“You can’t just be a CISO and implement something like this. It just impacts the organization too broadly.” — Chris DeRusha

“Moving toward … least privilege, strong recurrently validated authentication, locking down credentials … is really a sea change.” — Eric Goldstein

“We have to make sure that users can within a couple of clicks … get access to the things that are meaningful to them.” — Sean Frazier

“If you’re using identity as your perimeter, it brings in a lot of new tools … to make real-time, dynamic, threat-informed decisions.” — Louis Koplin

“One of the very first things that should be done that organizations often overlook is ensuring that they understand what's on their network today.” — Chris Usserman

“We perform webinars to look at zero trust concepts in the form of doing deep dives into the individual pillars.” — John Simms

“We’ve taken this intersection between the data and the user, and identified it as the ‘workspace.” — Jay Leask

“The place where you make decisions about who gets access to what … needs to be as close to the resource as possible.” — Steve Schmalz

“The acceptance of the model has happened a lot quicker in the last two years than I would have expected.” — Kevin Bingham

“What excites me the most about zero trust is it’s really the most transformative strategy … shift we’ve had in cyber in the last several decades.” — Cameron Chehreh

“Everyone’s zero trust implementation plan should be different … because everyone’s not starting from the same starting point.” — Sheena Burrell

“A zero trust solution … takes a lot of the tools, techniques and functionality that they have in their enterprise today.” — Tim Jones

“Before you get into all the cool technology … that everybody loves, you really have to focus on establishing your program.” — Stephen Haselhorst

“Everything that’s requesting data or exchange of data, you certainly would need to start there. That would be a first phase.” — Andrew Osborn

“I can have a discussion on zero trust with anybody, from someone in the CTO or CIO space, but also other organizations ... like procurement.” — Dan Carroll

“We have to implement zero trust in a way that every packet, every piece of data, every transaction is not trusted.” — Raju Ranjan

“There’s a clear opportunity to build better, build faster, be more flexible and deliver more secure systems.” — Nick Miller

“Zero trust is not really solving a technology problem. It’s really aimed at solving a business problem.” — James Yeager

“We are embracing automation. There’s just no ifs, ands or buts about that.” — Mike Witt

“Make sure that everyone across teams is hearing that same information of what benefits zero trust brings to an agency.” — Danny Connelly

“If users find zero trust cumbersome, they’re going to find workarounds — it’s human nature — and that undermines the goals and the protections.” — Bill Wright

“What’s critical is that context-aware access determinations happen at wire speed so there’s no friction for an agency’s end users but lots of friction for bad actors.” — Sean Frazier

“The service mesh is incredibly effective for runtime security, and for being able to monitor and assert the state of your system continuously.” — Zack Butcher

“Zero trust architectures are enabled by design principles that make use of both macro and micro segmentation." — Tom Van Meter