Zero Trust Journey

In this episode of Zero Trust Journey, host Zach Pugh talks with Nemi George, an experienced information security executive, about the practical realities of implementing Zero Trust in a busy organization—especially where patient care and time-sensitive workflows collide with security needs. Nemi shares real-world strategies for starting small with critical assets, streamlining multi-factor authentication, and addressing legacy systems without disrupting business operations. The discussion underscores how Zero Trust should enable the organization by prioritizing user experience, cultural alignment, and clear leadership support.

Highlights

• Balancing Security & User Experience: Why understanding workflows—especially in clinical settings—is crucial to successful Zero Trust.
• Starting Small, Thinking Big: How focusing on critical data and systems first can reduce complexity and risk.
• Adaptive Authentication & MFA: Strategies for right-sizing multifactor requirements without bringing business to a halt.
• Zero Standing Privileges: Using just-in-time access and least privilege principles to lock down user accounts.
• Legacy Systems & Micro-Segmentation: Practical ways to incorporate older or specialized devices into a modern Zero Trust framework.

Key Takeaways

• Know Your Assets: Accurate asset inventory is the foundation of any effective security program.
• User-Centric Security: Security should align with user workflows, minimizing friction while maintaining strong protections.
• Leadership Buy-In: Zero Trust initiatives are more successful when presented as business enablers rather than “controls.”
• Passwordless Future?: Long passphrases, biometrics, and context-based access can reduce both risk and user frustration.
• Culture & Technology: Zero Trust is a shift in mindset, not just a collection of tools—successful adoption requires both process optimization and stakeholder engagement.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, host Victor Monga is joined by Snehal Antani, CEO and co-founder of Horizon3.ai, to break down the complexities of Zero Trust and the practical steps organizations can take to reduce network reachability and minimize the blast radius of cyberattacks. Snehal shares insights from his career spanning Fortune 500 companies, the Department of Defense, and his current role as a cybersecurity innovator, emphasizing the importance of continuous security validation and understanding the difference between vulnerable and exploitable systems.

Snehal offers actionable advice on how to prioritize security efforts based on return on effort (ROE) and how organizations can shift their focus from simply buying tools to adopting methodical, measurable approaches to risk reduction. Whether you're starting your Zero Trust journey or refining your strategy, this episode delivers real-world lessons to help you build a resilient security program.

What You’ll Learn in This Episode:

• Vulnerable vs. Exploitable: Why understanding this difference is crucial for smart security decisions.
• Reducing Reachability: How limiting network, credential, and device reachability minimizes risk.
• Return on Effort (ROE): Prioritizing high-impact actions that deliver maximum risk reduction with minimal effort.
• Continuous Security Validation: Why regular pen testing is vital to understanding your exploitable attack surface.
• Zero Trust as an Evolution: How Zero Trust is an evolution of existing security practices—not a product or one-size-fits-all solution.

Key Takeaways:

• Start with Reachability: Focus on reducing network, credential, and device reachability as a foundation for Zero Trust.
• Continuous Validation Matters: Regular testing ensures your controls are effective over time.
• Prioritize High-Impact Fixes: Maximize your return on effort by focusing on what reduces the most risk with the least effort.
• Cultural Shifts Are Critical: Successful Zero Trust requires aligning technology, processes, and people.
• Measure and Evolve: Zero Trust is a continuous journey—track progress and adapt as needed.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Welcome to I Zero Trust What You’re Saying – February 2025 Edition! In this episode, we break down the latest Zero Trust news, trends, and updates that matter to security practitioners. No hype—just real insights to help you navigate the evolving cybersecurity landscape.

Stay informed, stay secure, and as always, Zero Trust everything!

🔗 News Links:
--| https://executivegov.com/2024/12/nist-zero-trust-architecture-guidance-feedback/
--| https://securityboulevard.com/2024/12/making-zero-trust-architecture-achievable/
--| https://www.itpro.com/cloud/cloud-security/understanding-nis2-directives-the-role-of-sase-and-zero-trust
--| https://www.globenewswire.com/news-release/2024/12/05/2992083/0/en/Zscaler-Finds-Over-87-of-Cyberthreats-Hide-in-Encrypted-Traffic-Reinforcing-Need-For-Zero-Trust.html
--| https://www.zscaler.com/resources/industry-reports/threatlabz-encrypted-attacks-report.pdf
--| https://www.arnnet.com.au/article/3617743/home-affairs-opens-consultation-on-zero-trust-principles.html
--| https://federalnewsnetwork.com/cme-event/federal-executive-forum/dec-federal-executive-forum-zero-trust-strategies-in-government-progress-and-best-practices-2024/
--| https://www.microsoft.com/en-us/security/blog/2024/11/11/dod-zero-trust-strategy-proves-security-benchmark-years-ahead-of-schedule-with-microsoft-collaboration/
--| https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/outsourcing-and-procurement/cyber-supply-chains/choosing-secure-and-verifiable-technologies

👉 Learn more at: ztjourney.com

Disclaimer
The views and opinions expressed in this episode are those of the speakers and do not necessarily reflect the official policy or position of any affiliated organization. This content is provided for informational purposes only.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, hosts Victor Monga and Steve are joined by Zach Pugh, a seasoned cybersecurity product manager, to explore why government agencies are leading the charge on Zero Trust initiatives—and how the private sector can catch up. They delve into overcoming cultural resistance, dissecting vendor myths, and understanding why even the humble web browser deserves a serious seat at the Zero Trust table.

Zach shares tactical advice from his hands-on experience, emphasizing how organizations can start small, focus on business goals, and avoid the common pitfalls of “one-size-fits-all” vendor solutions. Whether you’re mapping out your first Zero Trust strategy or fine-tuning an existing program, this conversation provides practical insights to help you succeed in today’s dynamic threat landscape.

What You’ll Learn in This Episode

• Government First? Why federal agencies adopted Zero Trust faster than many private organizations—and what we can learn from them.
• Vendor Myths vs. Reality: Spotting red flags and ensuring your Zero Trust strategy isn’t hijacked by product pitches.
• Cultural Buy-In: How to articulate Zero Trust’s value to non-technical stakeholders and overcome resistance to change.
• Browser as an Asset: Why ignoring browser security can undermine your entire Zero Trust posture.
• Continuous Evolution: Understanding that Zero Trust is an ongoing journey, not a one-time implementation.

Key Takeaways

• Business Alignment: Start with executive buy-in and align Zero Trust initiatives to broader organizational goals.
• Practical Progress: Small, well-defined protect surfaces are easier to secure, test, and iterate on.
• Realistic Expectations: No single product can deliver Zero Trust—prioritize people, processes, and technology in tandem.
• Ongoing Validation: Regularly revisit your Zero Trust framework to adapt to evolving threats and changes in your environment.

Whether you’re a security leader or just beginning your Zero Trust journey, this episode provides practical insights to strengthen your strategy, reduce risk, and gain buy-in across your organization.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, hosts Victor Monga and Zach Pugh sit down with Jose Barajas, Vice President of Global Sales Engineering at AttackIQ to explore what it truly takes to implement and sustain Zero Trust security beyond the buzzwords.

Jose shares first-hand insights from years of helping organizations validate their security controls, revealing the biggest misconceptions, common pitfalls, and the real challenges that teams face when moving Zero Trust from theory to practice. From breaking down resistance to change to securing executive buy-in, this episode delivers practical strategies for making Zero Trust work—no matter where you are in the journey.

What You’ll Learn in This Episode:

✔ The Validation Gap – Why 90% of organizations assume their Zero Trust controls work, but nearly half fail security testing.
✔ Beyond Compliance – How Zero Trust is a security strategy, not just a checkbox for regulations.
✔ Breaking Cultural Barriers – Overcoming resistance from teams who feel “Zero Trust means you don’t trust them.”
✔ Securing Executive Buy-In – “I've gotta find a way to position Zero Trust as a revenue driver or at least to offset the protection of assets in the business.”
✔ The Role of Continuous Testing – Why Zero Trust isn’t a one-and-done initiative, but an evolving process requiring ongoing validation.

Victor and Zach dive into real-world Zero Trust adoption stories, exposing the biggest roadblocks organizations face—including why many Zero Trust projects fail before they start. Jose shares actionable ways to validate security controls, iterate on implementations, and gain leadership support to drive Zero Trust forward.

Key Takeaways:

🔹 Zero Trust isn’t complicated—it’s just hard. Cultural shifts and executive mandates are critical for success.
🔹 Validation matters—if you don’t test security controls regularly, they likely aren’t working as intended.
🔹 Zero Trust isn’t about mistrust—it’s about verifying digital actions, not distrusting employees.
🔹 Align Zero Trust with business goals—position it as a risk-reducing, revenue-protecting strategy to gain leadership support.
🔹 Start small, iterate, and automate—Zero Trust isn’t all or nothing, it’s a process of continuous improvement.

Whether you’re a security leader or just beginning your Zero Trust journey, this episode provides practical insights to strengthen your strategy, reduce risk, and gain buy-in across your organization.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, hosts Victor Monga and Steve Turner are joined by Zero Trust experts from Microsoft Clay Taylor and Tarek Dawoud to discuss how Zero Trust strategies can secure today’s expansive digital estates. They share insights from Microsoft’s Zero Trust Workshop and their collaboration with NIST, offering a practical guide for navigating the challenges of implementation.

Clay and Tarek reveal how organizations can move from overwhelmed to action-ready by breaking down silos, aligning teams, and leveraging practical tools. They emphasize that Zero Trust is not a product or a one-time fix—it’s a continuous journey of strengthening security and enabling business outcomes.

What You’ll Learn in This Episode:

• Securing your digital estate: How to protect identities, apps, devices, and data in an increasingly complex environment.
• Breaking silos for success: Aligning identity, device, and application teams for cohesive Zero Trust strategies.
• Insights from NIST collaboration: Lessons from Microsoft’s contribution to the industry-standard Zero Trust reference architecture.
• Practical workshop tools: How Microsoft’s Zero Trust Workshop simplifies implementation and tracks progress.
• Balancing security with user experience: Implementing robust security controls without disrupting productivity.

Victor and Steve dive into the real-world obstacles organizations face, from navigating vendor hype to addressing misconceptions about Zero Trust. Clay and Tarek share how the pandemic accelerated adoption, why federal government initiatives are leading the charge, and how to overcome internal barriers to Zero Trust success.

Key Takeaways:

• Zero Trust is about building on your current investments, not starting from scratch.
• Practical tools like Microsoft’s Zero Trust Workshop can simplify deployment and help organizations track progress over time.
• Collaboration is essential—breaking silos across teams ensures a unified approach to security.
• Effective Zero Trust frameworks enhance security while enabling seamless business operations.

Whether you’re a security leader or new to Zero Trust, this episode offers actionable advice to strengthen your strategy, reduce risk, and navigate the complexities of today’s cybersecurity landscape.

Stay connected with Zero Trust Journey! Follow us on LinkedIn, subscribe on YouTube, and visit our website for exclusive content and resources to help advance your Zero Trust journey.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, host Victor Monga is joined by Steve Turner, a former Forrester analyst and current Microsoft expert, to explore the realities of Zero Trust in today's evolving cybersecurity landscape. They tackle the myths, challenges, and strategies surrounding Zero Trust and provide actionable guidance to help organizations build effective architectures and align them with business goals.

From discussing why perimeter-based security models are no longer sufficient to exposing the "blinky box" marketing gimmicks of vendors, this episode offers a no-nonsense, practical approach to Zero Trust. Steve and Victor dive deep into the key elements of a Zero Trust strategy, emphasizing that it is not a product or quick fix but a framework to enhance organizational security by leveraging what you already have.

What You’ll Learn in This Episode:

• Why perimeter-based security is outdated: Understand the failures of traditional perimeter defenses and why Zero Trust offers a more robust approach.
• The pitfalls of vendor hype: Learn how to evaluate vendor claims, hold them accountable, and reject solutions that overpromise but underdeliver.
• Using what you already have: Discover how to build on existing security investments like MFA, SAML, and least privilege to create a Zero Trust architecture.
• The business value of Zero Trust: Translate technical jargon into business terms to secure buy-in from leadership and align security efforts with organizational goals.
• Training and continuous improvement: Explore strategies for upskilling teams and fostering a culture of ongoing learning and adaptation in Zero Trust.

Victor and Steve stress that Zero Trust is a journey, not a destination. It’s about taking inventory of your current security efforts, aligning them with core Zero Trust principles, and integrating them into a tailored architecture that supports your organization’s unique needs. They highlight the importance of a collaborative approach, where vendors become partners in building a seamless and transparent Zero Trust ecosystem, rather than pushing a one-size-fits-all solution.

Key Takeaways:

• Avoid throwing out what already works; instead, enhance your security by weaving Zero Trust principles into ongoing projects.
• Focus on practical, measurable outcomes that align security efforts with business goals.
• Leverage free resources, such as guidance from NIST and CSA, to benchmark progress and avoid vendor lock-in.
• Remember that user experience matters—effective Zero Trust should improve security without creating unnecessary friction for employees.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, host Victor Monga welcomes Jay Mar-Tang, Field CISO at Pantera, for a lively discussion about the real-world application of Zero Trust principles. Taking inspiration from Stone Cold Steve Austin’s mantra, “Don’t Trust Anybody,” they dive deep into the mindset shift needed to embrace Zero Trust as a framework and philosophy.

Through candid stories and real-world examples, Victor and Jay tackle some of the most pressing questions about Zero Trust:

• What does Zero Trust truly mean, beyond the marketing buzz?
• Why is it a continuous process, not a one-time project?
• How can businesses avoid common missteps, like relying on flashy "Zero Trust certified" tools?
• What role do validation, granular access control, and business alignment play in a successful Zero Trust journey?
• How can organizations balance the technical, process, and human elements required to make Zero Trust effective?

This episode also emphasizes the importance of foundational security hygiene, such as multi-factor authentication and asset visibility, while addressing why focusing on business objectives is critical to Zero Trust's success.

Packed with actionable insights, expert advice, and even some nostalgic wrestling references, this episode is a must-listen for anyone navigating the complexities of modern cybersecurity. Tune in to discover how Zero Trust can empower your organization to reduce risk, protect critical assets, and evolve with confidence.

Ready to start—or refine—your Zero Trust journey? Join the conversation now!

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

In this episode of Zero Trust Journey, the hosts and guests from the Department of Defense (DOD) share their firsthand experiences with implementing Zero Trust in high-security environments. The discussion explores the challenges, insights, and real-world applications of adopting a Zero Trust security framework, focusing on the steps necessary to achieve a successful Zero Trust journey.

Key Topics Covered:

• The Business-Driven Zero Trust Strategy:
  The episode emphasizes that organizations must define their Zero Trust strategy from within, rather than being led by vendor-driven solutions. Zero Trust is not a one-size-fits-all solution but should be tailored to meet business needs.
• The Zero Trust Mindset:
  The guests discuss the core principle behind Zero Trust: never trusting anything or anyone by default. This mindset of constant verification of users, devices, and applications strengthens security and fosters continuous vigilance.
• Zero Trust as a Cultural Shift:
  Zero Trust requires more than just new tools; it demands a cultural transformation. The episode explores how adopting Zero Trust requires a shift in how organizations approach cybersecurity, necessitating collaboration between security, IT, and business teams.
• Collaboration and Breaking Down Silos:
  One of Zero Trust’s key benefits is its ability to break down organizational silos. The guests share how collaboration across security, network, and IT teams ensures security is integrated into all areas of the business from the start.
• Overcoming Resistance to Change:
  Implementing Zero Trust often challenges established practices. The guests discuss overcoming resistance from teams, particularly system administrators and developers. Leadership and clear communication are crucial to help employees understand and embrace Zero Trust.
• Zero Trust in the DOD Sector:
  The guests provide insights into applying Zero Trust within the DOD sector, where securing sensitive data is critical. The discussion covers how to overcome the challenges of implementing Zero Trust across large, complex organizations with legacy systems.
• Legal and Regulatory Alignment:
  The episode explains how Zero Trust aligns with legal, regulatory, and compliance requirements. The guests discuss how adopting Zero Trust can help meet evolving data protection and privacy standards, positioning it as a strategic business move.

Takeaways and Key Lessons:

Listeners will learn that Zero Trust is an ongoing journey. The episode emphasizes continuous refinement, collaboration, and integrating Zero Trust principles into all business layers. The guests recommend starting small, assessing current security, and gradually building upon existing systems to ensure long-term success.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.

Welcome to the first episode of the Zero Trust Journey Podcast, where host Victor Monga sits down with cybersecurity and compliance expert Erin Logue Smith to pull back the curtain on what Zero Trust truly means—and what it doesn’t. Zero Trust is everywhere in the industry’s vocabulary, but for many, it remains a buzzword heavy on aspiration and light on tangible guidance. If you’ve ever wondered why you can’t just buy a product labeled “Zero Trust” and call it a day, or if you’ve struggled to break through organizational barriers that resist meaningful security changes, this is the conversation you need to hear.

In this candid conversation, Victor and Erin discuss why Zero Trust can’t simply be achieved by purchasing a “blinky box” solution or ticking a compliance checkbox. It’s a philosophy that requires aligning technology, people, and processes. Rather than treating Zero Trust as an isolated project, they explore how it fits into a broader cybersecurity ecosystem: one that includes data backups, incident response plans, and a resilience strategy robust enough to withstand modern threats.

Erin offers unique insights from both a legal and a cybersecurity perspective, emphasizing that Zero Trust goes hand in hand with regulatory readiness and data protection. Whether you’re dealing with sensitive customer information, proprietary business data, or remote work environments, Zero Trust principles ensure every user and device must continuously prove their legitimacy.

Victor and Erin also address the cultural challenges organizations face. Implementing Zero Trust often means changing long-standing habits and confronting initial resistance from executives and staff accustomed to minimal authentication steps. Communication is key—explaining the “why” behind these measures helps foster buy-in, encouraging everyone to embrace a more secure posture rather than viewing it as an inconvenient hurdle.

For those just starting their journey, this episode provides practical guidance. Begin by focusing on fundamentals: understand your existing architecture, know where your data resides, and clarify your incident response approach. Then, piece by piece, incorporate tools and policies that support ongoing authentication, authorization, and validation. Partner with trusted advisors who can help you navigate complexity without losing sight of Zero Trust’s core principles.

Instead of racing toward a final endpoint, recognize Zero Trust as a continuous evolution. Over time, these efforts build a stronger, more agile security framework—one that protects your organization, meets regulatory expectations, and stands ready against future threats. It’s not about one product or a quick fix, but about committing to the journey and reaping the long-term rewards of genuine security transformation.

Subscribe to our LinkedIn to never miss news, updates, and quizzes to earn digital badges.

• https://ztjourney.com
• LinkedIn
• YouTube

Disclaimer: The views expressed are those of the speakers.