Zero Trust for the AI Era | John Kindervag, Rich Mogull, and Don Yeske

So D- Don, right, as John said, right, you've essentially done your thesis on protect surfaces.

surfaces.I did

And a protect surface is a, is a key part of how you actually make a zero trust strategy real, right? So explain what a protect surface is and why it's so important.

Well, let me, let me answer that in the reversed order.

Uh, I'll, I'll start by explaining why it's important.

The reason I chose protect surfaces as the topic of my master's thesis at NDU is because of my experience implementing zero trust at the Department of Homeland Security, and earlier than that, at the Department of the Navy when I was serving as the CTO there.

And the reason I have, over the course of that experience, come to believe that identifying protect surfaces is the one first critical step you have to take is because I've seen what we've actually done.

Mm.

And we've done what we were told to do.

And what we were told to do is go implement, you know, various cybersecurity tactics that are good tactics, right? Go implement multi-factor authentication.

Go implement, you know, uh, you know, better, uh, uh, recording and, and staging and distribution of your event and incident data, right? Go segment in your networks.

These are all good things to do, and they will actually produce good results, but they will only produce good results if, and this is a, this is a critical if, if you're actually measuring what you're defending.

Mm.

If what you're measuring is the implementation of tactics, there is an endless space in which to implement those tactics, and the government's actual experience doing that is not...

This is not me saying it.

This is...

CISA published a report in 2025 that was required by Congress, and that report listed how far we had come from the, the, the definition of those tactics, from the issuance of those orders.

Like, tell me how well you did.

And the report was not good.

Uh, it had some good things in it, but what it said was, for example, the example I gave earlier was, uh, implement multi-factor authentication and implement phishing-resistant multi-factor authentication.

In the year, at the moment when, uh, OMB memorandum M-22-09 was, was written, we were at about 60%, give or take, Kentucky windage.

About 60% of federal agencies had done what the task required, which was for your public-facing stuff only, offer people the alternative of signing up for phishing-resistant MFA.

And about 8%, give or take, of public-facing applications that were, that were produced by the US government offered that alternative in a phishing-resistant form.

When that task was due, which was over a year later, we'd reached about 70%.

When the report was written in 2025, we'd reached 80%.