is the author of multiple books, including:

* Project Zero Trust: A Story About a Strategy for Aligning Security and the Business (Cybersecurity Canon Hall of Fame winner)

* Rise of the Machines: A Project Zero Trust Story

* Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future

* No More Magic Wands

George’s books skip the jargon and focus on stories. You might just find yourself rethinking Zero Trust and how it can help your team ship faster while keeping your organization and customers safe.

Security AND ship faster? Yes, please. We built the easy button for military-grade authentication.

“You can’t measure that” is just business-speak for “we’re guessing and hoping nobody notices.”

Doug Hubbard notices. And then he brings math. The kind that turns million-dollar guesswork into real decisions, and lets software teams prove they delivered value, not just code.

And security? Also measurable. Start with defining what security means for your product (most teams miss this step!). Then get resourceful on where you get the data you need to reduce uncertainty.

* Measurement is about reducing uncertainty. One tiny drop in uncertainty can change a million-dollar decision.

* Developers love measuring speed… but speed by itself is often the least important thing. Ask questions like:

* Did it create value?

* Did it cost us more in fixes than it saved in speed?

* Should we repeat, adjust, or stop investing in this feature?

* If someone says “that’s impossible to measure,” spoiler: it’s 100% measurable. Doug says, “you already have more data than you think, and you need way less data than you assume.”

* Spend more time planning for how you will leverage AI. Doug advises, “Spend more time thinking about where AI is going and options for ways you can use it.” In fact, one of the best ways you can use AI is to brainstorm and model thousands of alternative solutions.

* Security isn’t a vibe. It’s measurable. Breach databases, vulnerability scores, and near-miss data are just a few examples of hard evidence hiding in plain sight. Doug recommends starting out with Cyentia Institute’s Information Risk Insights Study (IRIS) and Verizon’s Data Breach Investigations report.

* Simple math beats expert intuition again and again. Basic statistical models often outperform seasoned pros when choosing what to build or what to fix.

* The first step for any developer: ask “What decision will this metric change?” If the metric doesn’t change a decision, it’s just noise.

About Doug Hubbard

Doug Hubbard grew up in a small rural town, became a Captain in the Army National Guard, and went on to build a career solving one of the hardest problems in business: measuring the things everyone else says can’t be measured. He’s the inventor of Applied Information Economics, founder of Hubbard Decision Research, and the guy companies call when they need to reduce uncertainty in the most uncertain environments. Doug literally makes the immeasurable… measurable.

Doug is the author of:

* How to Measure Anything in Project Management

* How to Measure Anything: Finding the Value of Intangibles in Business

* The Failure of Risk Management: Why It’s Broken and How to Fix It

* How to Measure Anything in Cybersecurity Risk

* Pulse: The New Science of Harnessing Internet Buzz to Track Threats and Opportunities

Dread authentication setup? Not anymore. Authentication in 5 Minutes. (No seriously, we timed it.)

Think Apple and Google are doing deep security reviews of your app? Think again.

While the App Store and Google Play scan for known malware, they completely miss big security gaps like API misconfigurations and vulnerabilities in third-party tools. Mobile app security expert Andrew Hoog breaks down the top “gotcha” moments for mobile developers and the quick, actionable steps your team can take to secure your apps and protect your users.

Top three mobile security fails

* Skipping security reviews. Most teams either skip security reviews or use tools built for web apps. But web app scanners miss a whole range of mobile-specific vulnerabilities.

* Using sketchy third-party SDKs. Andrew estimates 60–70% of vulnerabilities come from free, well-documented SDKs, which are “like catnip” for developers. These can send unencrypted data, use weak keys, or leak user data to foreign entities.

* Ignoring AI risks. You, or the SDKs you rely on, might be using personally identifiable information (PII) in ways that break privacy laws, violate contracts, or erode user trust.

What you can do today

* Get the right tools. Use security tools built for mobile apps. Andrew recommends:

* Radare (open-source reverse engineering toolkit, binary and static analysis)

* Frida (open-source dynamic instrumentation toolkit)

* Both have great documentation to get you started.

* Involve your team and stakeholders. Try NowSecure’s Mobile Application Risk Checker. It reports on sensitive data, privacy declarations, and network connections. Your app might already be listed! Start including mobile app security and privacy risks in your threat intel program.

* Leverage free learning resources. Explore OWASP Mobile Application Security, NowSecure Academy, or tools like Claude for contextual security insights.

About Andrew Hoog

Andrew Hoog is a developer’s go-to security person. He’s been in the trenches of mobile security and forensics for over a decade, building, breaking, and securing apps long before it was cool.

He co-founded NowSecure, wrote two books on mobile forensics and security, and holds three patents in the field. When he’s not deep in code or court (he’s also an expert witness in U.S. Federal Courts), he’s helping shape the future of mobile app security at NowSecure.

Andrew’s mission? Help developers build apps that are not just awesome but are secure by design.

See how VIA’s Zero Trust Fabric delivers military-grade authentication.

Getting an Authorization to Operate (ATO) can be a slow and expensive hurdle for developers trying to deploy software for the government. In this episode, Dave Raley, Digital Program Manager at Marine Corps Community Services (MCCS), explains how he’s revolutionizing this process with Operation StormBreaker. Instead of a months-long process, StormBreaker provides a pre-authorized DevSecOps platform that allows mission owners and contractors to deploy their code into production in as little as 15 minutes.

By shifting from a traditional “checklist” mindset to one of continuous risk assessment, StormBreaker focuses on the ultimate goal: securely and resiliently delivering mission-critical capabilities.

Key Takeaways

* Stormbreaker is an alternative to an old checklist model. The traditional Risk Management Framework (RMF) acts like a static checklist. StormBreaker takes a more modern approach, one underscored in the recently-released Cybersecurity Risk Management Construct, and uses advanced tooling to continuously monitor the software’s actual risk posture at any given moment.

* Focus on outcomes. The most important question isn’t “Did we complete the checklist?” but rather, “Did we get a secure and resilient workload into production?” Understand the pain point before trying to build a solution.

* Contractors can’t get an ATO alone. A commercial company is always dependent on its government partner to secure an ATO.

* Ask early, ask often. Software teams should ask their mission owners right away, “What’s the plan to get this into production?” That exposes roadblocks before time and money disappear.

About Dave Raley

Ever wonder how some leaders just get it when it comes to modernizing big organizations? Then you need to meet Dave Raley, who has been with the Marine Corps as a civilian since 2010. Dave is the Digital Program Manager at Marine Corps Community Services (MCCS) and he totally transformed how Marines and their families get services.

But here’s the best part: he didn’t just manage change, he ignited it. Dave actually founded MCCS’s innovation capability and launched their whole customer experience (CX) strategy.

He pioneered something called Operation StormBreaker. Why? To cut down on software development headaches, save money, and get critical missions done faster. And get this: StormBreaker is gaining traction beyond MCCS, making secure cloud deployments scalable for services across national security.

Like this podcast episode? We’d love if you shared it!

Building software for the DoD shouldn’t be a constant battle with access. We know, because we’ve been there. We built VIA’s Zero Trust Fabric to fix all that.

Want to build software for the DoD? You won’t get better guidance than from Michael Frank, Deputy CTO, Department of the Navy, who works with entrepreneurs, non-traditional DoD contractors, and private capital to connect mission needs with commercial solutions. Mike says the best partners are adaptable and communicate relentlessly. While they might push back on “bespoke everything,” they still respect real DoD constraints. They’re fluent in risk, laying out crisp assessments of what’s accepted, what’s been mitigated, and why.

Bottom line: know the mission, know your product, and flash your risk math prowess. That’s how commercial teams win in defense.

Key takeaways:

* DoD work = hardest, most meaningful problems. The kind that attracts top talent and spins out dual-use breakthroughs.

* Use dual-use to your advantage. Navy focus areas (cyber, threat intel, AI, quantum/PQC) let you build once and win in both defense and commercial markets.

* One product, one UX. There shouldn’t be an “optimal UX for commercial” and “suboptimal UX for DoD.” Great UX should be universal.

* Speed vs. security is a choice. Understand and own it. In other words, skip controls now, pay the price later. Mike says it’s important for teams to understand “Everything we engineer, everything we build, must be secure from day one. That must be the priority.”

* Mike’s team embraces “secure by design.” Engineering and security leaders take note: bake in compliance up front and give engineers paved roads, not bolt-ons.

* Great partners adapt and communicate. Just like in any healthy, thriving relationship, they learn how to work with the government, they’re great communicators, they know how to push back (the DoD doesn’t expect “bespoke everything”) but also remain flexible and recognize there are DoD-specific constraints.

* Get fluent in risk. Conduct a risk assessment, have a deep understanding of what risks exist and what you’re doing about them. This is evidence you understand both your product and the broader mission.

About Michael Frank

Michael Frank is the Deputy Chief Technology Officer for the Department of the Navy. In addition to his role as Deputy CTO, he’s also currently Cyber Portfolio Lead for the Marine Innovation Unit as a Marine Reservist.

Mike is an expert at navigating the unique challenges of the DoD and part of his role is helping organizations work successfully with the Department of the Navy. In other words, Mike's the person you want on your team! What's especially great about Mike is his 360-degree view. He's consulted for both public and private sectors, so he truly understands the landscape. He's seen it all.

After college, Mike served for four years on active duty in the Marine Corps as a communications officer. He continued (and continues!) his service in the reserves, where he established Defensive Cyber Operations (DCO) Companies. Simultaneously, he earned his MBA and worked in consulting at Accenture and Boston Consulting Group (BCG).

At Accenture and BCG, Mike worked with various DoD organizations, consulted on cyber issues for the Department of Energy and Department of State, and advised banks, insurance companies, and healthcare companies. Basically, he's got a ton of experience understanding and solving critical problems for all sorts of organizations.

Like this podcast episode? We’d love if you shared it!

Building software for the DoD shouldn't be a constant battle with access. We know, because we've been there. We built VIA's Zero Trust Fabric to fix all that. Try it out for free at https://www.solvewithvia.com/ztf-platform/