Host: Dr. Victor Monga (https://www.linkedin.com/in/victorvirtual)
Co-Host: Zach Pugh (https://www.linkedin.com/in/zachary-pugh)
Co-Host: Steve Turner (https://www.linkedin.com/in/beingageek)

What You'll Learn:

• The SMB Target on Your Back: Why believing you are "too small to be targeted" is a fatal error, and why cybercriminals actively hunt for SMBs with weak defenses.
• Zero Trust on a Budget: How to implement Zero Trust principles—focusing on identity and context rather than just technology—without needing a massive security team or budget.
• The First Line of Defense: Why Multi-Factor Authentication (MFA) is the non-negotiable first step for any SMB looking to secure their infrastructure.
• Compliance vs. Security: Understanding why compliance is just a baseline, and how Zero Trust helps you meet standards while actually securing your assets.
• Asset Visibility: Why you cannot secure what you don't know you have, and the importance of managing assets to prevent devastating financial loss.
• This episode is a must-listen for SMB owners, IT generalists, and security practitioners looking to build a resilient security posture that protects against the devastating costs of a data breach.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – Oct 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:
--| https://www.cio.gov/zero-trust-data-security-guide-may2025/
--| https://www.meritalk.com/articles/pentagon-to-release-updated-zero-trust-strategy-by-end-of-year/
--| https://govciomedia.com/federal-zero-trust-forum/
--| https://www.cisa.gov/topics/cybersecurity-best-practices/zero-trust
--| https://www.securityweek.com/socure-acquires-risk-decisioning-company-effectiv-for-136m/
--| https://news.sophos.com/en-us/2024/10/21/sophos-to-acquire-secureworks-to-accelerate-cybersecurity-services-and-technology-for-organizations-worldwide/
--| https://therecord.media/pokemon-video-game-developer-game-freak-confirms-data-breach
--| https://thehackernews.com/2024/10/cloudflare-thwarts-largest-ever-38-tbps.html

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Guest: James Plouffe (https://www.linkedin.com/in/jamesplouffe)
Host: Dr. Victor Monga (https://www.linkedin.com/in/victorvirtual)

In this essential episode, host Dr. Victor Monga sits down with James Plouffe, Principal Analyst at Forrester, to tackle the bold claim that "Zero Trust without testing is a lie."

James, who also served as a Technical Consultant on the hit TV show Mr. Robot, shares his expert perspective on why security leaders are experiencing Zero Trust fatigue and how they can prove their progress.

What You'll Learn:

• Zero Trust is a Journey, Not a Destination: Why viewing Zero Trust as a project you can "finish" is fundamentally flawed.
• The Critical Gap: Why continuous security validation and testing controls are the single most important factors in a Zero Trust strategy.
• Operationalizing MITRE ATT&CK: How to shift away from old audit checklists and use frameworks like MITRE ATT&CK to create demonstrable proof of your defenses.
• Overcoming the "People Problem": Strategies for getting buy-in from long-time employees and successfully implementing controls like micro-segmentation without causing friction.
• The Biggest Win for Least Lift: Where security leaders should invest their resources first to achieve the highest impact (Hint: It’s all about Identity and MFA).
• Hacking Hollywood: James shares his experiences ensuring technical accuracy on the set of Mr. Robot and meeting actor Rami Malek.
  
  

This episode is a must-listen for CISOs and security practitioners looking to move beyond theory and build a tangible, well-tested, and effective Zero Trust architecture.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

00:00 Introduction to SMB Cybersecurity Challenges
02:43 The Importance of Securing SMBs
05:32 Lack of In-House Expertise in SMBs
08:23 The Cybersecurity Buying Journey for SMBs
11:15 Decision-Making in Cybersecurity Purchases
14:18 Cost of Inaction vs. Cost of Protection
17:03 The Role of AI in Cybersecurity for SMBs
20:06 Advice for SMB Leaders on Cybersecurity Investments

Guest: Ken Yao (https://www.linkedin.com/in/kennethyao)
Guest: Martin Rivera Neuhaus (https://www.linkedin.com/in/martinriveran)
Host: Dr. Victor Monga (https://www.linkedin.com/in/victorvirtual)

Protect Your Business and Your Partners! Small and Medium Businesses (SMBs) make up 99.9% of US businesses, but 60% lack a dedicated cybersecurity expert. This leaves them vulnerable—and makes them a massive weak link in the global supply chain.

In this vital episode of the Zero Trust Journey podcast, Dr. Victor Monga is joined by Martin Rivera, CEO of Enstall Technologies, and Ken Yao, CEO of Cybers, to discuss the unique challenges SMBs face when trying to buy, implement, and manage cybersecurity solutions.

This is a must-listen for every SMB owner, CEO, or business leader who handles sensitive data or is part of a larger supply chain. Learn how to make smart, pragmatic security investments even without an in-house CISO.

Highlights:
--| The Cost of Inaction: Why getting breached is often a death sentence for an SMB, contrasted with the recovery resources available to large enterprises. 
--| Minimal Viable Security: How SMBs can determine their "good enough" security posture and make strategic bets to stay ahead of threat actors. 
--| The Buying Lifecycle: Who is the decision-maker for security at a small company (CEO vs. CFO/CTO) and the 5 key factors that drive their purchasing decisions (cost, functionality, UX, compatibility, and support). 
--| The CISO Communication Gap: Why technical leaders often fail to secure budget from the CEO, and how to quantify risk in simple business terms (e.g., millions in lost revenue) to get buy-in. 
--| The AI Promise: How AI-driven tools can potentially bridge the massive skill gap and help non-IT trained staff manage complex security tools.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode, we dive deep into the organizational and cultural roadblocks of Zero Trust with Mark Simos, Lead Cybersecurity Architect at Microsoft. Mark, a veteran who has spent over 25 years helping enterprises operationalize security, reveals why failure in Zero Trust often stems not from technical missteps, but from a fundamental misunderstanding of roles, responsibilities, and business incentives. He shares the journey of evolving from a technical expert to a "storyteller" and how that shift is essential for CISOs today.

Guest: Mark Simos (https://www.linkedin.com/in/marksimos)
Host: Dr. Victor Monga (https://www.linkedin.com/in/victorvirtual)
Co-Host: Dr. Victor Monga (https://www.linkedin.com/in/beingageek)

Mentioned Resources:

• Mark Simos on LinkedIn: https://www.linkedin.com/posts/marksimos_security-doesnt-get-better-until-we-correct-activity-7376623700508418048-yEDF?utm_source=share&utm_medium=member_desktop&rcm=ACoAABKQrw8BhNT_WGckKwwZ1zNfi6UkyFkMpZU
• The Open Group Security Roles and Responsibilities Standard: https://www.opengroup.org/open-group-july-virtual-event-explore-open-digital-standards-across-industries
• Microsoft Cybersecurity Reference Architecture (MCRA): https://learn.microsoft.com/en-us/security/adoption/mcra

Highlights:
--| The Two Broken Assumptions: How Zero Trust changes the assumption that the firewall is enough, and—crucially—that security is only the security team's job.
--| The CISO's Trap: Why technical CISOs often fail and get rotated out when they talk "speeds and feeds" instead of connecting security to business risk and outcomes.
--| Accountability vs. Blame: The critical difference leaders must understand to stop the cycle of finger-pointing and achieve real change.
--| The Microsoft SFI Example: How linking executive pay and incentive structures to security metrics drives cultural change across the organization.
--| The Role of the Storyteller: Mark's realization that communicating complex technology requires narrative skills to land concepts with business leaders.
--| The Future of Jobs: How AI will augment and change tasks, but the fundamental jobs to be done in security (and the need for human expertise) will remain.
--| One Key Piece of Advice: The single most important thing a CISO or architect can do to modernize their org structure around Zero Trust.

This episode is a must-listen for anyone struggling to move their Zero Trust initiative beyond the technical implementation phase. Mark provides a clear roadmap for embedding security accountability throughout the entire business.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – Aug 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:
--| https://blog.reemo.io/september-2025-cyber-outlook
--| https://industrialcyber.co/cisa/cisa-unveils-zero-trust-guidance-to-safeguard-connected-communities
--| https://www.justice.gov/opa/pr/lockergoga-megacortex-and-nefilim-ransomware-administrator-charged-ransomware-attacks
--| https://www.meritalk.com/articles/pentagon-to-release-updated-zero-trust-strategy-by-end-of-year
--| https://www.swktech.com/swk-cybersecurity-news-recap-september-2025
--| https://tech.co/news/data-breaches-updated-list
--| https://www.fedinsider.com/hot-topics-in-cybersecurity-day-3-the-importance-of-zero-trust-architecture
--| https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem
--| https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
--| https://therecord.media/ohio-ransomware-attack-impacts-45000
--| https://www.globenewswire.com/news-release/2025/09/29/3157997/0/en/Rising-Cyber-Risks-Zero-Trust-Adoption-And-Cloud-Delivered-Security-Demand-Are-Driving-Strong-Momentum-In-the-Security-Service-Edge-Market-According-to-Astute-Analytica.html

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode, we cut through the marketing hype to reveal the strategic core of Zero Trust with Alex Sharpe, a 30-year cybersecurity veteran from the NSA, Booz Allen, and KPMG who co-authored the foundational "Zero Trust Guiding Principles" for the Cloud Security Alliance.

Guest: Alex Sharpe (https://www.linkedin.com/in/alex-sharpe-3rd/)
Host: Dr. Victor Monga (https://www.linkedin.com/in/victorvirtual)

Mentioned Resources:
CSA Zero Trust Guiding Principles: https://cloudsecurityalliance.org/artifacts/zero-trust-principles-v-1-1

CSA The Business Value of Zero Trust: https://cloudsecurityalliance.org/blog/2023/10/27/what-is-the-business-value-of-zero-trust

Highlights:
--| The Two Axes of Zero Trust: How every successful strategy boils down to managing Identity (likelihood) and Segmentation (impact).
--| Why the "whack-a-mole" approach of chasing use cases instead of building a strategy is destined to fail.
--| The Ransomware Effect: How the "stuff that was too hard" suddenly becomes the top priority after a major breach.
--| Why compliance is just "table stakes"—the bare minimum—and is not the same as being secure.
--| A clear first step for any organization: Why mastering access control for your most valuable assets is where the journey must begin.
--| Beyond defense to true resilience: Shifting the mindset from just preventing breaches to ensuring the business remains viable amidst adversity.

This episode is an essential listen for any leader tired of the fluff. It provides a clear, actionable framework for building a Zero Trust program that delivers measurable resilience and business value.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – Aug 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:
--| https://www.illumio.com/blog/top-cybersecurity-news-stories-from-august-2025
--| https://xage.com/blog/cyber-attack-news-august-2025/
--| https://www.cybersecuritydive.com/news/government-zero-trust-migration-black-hat/756985/
--| https://thehackernews.com/2025/08/new-rce-vulnerability-api-gateway.html
--| https://www.bleepingcomputer.com/news/security/new-chronostealer-malware-bypasses-mfa-and-edr-tools/
--| https://cloud.google.com/mandiant/m-trends/apt44-supply-chain-report
--| https://krebsonsecurity.com/2025/08/massive-data-scraping-exposes-professional-data/

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode, we bridge the gap between Zero Trust theory and real-world deployment with Norman Wong, a key contributor to NIST's groundbreaking implementation guide (SP 1800-35).

Guest: Norman Wong (https://www.linkedin.com/in/gahnormanwong)
Host: Dr. Victor Monga (https://www.linkedin.com/in/victorvirtual)

https://csrc.nist.gov/pubs/sp/1800/35/final

Highlights:
--| Why the "if it ain't broke, don't fix it" mindset is the biggest barrier to Zero Trust adoption.
--| Inside baseball from the NIST NCCoE project: how competitors like Palo Alto Networks, Cisco, and Zscaler collaborated to build a real-world Zero Trust architecture.
--| The "crawl, walk, run" method: implementing Zero Trust incrementally without disrupting business operations.
--| Beyond the user: why identity is crucial for visibility but isn't the only place to start your journey.
--| The biggest trap organizations fall into: creating fragmented "Zero Trust silos" that don't integrate.
--| Bringing a knife to a gunfight: How AI is becoming non-negotiable for defending against AI-powered attacks.

An essential guide for any leader feeling overwhelmed by Zero Trust, this episode offers a practical roadmap for moving from planning and theory to a mature, measurable program.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode, we take on a candid debate: is Zero Trust a real strategy or just another layer of marketing? Guest Ken Yao challenges the industry’s favorite buzzword while unpacking what truly matters for building security programs.

Guest: Ken Yao (https://www.linkedin.com/in/kennethyao)
Host: Dr. Victor Monga (https://www.linkedin.com/in/victorvirtual)

Highlights:
--| Why Ken sees Zero Trust as “Trust but Verify, minus the politeness.”
--| The bear-chase analogy: benchmarking against peers instead of chasing perfection.
--| Big GRC vs. little gRC—and why compliance alone is never enough.
--| The danger of buzzwords overshadowing execution in contracts and programs.
--| Why long-term trust, not short-term slogans, should guide strategy.
--| Looking ahead: how AI could make security a “solved problem” in the next five years.

A rare episode that puts Zero Trust under the microscope, weighing strategy against marketing and forcing us to ask—are we building real security, or just selling stories?

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.