Zero trust, by ear

Walks through NIST SP 800-207 and explains why zero trust is an architecture joining identity and security, with every session authenticated and authorized.

Covers zero trust basics and its deperimeterization roots, building a strategy from an inventory of users, devices and workloads, winning board buy-in, and giving people simple security tools.

A security chief who led zero trust programs explains what zero trust looks like in practice and how an organization can get started.

Explains why zero trust depends on verifying every access request using identity, device health, and context, and how identity lifecycle management supports it.

Reviews CISA's Zero Trust Maturity Model version 2.0 and how organizations can use it to measure progress and choose next steps.

Microsoft architects walk through the Zero Trust Workshop and the rollout gaps they see most, such as device compliance policies never enforced through Conditional Access.

A county government CTO explains how device identity fits into a zero trust program alongside human identity in a complex public-sector organization.

A remote access veteran explains replacing VPNs with identity-based zero trust network access, running both side by side during migration.

Gives a design method for Conditional Access: block-by-default policies, persona-based naming, and tested break-glass accounts protected with FIDO2.

Explains the Shared Signals Framework and CAEP with real examples, such as services sharing session and location signals so access can be changed in near real time.

Updates the state of the Shared Signals Framework and CAEP standards, including adoption by major technology companies.

Traces authorization from static entitlements to externalized, policy-based decisions that use real-time context, the per-request model zero trust requires.

Argues ZTNA alone cannot cover hybrid environments, AI agents, and ephemeral workloads, and describes integrated zero trust platforms enforcing policy for every identity type.

Explains why long-lived federated sessions need continuous signals, and how the OpenID Shared Signals and Events work on CAEP lets providers share session changes.