• Host: Zach Pugh (LinkedIn)
• Co-Host Victor Monga (LinkedIn)
• Guest Jason Garbis (LinkedIn)

Highlights:

• Practical Zero Trust Implementation: Jason emphasizes the importance of adopting a realistic, incremental approach to Zero Trust, urging organizations to leverage existing capabilities before investing in new technologies.
• Introducing ZTMM+: Discover Jason’s enhancement of the CISA Zero Trust Maturity Model, designed to provide clearer definitions, practical guidance, and address critical gaps like secure internet access and data loss prevention.
• Simplifying Complexity: Learn how the ZTMM+ framework translates complex Zero Trust maturity assessments into straightforward, actionable questions, promoting collaboration across IT, security, and business teams.
• Avoiding Vendor Hype: Jason debunks vendor-driven myths and clarifies that no product is inherently "Zero Trust Certified," reinforcing the importance of strategic integration over reliance on vendor solutions.
• Secure Internet and DLP Strategies: Get insights into why comprehensive secure internet access controls and robust data loss prevention (DLP) strategies are essential yet often overlooked in standard maturity models.

Key Takeaways:

• Start with Practical Steps: Begin your Zero Trust journey by tightening policies around critical business assets, leveraging current technologies, and incrementally building your capabilities.
• ZTMM+ as an Actionable Tool: Use the enhanced maturity model (ZTMM+) to objectively measure your organization's true Zero Trust maturity and identify realistic improvement areas without overwhelming complexity.
• Vendor Realities: Recognize that true Zero Trust maturity involves strategic orchestration across existing processes and tools rather than dependency on a single vendor’s solution.
• Business-Focused Security: Zero Trust initiatives succeed when security leaders deeply align security improvements with clear, direct business benefits—supporting innovation, compliance, and strategic business expansions.
• Collaboration is Essential: Cross-functional collaboration between security teams, IT, and business stakeholders is critical for identifying real-world security gaps and practical, impactful solutions.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – March 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:

• https://www.defense.gov/News/News-Stories/Article/Article/4078717/zero-trust-architecture-could-prevent-adversary-data-theft-protect-warfighters/
• https://www.meritalk.com/articles/dods-ot-zero-trust-strategy-under-review-expected-by-august/
• https://defensescoop.com/2025/03/11/army-unified-network-plan-2-0-data-zero-trust/
• https://defensescoop.com/2025/02/19/navy-zero-trust-controls-ot-weapon-systems-platforms/
• https://statescoop.com/convincing-users-key-for-zero-trust-rollouts-ciso-says/
• https://www.rcrwireless.com/20250312/security/verizon-zero-trust-security
• https://www.scworld.com/resource/breaking-with-tradition-at-zero-trust-world-2025
• https://www.scworld.com/brief/strengthening-cloud-security-with-ai-driven-threat-detection-zero-trust

👉 Learn more at: ztjourney.com

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

Host
Steve Turner (Linkedin)

Co-Host
Zach Pugh (LinkedIn)

Guest
Chase Cunningham, also known as Dr. Zero Trust (Linkedin)

Highlights:

• No Zero Trust Certified Product: Chase debunks the myth of a one-size-fits-all, certified solution—exposing vendor hype and unrealistic promises.
• Red Teaming as the Foundation: Learn why actionable red team assessments are critical for uncovering vulnerabilities and accelerating your security journey.
• Simplifying Micro Segmentation: Discover how modern policy engines and ZTNA are transforming a once complex concept into practical, scalable security measures.
• Small Business Cybersecurity: Understand why every organization—regardless of size—is a target, and explore budget-friendly, high-impact strategies.
• Portfolio Over Platform: Explore the benefits of integrated, API-enabled best-of-breed solutions versus monolithic vendor platforms.

Key Takeaways:

• Operational Over Compliance: A real Zero Trust strategy focuses on continuous, threat-based validation rather than merely ticking compliance checklists.
• Red Teaming Delivers ROI: Proactive testing and real-world assessments not only expose gaps but can also recover budgets tied up in redundant security solutions.
• Practical Strategies for Every Business: From centralized identity management to optimized asset inventories, start small and build a resilient security posture over time.
• Debunking Vendor Myths: With no certified Zero Trust product on the market, focus on proven operational tactics rather than buzzwords.
• Cyber Warfare Awareness: Recognize that in today’s digital battlefield, every asset—from your enterprise network to IoT devices—is valuable to adversaries, making proactive defense a must.

Dive into this unfiltered conversation with Chase Cunningham to get real-world insights and actionable strategies that cut through industry buzz and prepare you for the realities of cyber warfare.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

Host
Zach Pugh (https://www.linkedin.com/in/zachary-pugh/)

Co-Host
Victor Monga (https://www.linkedin.com/in/victorvirtual/)

Guest
Drinor Selmanaj (https://www.linkedin.com/in/drinor-selmanaj-5bb28185/)

Highlights:

• Vulnerable vs. Exploitable: Distinguishing between a known vulnerability and a realistic exploitation path is essential for smart security decisions.
• Return on Effort: Focus on the security measures that provide the greatest risk reduction for the time and resources invested.
• Continuous Validation: Embrace adversary emulation, red-teaming, and regular testing to ensure your Zero Trust controls remain effective against evolving threats.
• Reducing Reachability: Minimize network, credential, and device reachability to cut down attackers’ lateral movement and protect critical assets.
• Practical Zero Trust Framework: Break down Zero Trust into manageable steps—start with asset inventories, least-privilege policies, and ongoing security education.

Key Takeaways:

• Zero Trust Is a Journey: It’s not a one-time project. Continuous assessment and adaptation are vital to keep pace with evolving threats.
• Define Your Own Zero Trust: There is no official Zero Trust certification, so each organization must clarify what Zero Trust means in the context of its unique business objectives.
• Continuous Security Validation: Regular testing (e.g., adversary emulation, red teaming) is key to security maturity and helps ensure Zero Trust controls work as intended.
• Adapt to Emerging Threats & AI: As attackers’ methods evolve—particularly with AI—organizations must keep refining and updating their Zero Trust strategies.
• Practical Application Matters: Beyond theory, Zero Trust relies on hands-on experience, clear asset inventories, and least-privilege principles to minimize the attack surface.
• Education & Culture: A security-first mindset, leadership support, and team-wide training are essential for successful Zero Trust adoption at scale.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, host Zach Pugh talks with Nemi George, an experienced information security executive, about the practical realities of implementing Zero Trust in a busy organization—especially where patient care and time-sensitive workflows collide with security needs. Nemi shares real-world strategies for starting small with critical assets, streamlining multi-factor authentication, and addressing legacy systems without disrupting business operations. The discussion underscores how Zero Trust should enable the organization by prioritizing user experience, cultural alignment, and clear leadership support.

Highlights

• Balancing Security & User Experience: Why understanding workflows—especially in clinical settings—is crucial to successful Zero Trust.
• Starting Small, Thinking Big: How focusing on critical data and systems first can reduce complexity and risk.
• Adaptive Authentication & MFA: Strategies for right-sizing multifactor requirements without bringing business to a halt.
• Zero Standing Privileges: Using just-in-time access and least privilege principles to lock down user accounts.
• Legacy Systems & Micro-Segmentation: Practical ways to incorporate older or specialized devices into a modern Zero Trust framework.

Key Takeaways

• Know Your Assets: Accurate asset inventory is the foundation of any effective security program.
• User-Centric Security: Security should align with user workflows, minimizing friction while maintaining strong protections.
• Leadership Buy-In: Zero Trust initiatives are more successful when presented as business enablers rather than “controls.”
• Passwordless Future?: Long passphrases, biometrics, and context-based access can reduce both risk and user frustration.
• Culture & Technology: Zero Trust is a shift in mindset, not just a collection of tools—successful adoption requires both process optimization and stakeholder engagement.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, host Victor Monga is joined by Snehal Antani, CEO and co-founder of Horizon3.ai, to break down the complexities of Zero Trust and the practical steps organizations can take to reduce network reachability and minimize the blast radius of cyberattacks. Snehal shares insights from his career spanning Fortune 500 companies, the Department of Defense, and his current role as a cybersecurity innovator, emphasizing the importance of continuous security validation and understanding the difference between vulnerable and exploitable systems.

Snehal offers actionable advice on how to prioritize security efforts based on return on effort (ROE) and how organizations can shift their focus from simply buying tools to adopting methodical, measurable approaches to risk reduction. Whether you're starting your Zero Trust journey or refining your strategy, this episode delivers real-world lessons to help you build a resilient security program.

What You’ll Learn in This Episode:

• Vulnerable vs. Exploitable: Why understanding this difference is crucial for smart security decisions.
• Reducing Reachability: How limiting network, credential, and device reachability minimizes risk.
• Return on Effort (ROE): Prioritizing high-impact actions that deliver maximum risk reduction with minimal effort.
• Continuous Security Validation: Why regular pen testing is vital to understanding your exploitable attack surface.
• Zero Trust as an Evolution: How Zero Trust is an evolution of existing security practices—not a product or one-size-fits-all solution.

Key Takeaways:

• Start with Reachability: Focus on reducing network, credential, and device reachability as a foundation for Zero Trust.
• Continuous Validation Matters: Regular testing ensures your controls are effective over time.
• Prioritize High-Impact Fixes: Maximize your return on effort by focusing on what reduces the most risk with the least effort.
• Cultural Shifts Are Critical: Successful Zero Trust requires aligning technology, processes, and people.
• Measure and Evolve: Zero Trust is a continuous journey—track progress and adapt as needed.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – February 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:
--| https://executivegov.com/2024/12/nist-zero-trust-architecture-guidance-feedback/
--| https://securityboulevard.com/2024/12/making-zero-trust-architecture-achievable/
--| https://www.itpro.com/cloud/cloud-security/understanding-nis2-directives-the-role-of-sase-and-zero-trust
--| https://www.globenewswire.com/news-release/2024/12/05/2992083/0/en/Zscaler-Finds-Over-87-of-Cyberthreats-Hide-in-Encrypted-Traffic-Reinforcing-Need-For-Zero-Trust.html
--| https://www.zscaler.com/resources/industry-reports/threatlabz-encrypted-attacks-report.pdf
--| https://www.arnnet.com.au/article/3617743/home-affairs-opens-consultation-on-zero-trust-principles.html
--| https://federalnewsnetwork.com/cme-event/federal-executive-forum/dec-federal-executive-forum-zero-trust-strategies-in-government-progress-and-best-practices-2024/
--| https://www.microsoft.com/en-us/security/blog/2024/11/11/dod-zero-trust-strategy-proves-security-benchmark-years-ahead-of-schedule-with-microsoft-collaboration/
--| https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/outsourcing-and-procurement/cyber-supply-chains/choosing-secure-and-verifiable-technologies

👉 Learn more at: ztjourney.com

Disclaimer
The views and opinions expressed in this episode are those of the speakers and do not necessarily reflect the official policy or position of any affiliated organization. This content is provided for informational purposes only.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, hosts Victor Monga and Steve are joined by Zach Pugh, a seasoned cybersecurity product manager, to explore why government agencies are leading the charge on Zero Trust initiatives—and how the private sector can catch up. They delve into overcoming cultural resistance, dissecting vendor myths, and understanding why even the humble web browser deserves a serious seat at the Zero Trust table.

Zach shares tactical advice from his hands-on experience, emphasizing how organizations can start small, focus on business goals, and avoid the common pitfalls of “one-size-fits-all” vendor solutions. Whether you’re mapping out your first Zero Trust strategy or fine-tuning an existing program, this conversation provides practical insights to help you succeed in today’s dynamic threat landscape.

What You’ll Learn in This Episode

• Government First? Why federal agencies adopted Zero Trust faster than many private organizations—and what we can learn from them.
• Vendor Myths vs. Reality: Spotting red flags and ensuring your Zero Trust strategy isn’t hijacked by product pitches.
• Cultural Buy-In: How to articulate Zero Trust’s value to non-technical stakeholders and overcome resistance to change.
• Browser as an Asset: Why ignoring browser security can undermine your entire Zero Trust posture.
• Continuous Evolution: Understanding that Zero Trust is an ongoing journey, not a one-time implementation.

Key Takeaways

• Business Alignment: Start with executive buy-in and align Zero Trust initiatives to broader organizational goals.
• Practical Progress: Small, well-defined protect surfaces are easier to secure, test, and iterate on.
• Realistic Expectations: No single product can deliver Zero Trust—prioritize people, processes, and technology in tandem.
• Ongoing Validation: Regularly revisit your Zero Trust framework to adapt to evolving threats and changes in your environment.

Whether you’re a security leader or just beginning your Zero Trust journey, this episode provides practical insights to strengthen your strategy, reduce risk, and gain buy-in across your organization.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, hosts Victor Monga and Zach Pugh sit down with Jose Barajas, Vice President of Global Sales Engineering at AttackIQ to explore what it truly takes to implement and sustain Zero Trust security beyond the buzzwords.

Jose shares first-hand insights from years of helping organizations validate their security controls, revealing the biggest misconceptions, common pitfalls, and the real challenges that teams face when moving Zero Trust from theory to practice. From breaking down resistance to change to securing executive buy-in, this episode delivers practical strategies for making Zero Trust work—no matter where you are in the journey.

What You’ll Learn in This Episode:

✔ The Validation Gap – Why 90% of organizations assume their Zero Trust controls work, but nearly half fail security testing.
✔ Beyond Compliance – How Zero Trust is a security strategy, not just a checkbox for regulations.
✔ Breaking Cultural Barriers – Overcoming resistance from teams who feel “Zero Trust means you don’t trust them.”
✔ Securing Executive Buy-In – “I've gotta find a way to position Zero Trust as a revenue driver or at least to offset the protection of assets in the business.”
✔ The Role of Continuous Testing – Why Zero Trust isn’t a one-and-done initiative, but an evolving process requiring ongoing validation.

Victor and Zach dive into real-world Zero Trust adoption stories, exposing the biggest roadblocks organizations face—including why many Zero Trust projects fail before they start. Jose shares actionable ways to validate security controls, iterate on implementations, and gain leadership support to drive Zero Trust forward.

Key Takeaways:

🔹 Zero Trust isn’t complicated—it’s just hard. Cultural shifts and executive mandates are critical for success.
🔹 Validation matters—if you don’t test security controls regularly, they likely aren’t working as intended.
🔹 Zero Trust isn’t about mistrust—it’s about verifying digital actions, not distrusting employees.
🔹 Align Zero Trust with business goals—position it as a risk-reducing, revenue-protecting strategy to gain leadership support.
🔹 Start small, iterate, and automate—Zero Trust isn’t all or nothing, it’s a process of continuous improvement.

Whether you’re a security leader or just beginning your Zero Trust journey, this episode provides practical insights to strengthen your strategy, reduce risk, and gain buy-in across your organization.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, hosts Victor Monga and Steve Turner are joined by Zero Trust experts from Microsoft Clay Taylor and Tarek Dawoud to discuss how Zero Trust strategies can secure today’s expansive digital estates. They share insights from Microsoft’s Zero Trust Workshop and their collaboration with NIST, offering a practical guide for navigating the challenges of implementation.

Clay and Tarek reveal how organizations can move from overwhelmed to action-ready by breaking down silos, aligning teams, and leveraging practical tools. They emphasize that Zero Trust is not a product or a one-time fix—it’s a continuous journey of strengthening security and enabling business outcomes.

What You’ll Learn in This Episode:

• Securing your digital estate: How to protect identities, apps, devices, and data in an increasingly complex environment.
• Breaking silos for success: Aligning identity, device, and application teams for cohesive Zero Trust strategies.
• Insights from NIST collaboration: Lessons from Microsoft’s contribution to the industry-standard Zero Trust reference architecture.
• Practical workshop tools: How Microsoft’s Zero Trust Workshop simplifies implementation and tracks progress.
• Balancing security with user experience: Implementing robust security controls without disrupting productivity.

Victor and Steve dive into the real-world obstacles organizations face, from navigating vendor hype to addressing misconceptions about Zero Trust. Clay and Tarek share how the pandemic accelerated adoption, why federal government initiatives are leading the charge, and how to overcome internal barriers to Zero Trust success.

Key Takeaways:

• Zero Trust is about building on your current investments, not starting from scratch.
• Practical tools like Microsoft’s Zero Trust Workshop can simplify deployment and help organizations track progress over time.
• Collaboration is essential—breaking silos across teams ensures a unified approach to security.
• Effective Zero Trust frameworks enhance security while enabling seamless business operations.

Whether you’re a security leader or new to Zero Trust, this episode offers actionable advice to strengthen your strategy, reduce risk, and navigate the complexities of today’s cybersecurity landscape.

Stay connected with Zero Trust Journey! Follow us on LinkedIn, subscribe on YouTube, and visit our website for exclusive content and resources to help advance your Zero Trust journey.

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.