The new normal: How to embrace a cultural approach to zero trust

Today’s bad actors are increasingly ruthless and hostile. With the threat landscape ever evolving, combating increasingly sophisticated attacks necessitates a shift in focus from tools to culture. As social engineering schemes and AI-driven threats ramp up, it becomes increasingly evident that a modern, successful cyber defense requires a comprehensive, holistic approach — one that accounts for technology principles alongside human awareness and behavior.  

Cyber resilience can no longer be achieved by implementing new security tools or measures alone. Cyber resilience starts with building a culture of resilience that hinges on fostering vigilance and skepticism. There needs to be a proactive approach to security that eliminates the need to “overtrust” in the name of output and productivity.  

Central to this cultural transformation is the concept of “zero trust”, a cybersecurity best practice based on the principles of least privilege and assume breach. In short, zero trust is a framework based on the idea of “never trust, always verify.” And while trust may be a human emotion, against the backdrop of today’s threat landscape, there’s no place for it in the digital world.  

A much-needed mindset shift 

A resilient security strategy isn’t just about the tools — it’s also about individuals’ collective mindset. At this point in time, cyber resilience can’t be achieved at the behest of the CISO or the SecOps team alone. It requires buy-in from the entire organization, from IT to HR, from accounting to the C-suite. A mindset influences the tools an organization adopts and the way decisions are made. In an era where trust is easily exploited and the attack surface continues to expand, individuals must adopt a more skeptical, vigilant mindset. Anyone who fails to do so creates a security handicap which bad actors can exploit. 

In fact, Verizon’s 2023 Data Breach Incident Report found that 19% of data breaches stemmed from internal actors, who caused either intentional or unintentional harm through misuse and human error. Plus, bad actors are seeing success in exploiting trusted relationships to capitalize on the hyperconnectivity of the software supply chain. According to CrowdStrike’s 2024 Global Threat Report, “Adversaries are maximizing their return on investment (ROI) by targeting vendor-client relationships, creating a single access point to target multiple organizations across verticals and regions. By exploiting access to IT vendors and compromising the software supply chain, they use trusted software to spread malicious tools.” 

In today’s world, organizations and individuals alike must approach inquiries and connections with a critical eye. But even despite organizations’ best efforts, the reality is that at some point there is bound to be one bad actor who breaks in and breaks through perimeter defenses or bypasses trusted relationships. While threat prevention is an essential element to prioritize, mitigating the repercussions of a breach must take precedence. Zero trust mandates a paradigm shift — necessitating a departure from traditional perimeter-based security models towards a more granular, identity-centric approach. 

Adopting zero trust entails not only deploying advanced technological tools and safeguards but also cultivating a mindset of continuous skepticism and validation — i.e. regularly practicing “assume breach.” It involves fostering a workplace standard where questioning the integrity of systems, solutions and data becomes second nature, and where individual employees assume responsibility for safeguarding against potential threats.  

It’s up to organizations to foster that environment of continuous learning, of course (especially as threats rapidly evolve) and offer employees the opportunity to participate in tests, workshops and incident response plans. While it’s up to employees to practice due diligence, it’s up to organizations and business leaders to ensure that they’re enabling the workforce with the resources and learning opportunities needed to effectively put what they’ve learned into practice.  

What’s next for business leaders  

So, how can business leaders ensure their employees are more discerning users of the technology they’re using? As cliche as it may sound, the answer is through greater communication. To build a culture that aligns with the principles of zero trust, all members of an organization must understand why they should be wary of automatically trusting communications and the gravity of misplaced trust, which is something that must be communicated from the top down. This encompasses providing comprehensive training programs, reinforcing the importance of cybersecurity protocols and fostering a culture of open communication where security concerns are addressed transparently and promptly.  

Business leaders can’t simply expect their CIOs and CISOs to shoulder this responsibility. They themselves must set the example of the zero trust
mindset, demonstrating a commitment to cybersecurity best practices and actively participating in initiatives to enhance cyber literacy and organizational resilience. By prioritizing cybersecurity as a strategic imperative and embedding it within organizational culture, businesses can fortify their defenses against evolving threats and mitigate the risk of costly breaches. While a zero trust culture can’t be built overnight, it’s important to start somewhere. 

In short, today’s increasingly sophisticated threat landscape warrants a more holistic approach to resilience that transcends technological solutions. New security tools will enter the cybersecurity industry, sure, but as new technologies emerge and more connections are made, it will become even more important for individuals to be discerning users — questioning and considering before handing over the keys to the metaphorical IT castle. While breaches do happen, by cultivating a culture rooted in the principles of zero trust, organizations will be better able to strengthen their defenses and adapt to the ever-changing threat landscape with confidence — trusting that their people are not a handicap on their cyber resilience journey, but instead a strategic enabler. It takes time, but it’s an essential investment to make.