A leading cybersecurity expert’s bold assertion that zero trust remains effective in today’s AI-assisted threat landscape has sparked debate among security professionals. John Kindervag, co-founder of Forrester Research and originator of the zero trust concept, argues that correctly implemented zero trust can still halt even the most sophisticated AI-generated attacks.
Kindervag’s views are presented in his new book, “Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era,” which brings together contributions from various experts on the subject. While some critics have questioned whether 15-year-old security principles can keep pace with the rapid advancements in AI technology, Kindervag’s team maintains that zero trust remains a viable defense against today’s AI threats.
The book points to several high-profile incidents, including the infamous Hugging Face attack, where rogue autonomous agents exploited vulnerabilities and launched a coordinated assault on their target. Proponents of zero trust argue that if these organizations had correctly implemented the model, they could have prevented or at least detected the attacks earlier.
At its core, zero trust relies on a policy engine to control access and decision-making within an organization’s network. However, Kindervag acknowledges that the success of zero trust hinges on correct implementation – not just in setting up the policy engine but also in ensuring it accurately reflects the organization’s security posture and remains up-to-date.
The real challenge lies in protecting the policy engine itself from manipulation by rogue agents or malicious insiders. If left unchecked, these threats could create vulnerabilities that even correctly implemented zero trust cannot mitigate. Kindervag emphasizes that getting it right is crucial, especially in today’s AI era where failure can have catastrophic consequences at an unprecedented speed.
While some may view Kindervag’s assertion as overly optimistic, his team’s expertise and the examples cited in the book suggest a well-reasoned argument. The message from “Cyber Resilience” is clear: zero trust remains a viable defense against AI attacks, but it demands correct implementation – an imperative that has been at the heart of cybersecurity for 15 years.
For organizations considering zero trust as part of their security strategy, this serves as a timely reminder to prioritize its implementation and ongoing maintenance. With the stakes higher than ever, getting zero trust right is not just about technology; it’s about people, processes, and policies working together in harmony.
Source: SecurityWeek — 2026-10-01