Zero Trust Journey

In this episode, hosts Dr. Victor Monga and Zach Pugh unpack one of the most actionable Zero Trust resources available today—NIST Special Publication 1800-35. Unlike its predecessor SP 800-207, this guide dives deep into the how of Zero Trust, providing lab-tested architectures from 24 vendor collaborators including Microsoft, Palo Alto, and Zscaler.

Victor and Zach explore how NIST’s Enhanced Identity Governance (EIG) model and real-world testing—complete with adversary emulations—finally give security leaders the blueprint they’ve been waiting for. They spotlight implementation gaps, integration hurdles, and the importance of continuous validation—not just visibility.

Highlights:
--| Why SP 1800-35 is the most practical Zero Trust guide to date.
--| Enhanced Identity Governance and the identity-first foundation.
--| Lessons from 19 tested architectures: what worked and what broke.
--| Continuous validation as a Zero Trust necessity.
--| Crawl, Walk, Run: Using the NIST maturity model to begin your journey.
--| Mapping ZTA to real-world missions and risk-based prioritization.

This is not just another framework—it's your implementation playbook. Tune in to understand what’s really required to make Zero Trust work at scale.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Guest: Razi Rais (https://www.linkedin.com/in/razirais)
Host: Victor Monga (https://www.linkedin.com/in/victorvirtual)

In this episode of the Zero Trust Journey podcast, bestselling author and enterprise strategist Razi Rais joins host Victor Monga to challenge the idea that Zero Trust can be bought. Razi shares the philosophical foundations of Zero Trust, real-world enterprise pitfalls, and how AI is reshaping security strategies faster than most teams can adapt.

Highlights:
--| Zero Trust is not a tool—it’s an organizational mindset.
--| AI and LLMs are adding pressure on already fragile architectures.
--| Security posture must match real-world connectivity—not old models.
--| Collaboration between dev, ops, and security is non-negotiable.
--| Maturity models work—if you know your organization’s appetite for risk.
--| Understand your “why” before you start your Zero Trust journey.
--| Not every company is ready—or willing—for Zero Trust. And that’s okay.

If you’re a cybersecurity leader navigating transformation, AI threats, or just vendor fatigue, this conversation is a roadmap you can’t afford to miss.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – May 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:
--| https://www.forbes.com/councils/forbestechcouncil/2025/05/30/the-future-of-cybersecurity-leadership-universal-zero-trust
--| https://www.carahsoft.com/blog/palo-alto-networks-from-concept-to-implementation-operationalizing-zero-trust-architecture-in-government-environments-blog-2025
--| https://defensescoop.com/2025/05/22/pentagon-cyber-malaise-zero-trust-deadlines-translate-zero-urgency
--| https://www.computerweekly.com/opinion/Zero-trust-is-redefining-cyber-security-in-2025
--| https://thehackernews.com/expert-insights/2025/05/eliminating-public-ips-case-for-zero.html
--| https://www.illumio.com/blog/top-cybersecurity-news-stories-from-may-2025

👉 Learn more at: ztjourney.com

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Disclaimer: The views expressed are those of the speakers.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

00:00 Introduction to Allie Mellen
01:29 Allie's Journey in Cybersecurity
06:29 Understanding Zero Trust
09:30 Zero Trust and Security Operations
12:26 Platform vs. Best in Breed
17:36 The Role of Identity in Zero Trust
30:29 Zero Trust: Buzzword or Necessity?
34:31 The Importance of Compromise in Security

Guest: https://www.linkedin.com/in/hackerxbella/
Host: https://www.linkedin.com/in/victorvirtual
Host: https://www.linkedin.com/in/beingageek
Host: https://www.linkedin.com/in/zachary-pugh/

In this episode, the hosts and guest Allie Mellen, Principal Analyst at Forrester, dive deep into the realities of Zero Trust from the lens of security operations, threat detection, and real-world implementation. Allie shares her unconventional path into cybersecurity—from building a card skimmer in college to speaking at Black Hat—and how that hands-on experience shapes her perspective today.

Highlights:
--| Why ethical hackers often shift to blue team roles.
--| The SOC’s role in Zero Trust adoption—beyond buzzwords.
--| Platform vs. best-in-breed: what's really best for the analyst?
--| Why identity, cloud, and user experience are the new battlegrounds.
--| The need for community, practical training, and realistic Zero Trust expectations.
--| Why calling it “Zero Trust” can scare executives—and what to say instead.

Tune in to hear why Allie doesn’t like the term “perimeter,” how she thinks about identity and cloud, and why compromise—not control—is the real goal of Zero Trust.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Host: Dr. Victor Monga
Co-Host: Steve Turner
Guest: Chris Jablonski, Director of CXO Revolutionaries, Zscaler

CSA article: https://cloudsecurityalliance.org/blog/2025/01/31/seize-the-zero-moment-of-trust

Highlights:
--| The Intersection of CTEM and Zero Trust: Discover how Continuous Threat Exposure Management (CTEM) enhances Zero Trust security by dynamically identifying and mitigating risks.
--| Executive Buy-in: Chris shares practical advice on communicating Zero Trust’s tangible benefits to secure critical executive support.
--| Legacy Coexistence: Understand why gradual transition and coexistence with legacy systems are not only practical but essential during Zero Trust implementation.
--| AI and Automation: Learn how AI-driven insights and automation help manage the overwhelming volume of security telemetry, freeing teams to focus on strategic initiatives.
--| DevSecOps Integration: Explore how integrating Zero Trust principles into the software development lifecycle helps ensure secure, resilient applications from the ground up.

Key Takeaways:
--| Start Small and Prove Value: Successful Zero Trust journeys often begin with targeted proof-of-concepts that clearly demonstrate immediate benefits.
--| Human Factors Matter: Effective Zero Trust adoption hinges on change management—winning over end-users by clearly articulating direct benefits, not just cost savings.
--| Security as Competitive Advantage: Zero Trust enables business agility, accelerates secure M&A activities, and positions your organization ahead of peers stuck in legacy paradigms.
--| Security by Design: Addressing security during the development process (DevSecOps) is crucial to managing emerging AI threats and maintaining trustworthy software supply chains.
--| Zero Trust Mindset: Embrace Zero Trust not just as technology but as an operational mindset shift critical for managing tomorrow's threats effectively today.

Dive into this insightful conversation with Chris Jablonski to gain actionable strategies, cut through buzzwords, and accelerate your practical adoption of Zero Trust.

👉 Learn more at: ztjourney.com

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – April 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:
--| https://www.meritalk.com/articles/disas-thunderdome-achieves-advanced-zero-trust
--| https://federalnewsnetwork.com/federal-insights/2025/04/accelerate-together-zero-trust-2025-zscalers-jose-padin-on-how-to-transform-your-agencys-1990s-approach-to-security
--| https://www.cio.com/article/3962906/why-81-of-organizations-plan-to-adopt-zero-trust-by-2026.html
--| https://cloudsecurityalliance.org/blog/2025/04/17/zero-trust-is-not-enough-evolving-cloud-security-in-2025
--| https://www.virtru.com/blog/zero-trust/dod-symposium-2025
--| https://www.dafcio.af.mil/News/Article-Display/Article/4164916/office-of-the-chief-information-officer-conducts-zero-trust-update-deep-dive
--| https://www.rsa.com/news/press-releases/rsa-zero-trust-has-zero-chance-without-ai
--| https://www.illumio.com/blog/top-cybersecurity-news-stories-from-april-2025
--| https://www.hpe.com/us/en/newsroom/press-release/2025/04/hewlett-packard-enterprise-redefines-cloud-based-security-with-expansive-solutions-for-zero-trust-networking-and-private-cloud-operations.html
--| https://www.elisity.com/blog/rsac-2025-day-1-recap-zero-trust-microsegmentation-and-the-future-of-cybersecurity

👉 Learn more at: ztjourney.com

Stay connected with the Zero Trust Journey! Follow us on LinkedIn and subscribe to our YouTube for insights, discussions, and updates. Visit our website for exclusive content and to stay informed on the latest Zero Trust strategies.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

• Host: Zach Pugh (LinkedIn)
• Co-Host Victor Monga (LinkedIn)
• Guest Jason Garbis (LinkedIn)

Highlights:

• Practical Zero Trust Implementation: Jason emphasizes the importance of adopting a realistic, incremental approach to Zero Trust, urging organizations to leverage existing capabilities before investing in new technologies.
• Introducing ZTMM+: Discover Jason’s enhancement of the CISA Zero Trust Maturity Model, designed to provide clearer definitions, practical guidance, and address critical gaps like secure internet access and data loss prevention.
• Simplifying Complexity: Learn how the ZTMM+ framework translates complex Zero Trust maturity assessments into straightforward, actionable questions, promoting collaboration across IT, security, and business teams.
• Avoiding Vendor Hype: Jason debunks vendor-driven myths and clarifies that no product is inherently "Zero Trust Certified," reinforcing the importance of strategic integration over reliance on vendor solutions.
• Secure Internet and DLP Strategies: Get insights into why comprehensive secure internet access controls and robust data loss prevention (DLP) strategies are essential yet often overlooked in standard maturity models.

Key Takeaways:

• Start with Practical Steps: Begin your Zero Trust journey by tightening policies around critical business assets, leveraging current technologies, and incrementally building your capabilities.
• ZTMM+ as an Actionable Tool: Use the enhanced maturity model (ZTMM+) to objectively measure your organization's true Zero Trust maturity and identify realistic improvement areas without overwhelming complexity.
• Vendor Realities: Recognize that true Zero Trust maturity involves strategic orchestration across existing processes and tools rather than dependency on a single vendor’s solution.
• Business-Focused Security: Zero Trust initiatives succeed when security leaders deeply align security improvements with clear, direct business benefits—supporting innovation, compliance, and strategic business expansions.
• Collaboration is Essential: Cross-functional collaboration between security teams, IT, and business stakeholders is critical for identifying real-world security gaps and practical, impactful solutions.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – March 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:

• https://www.defense.gov/News/News-Stories/Article/Article/4078717/zero-trust-architecture-could-prevent-adversary-data-theft-protect-warfighters/
• https://www.meritalk.com/articles/dods-ot-zero-trust-strategy-under-review-expected-by-august/
• https://defensescoop.com/2025/03/11/army-unified-network-plan-2-0-data-zero-trust/
• https://defensescoop.com/2025/02/19/navy-zero-trust-controls-ot-weapon-systems-platforms/
• https://statescoop.com/convincing-users-key-for-zero-trust-rollouts-ciso-says/
• https://www.rcrwireless.com/20250312/security/verizon-zero-trust-security
• https://www.scworld.com/resource/breaking-with-tradition-at-zero-trust-world-2025
• https://www.scworld.com/brief/strengthening-cloud-security-with-ai-driven-threat-detection-zero-trust

👉 Learn more at: ztjourney.com

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Host
Steve Turner (Linkedin)

Co-Host
Zach Pugh (LinkedIn)

Guest
Chase Cunningham, also known as Dr. Zero Trust (Linkedin)

Highlights:

• No Zero Trust Certified Product: Chase debunks the myth of a one-size-fits-all, certified solution—exposing vendor hype and unrealistic promises.
• Red Teaming as the Foundation: Learn why actionable red team assessments are critical for uncovering vulnerabilities and accelerating your security journey.
• Simplifying Micro Segmentation: Discover how modern policy engines and ZTNA are transforming a once complex concept into practical, scalable security measures.
• Small Business Cybersecurity: Understand why every organization—regardless of size—is a target, and explore budget-friendly, high-impact strategies.
• Portfolio Over Platform: Explore the benefits of integrated, API-enabled best-of-breed solutions versus monolithic vendor platforms.

Key Takeaways:

• Operational Over Compliance: A real Zero Trust strategy focuses on continuous, threat-based validation rather than merely ticking compliance checklists.
• Red Teaming Delivers ROI: Proactive testing and real-world assessments not only expose gaps but can also recover budgets tied up in redundant security solutions.
• Practical Strategies for Every Business: From centralized identity management to optimized asset inventories, start small and build a resilient security posture over time.
• Debunking Vendor Myths: With no certified Zero Trust product on the market, focus on proven operational tactics rather than buzzwords.
• Cyber Warfare Awareness: Recognize that in today’s digital battlefield, every asset—from your enterprise network to IoT devices—is valuable to adversaries, making proactive defense a must.

Dive into this unfiltered conversation with Chase Cunningham to get real-world insights and actionable strategies that cut through industry buzz and prepare you for the realities of cyber warfare.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Host
Zach Pugh (https://www.linkedin.com/in/zachary-pugh/)

Co-Host
Victor Monga (https://www.linkedin.com/in/victorvirtual/)

Guest
Drinor Selmanaj (https://www.linkedin.com/in/drinor-selmanaj-5bb28185/)

Highlights:

• Vulnerable vs. Exploitable: Distinguishing between a known vulnerability and a realistic exploitation path is essential for smart security decisions.
• Return on Effort: Focus on the security measures that provide the greatest risk reduction for the time and resources invested.
• Continuous Validation: Embrace adversary emulation, red-teaming, and regular testing to ensure your Zero Trust controls remain effective against evolving threats.
• Reducing Reachability: Minimize network, credential, and device reachability to cut down attackers’ lateral movement and protect critical assets.
• Practical Zero Trust Framework: Break down Zero Trust into manageable steps—start with asset inventories, least-privilege policies, and ongoing security education.

Key Takeaways:

• Zero Trust Is a Journey: It’s not a one-time project. Continuous assessment and adaptation are vital to keep pace with evolving threats.
• Define Your Own Zero Trust: There is no official Zero Trust certification, so each organization must clarify what Zero Trust means in the context of its unique business objectives.
• Continuous Security Validation: Regular testing (e.g., adversary emulation, red teaming) is key to security maturity and helps ensure Zero Trust controls work as intended.
• Adapt to Emerging Threats & AI: As attackers’ methods evolve—particularly with AI—organizations must keep refining and updating their Zero Trust strategies.
• Practical Application Matters: Beyond theory, Zero Trust relies on hands-on experience, clear asset inventories, and least-privilege principles to minimize the attack surface.
• Education & Culture: A security-first mindset, leadership support, and team-wide training are essential for successful Zero Trust adoption at scale.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.