Zero Trust (ZT) has become a dominant framework in cybersecurity discussions, but as security leaders acknowledge, it is not a product, a single solution, or an endpoint—it’s a strategic mindset that continually evolves with an organization’s risk landscape. This CISO Executive Roundtable discussion provides deep insights into how organizations are approaching Zero Trust, the challenges they face, and the practical steps they are taking to implement it effectively.
Zero Trust: A Philosophy, Not Just a Framework
One security leader framed Zero Trust as an “assumed breach” mindset rather than a rigid technological framework. “Zero Trust is a state of mind, not just a security toolset,” a CISO remarked. This sentiment reflects the reality that threats can originate from both internal and external sources, making continuous verification a necessity.
Another security executive put it succinctly:
“Trust nothing—everything is hostile. Treat everything as if you are on a Starbucks network.”
The discussion also acknowledged a challenge: Many organizations have adopted Zero Trust language without fully grasping its implications. Several leaders highlighted a common misconception—treating Zero Trust as a product rather than a principle.
One CISO recalled:
“Before I arrived, our IT team bought a ‘Zero Trust product’ and declared victory. But now, I’m unwinding years of misplaced confidence and explaining that Zero Trust is a journey, not a one-time purchase.”
Key Takeaway:
Security leaders need to emphasize Zero Trust as a strategy rather than a technology stack. While tools are important, Zero Trust is ultimately about access control, continuous monitoring, and risk-based decision-making.
Communicating Zero Trust Without Buzzwords
Several leaders noted that technical jargon can alienate executives and business leaders. Instead of talking about Zero Trust, one security director said:
“I framed it as an ‘any access strategy’ – enabling employees to securely access data from anywhere, at any time, on any device.”
He said that language resonated far more than cybersecurity buzzwords.
Another security executive stressed that Zero Trust must be tied to business objectives:
“Your board doesn’t care about Zero Trust. They care about protecting revenue, customer trust, and intellectual property. Talk about those risks first, and then explain how Zero Trust principles help mitigate them.”
Key Takeaway:
When selling Zero Trust to leadership, focus on business outcomes rather than security terminology. Reframing ZT as a business enabler rather than a security constraint leads to broader acceptance.
Where to Start: Prioritizing Zero Trust Initiatives
For organizations in the early stages of their Zero Trust journey, the discussion centered on where to begin. Leaders identified five key priorities based on the NSA’s Zero Trust Model:
- Establish trust in identities – Ensure strong identity verification using MFA, behavioral analytics, and continuous authentication.
- Evaluate device trustworthiness – Enforce policies to verify device compliance before granting access.
- Enforce access policies – Implement conditional access rules that consider user identity, device security posture, and network risk level.
- Secure application access – Move beyond VPNs to software-defined perimeters and micro-segmentation.
- Continuously monitor behavior – Use AI-driven anomaly detection to spot unusual access patterns.
A leader from the education sector noted their starting point:
“Our first step was identity. If we can’t trust who is accessing our data, everything else falls apart.”
Another security executive from manufacturing focused on protecting high-value assets first:
“We’re prioritizing the security of intellectual property and operational technology before expanding Zero Trust to lower-risk areas.”
Here are a few resources provided by the leaders:
- Cloud Security Alliance Zero Trust Resources
- NSA – Embracing A Zero Trust Security Model
- https://ZeroTrustMaturity.org
Key Takeaway:
Zero Trust implementation should start with identity, high-value assets, and access control, rather than trying to secure everything at once.
Challenges in Zero Trust Implementation
Security leaders identified three major obstacles in Zero Trust adoption:
1. Legacy Systems and Technical Debt
One CISO stated:
“We have mainframe applications built decades ago that don’t support modern authentication methods. You can’t retrofit Zero Trust onto a 30-year-old system overnight.”
Organizations are using workarounds such as:
- Wrapping legacy applications in virtualized secure access layers
- Deploying privileged access management (PAM) solutions for high-risk applications
- Gradually migrating legacy systems to Zero Trust-compliant architectures
2. Resistance from Executives and Business Units
Another security leader admitted:
“Executives see security as an obstacle. If Zero Trust makes life harder for employees, it’s dead on arrival.”
To counteract resistance, leaders suggested:
- Aligning Zero Trust with business goals (e.g., enabling secure remote work)
- Demonstrating security as an enabler rather than a bottleneck
- Focusing on user experience to minimize friction
3. Managing Costs Without Overcomplicating Security
Budgets remain a constraint, with leaders emphasizing leveraging existing security investments before purchasing new tools.
One security leader recommended:
“Before buying anything, maximize what you already have—conditional access policies in Microsoft, endpoint security tools, and network segmentation.”
Key Takeaway:
Zero Trust should be implemented strategically and incrementally to avoid overwhelming the business.
Technologies That Accelerate Zero Trust Adoption
While Zero Trust is not a product, security leaders identified a few key initiatives that will help accelerate their implementation:
- Moving toward Passwordless Access – Microsoft/Google Authenticator, OKTA
- Deploying Immutable Endpoints – Fortified Desk
- Leveraging Conditional Access – Microsoft
One security executive noted:
“Conditional access policies in Microsoft 365 have been a game-changer. We’re enforcing access rules based on user risk levels without adding unnecessary friction.”
Key Takeaway:
Organizations don’t need to buy everything at once—leverage existing tools first before investing in new solutions.
Final Thoughts: Zero Trust as a Competitive Advantage
Zero Trust is more than just a cybersecurity initiative—it is a fundamental shift in how organizations protect their data, systems, and users. As one security leader concluded:
“We’re not just securing networks—we’re securing the business. Zero Trust isn’t about saying ‘no’ to users. It’s about enabling them to work securely, wherever they are.”
Ultimately, organizations that embrace Zero Trust strategically and pragmatically will be better positioned to withstand modern cyber threats while enabling secure business innovation.
Call to Action for Security Leaders:
- Assess your Zero Trust maturity – Identify gaps in identity, access control, and monitoring.
- Start with quick wins – Prioritize high-impact, low-friction security improvements.
- Communicate in business terms – Focus on risk reduction, operational resilience, and user experience.
- Adopt an iterative approach – Zero Trust is a journey, not a destination.
By making smart, strategic investments and prioritizing practical security controls, CISOs can ensure that Zero Trust delivers real business value—without becoming an impractical security ideal.
About Tim Howard
Tim Howard is the founder of 5 technology firms, including Fortify Experts, which helps companies create higher-performing teams through:
- People (Executive Search and vCISO/Advisory consulting),
- Process (NIST-based security assessments and Leadership Coaching),
- Technology (Simplifying Security Solutions), stream your workspace at Fortified Desk
How I can help you:
- Join over 30,000 People Getting Free Security Leadership Improvement Advice – Follow me on LinkedIn. www.linkedin.com/in/timhoward
- If you want to hire a great security leader, download our free ebook on How to Hire a Great CISO.
- If you want to quickly assess your Cybersecurity Maturity Level or Need a Strategic Improvement Roadmap, Contact me.
- If you are looking to simplify cybersecurity, see how Fortified Desk creates instant, immutable, indestructible streaming workspaces.
- Come be a part of the discussion in our Monthly CISO Forums.