Zero Trust
An architectural stance where no access is granted by network position; every request is authenticated, authorised and evaluated with signal.
Updated
Zero Trust replaces perimeter trust with per-request decisions based on identity, device state, application sensitivity and behavioural signal. It is a design principle, not a product you can buy. NIST SP 800-207 frames the baseline as verify explicitly, enforce least privilege, and assume breach.
In practice the first steps are strong authentication for privileged roles, device compliance as an access condition, removal of standing privilege, and segmentation that assumes an internal foothold. AI agents strain these assumptions further and increasingly need unique credentials and continuous authorisation rather than a one-time handshake.
Related
Identity & Zero Trust
Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.
Microsoft Entra ID
Entra ID hardening: Conditional Access design, PIM, phishing-resistant authentication, app registration governance and agent identity.
Cloud architecture review
Design-stage review of cloud and hybrid architecture: trust boundaries, identity model, segmentation, key management and detection design.
Threat modeling
A practical STRIDE-based threat modeling method for cloud, application and AI systems, built to be run by engineering teams.
Identity attack paths
Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.
Conditional Access baseline
An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.