So can we talk regulation? Are regulations starting to catch up with the threat landscape or is it that the regulations sort of follow?

Unfortunately regulations are always going to follow because our threat landscape is moving at such a rapid pace, faster than I've ever seen and naturally any form of regulation takes time to get approval.

So they generally unfortunately are a bit out of date when they're released.

I think the issue we have is sometimes regulations get too much into the detail, too much down in the weeds.

They should be much more high level and concentrate on risk.

There isn't a specific regulation on zero trust, but it is in DORA, HIPAA, CMMC, Cyber Essentials Plus, whatever you want to name.

It may not actually say zero trust, but it will say granular access or it will say they must verify constantly.

It's like Zero Trust can sometimes feel a bit like as fail-safe approaches you can have in a world where networks are always changing, AI is getting smarter.