It’s All Geek to Me: Communicating The Business Value of Zero Trust

### Overview Moderated by Jason Garbis, this panel session explores how cybersecurity leaders and practitioners can move beyond technical jargon to articulate the tangible business value of Zero Trust. The panelists emphasize that Zero Trust must not be treated as an isolated IT project or a marketing catchphrase, but rather as an ongoing, business-aligned cybersecurity journey requiring cross-functional collaboration and multiple executive champions across the organization.

### Key Topics - **Demystifying Zero Trust Definitions**: Panelists discuss core definitions ranging from the five foundational pillars (identity, device, user, network, and data) to risk-based, data-centric architectural guidelines. Jerry Chapman summarizes the foundation into three simple core concepts: identity, security controls, and risk. Chris Steffen highlights research showing that 17% of organizations delay Zero Trust initiatives simply because they struggle to settle on an agreeable definition. - **Translating Value into Business Language**: Security practitioners frequently fail by focusing solely on technical controls like MFA and microsegmentation rather than speaking the language of finance, operations, and leadership. Business value centers around monetary impact (revenue growth, operational cost reduction, operational optimization) and mitigating reputational risk. - **Tangible Business Benefits of Zero Trust**: - *User Experience & Productivity*: Moving past high-friction authentication toward continuous, contextual authorization reduces user frustration and decreases access-related help desk support ticket volume (with one highlighted enterprise reducing tickets by 80%). - *Mergers and Acquisitions (M&A)*: Zero Trust architectures streamline post-acquisition integration, granting secure day-one pinpoint access without needing months of manual network re-IP addressing. - *Competitive Differentiation and Partner Due Diligence*: Meeting rigorous third-party and regulatory security requirements acts as table stakes to close enterprise deals and retain vendor partnerships. - **Communicating and Championing Zero Trust Internally**: With average CISO tenures around 31 months, initiatives cannot rely on a single advocate. Security teams should recruit internal stakeholders who "speak business," educate board members via preliminary one-on-one sessions, position Zero Trust as part of the broader cybersecurity program rather than an overwhelming 50-million-dollar "marketecture" overhaul, and establish governance structures like a Zero Trust Center of Excellence or architecture review boards.

### Technical Details - **Continuous Authentication**: Transitioning from repetitive user prompts (e.g., prompting users 10 times via MFA tokens) to behavioral, background authentication and authorization that introduces friction only when abnormal behavior occurs outside baseline boundaries. - **Protect Surface & Granularity**: Rather than focusing solely on shrinking network segments or starting with massive overhauls, organizations should define their protect surface starting at the critical data and asset level, ensuring controls like encryption and least-privilege access are applied directly to high-value resources. - **Handling Policy Exceptions**: Zero Trust models break down when leadership demands special exceptions. The panel emphasizes applying consistent policy enforcement, noting that public-facing executives like CEOs are primary targets for spoofing and attacks.

### Takeaways - **Zero Trust Is a Journey, Not a Project**: Do not try to "eat the elephant all in one day"; pursue intentional, incremental milestones along a maturity model (traditional to intermediate to optimized). - **Align Metrics to Business Outcomes**: Alongside technical metrics like percentage of encrypted traffic or access denies, measure and communicate business-aligned metrics such as tool rationalization savings, shortened M&A timelines, and help desk ticket reduction. - **Build Cross-Functional Alliances**: Partner across IT, network, application development, and business units to ensure security acts as a collaborative business enabler rather than an obstacle.