Zero trust, by ear

Walks through NIST SP 800-207 and explains why zero trust is an architecture joining identity and security, with every session authenticated and authorized.

Covers zero trust basics, the business and cultural effects of removing the network perimeter, and why people need training alongside technical controls.

A security chief who led zero trust programs explains what zero trust looks like in practice and how an organization can get started.

Explains why zero trust depends on verifying every access request using identity, device health, and context, and how identity lifecycle management supports it.

Reviews CISA's Zero Trust Maturity Model version 2.0 and how organizations can use it to measure progress and choose next steps.

Microsoft field architects describe common zero trust rollout mistakes, such as defining device compliance policies without enforcing them through Conditional Access.

A county government CTO explains how device identity fits into a zero trust program alongside human identity in a complex public-sector organization.

A remote access veteran explains replacing VPNs with identity-based zero trust network access, running both side by side during migration.

Gives a design method for Conditional Access: block-by-default policies, persona-based naming, and tested break-glass accounts protected with FIDO2.

Explains the Shared Signals Framework and CAEP with real examples, and how they connect continuous access decisions to identity threat detection.

Updates the state of the Shared Signals Framework and CAEP standards, including adoption by major technology companies.

Traces authorization from static entitlements to externalized, policy-based decisions that use real-time context, the per-request model zero trust requires.

Argues ZTNA alone cannot cover hybrid environments, AI agents, and ephemeral workloads, and describes integrated zero trust platforms enforcing policy for every identity type.