The gap between Zero Trust policy and Zero Trust execution is where adversaries live. Michael Blake, Technical Fellow at Owl Cyber Defense, has spent over a decade closing that gap in the most sensitive critical infrastructure, federal and defense environments. These are the five steps he takes.
Inventory Reality
You cannot secure what you cannot see. Asset discovery in IT and OT environments routinely uncovers unmanaged devices, legacy controllers, and shadow IT, all invisible to inventory systems and unpatched. With attackers exploiting new vulnerabilities in as little as five days, the 209-day average patch window is not a gap, it’s an open door.
Segment to Shrink the Blast Radius
Ransomware attacks on industrial organizations surged 87% in 2024, with 25% causing complete OT shutdowns. Logical segmentation can be reconfigured or bypassed. Hardware separation cannot. No session to hijack, no rule to bypass, no management plane to exploit.
$4.88M — average cost of a data breach in 2024, the highest global average on record at the time.
Source: IBM Cost of a Data Breach Report 2024
Enforce Access by Role and Context
Stolen credentials let attackers look like legitimate users. In IT, MFA and behavioral analytics help, but privilege creep leaves standing access that should not exist. In OT, where endpoints cannot enforce identity, the boundary must do it instead.
Align Budget to Crown Jewels and OT Risk
Not everything can be secured at once. Focus budget on your highest-risk operational zones first, and treat supply chain as a primary threat; third-party components were implicated in 35.5% of breaches in 2024.
Sustain the Architecture
Zero Trust is not a deployment, it’s lifecycle management. The threat does not stop when implementation does and neither can you.
Who Should Read This
- CISOs & Security Leaders: Translating Zero Trust mandates into executable programs across hybrid IT/OT environments
- IT/OT Program Managers: Building the operational case for Zero Trust investment and navigating CMMC 2.0 requirements
- Defense & Critical Infrastructure: DoD contractors, defense industrial base suppliers, and operators of critical national infrastructure