If I had a nickel for every time a vendor told me their shiny new appliance would “solve Zero Trust,” I’d be retired on a beach somewhere.
Here is the hard truth I keep coming back to in conversations about the future of the edge: Zero Trust is not a product. It’s a mindset.
You can’t buy a box of “Zero Trust” any more than you can buy a box of “Weight Loss.” You can buy a treadmill (the tool), but if you don’t change your habits, you’re just a guy with a dusty treadmill in the basement (guilty as charged!)
Easy in PowerPoint, Hard in Real Life Zero Trust is easy in a PowerPoint. It looks great on a slide—”Only the right people get access to the right data.” Simple, right?
But in the trenches, it’s messy. It requires you to actually know who your users are and what they need. Do you know exactly which three servers Bob in Accounting needs to access? Probably not. And if you lock Bob down too tight, he can’t close the books, and you get a frantic call at 11 PM.
The “Key Ring” Problem Most enterprises right now are suffering from tool sprawl. You’ve got a vendor for VPN, a vendor for SD-WAN, a vendor for the firewall, and a vendor for cloud security. It’s like carrying a janitor’s key ring with 50 keys, and you have to try five of them just to open the front door.
That complexity is the enemy of security. When you have that many gaps between products, that’s where the bad guys slip in.
The Fix? Consolidate. The future isn’t about buying more security tools. It’s about buying fewer, better-integrated ones. We need to move toward platforms that handle both the connection and the inspection. Note that I say ‘fewer’ not ‘one’. Rarely will you find a single vendor that is good at everything. Dont be afraid to have a few eggs in your basket, and pick a few solid players in each space and bring them together in a cohesive solution (yes, the good ones will play fairly nicely together despite what sales teams will tell you).
Stop looking for a silver bullet. Start looking for a diet and exercise plan. It’s boring, it takes work, but it’s the only thing that actually keeps the heart attack (or the ransomware attack) away.
(This post is part of a series expanding on a panel discussion I was a participant in at the C3 tech summit in 2025.)