
1. Zero trust (never trust, always verify)
Zero trust can mean different things to different people, but the basic premise is that you assume the network is already breached and that a single boundary isn’t sufficient. Just because someone authenticated and was authorized once doesn’t mean they can act unchecked as they move through the network and access applications and systems. Users (human and nonhuman, such as AI agents) must be reauthenticated and reauthorized at every step, especially given modern, compound attacks that amplify the impact of initial breaches through rapid privilege escalation. When you keep your shields up, you’re always validating that the device or system granting access is still trusted, that the user is still authenticated and that the user still has permission to perform specific actions.
2. Least privilege access
This best practice is a highly effective way to contain the blast radius. Essentially, you limit access for users (human and nonhuman) and applications to only what is required to do their jobs. Titles and seniority don’t dictate access; role-based access controls do. Tracking every privileged session enables audit capabilities that provide insights to accelerate investigation and response. Separation of duties is a complementary concept. Users responsible for operational mechanics (e.g., Salesforce users) don’t get access to the infrastructure (e.g., logs and permissions), and vice versa. Infrastructure users (e.g., network engineers) don’t get access to operational mechanics (e.g., sensitive customer data).
3. Automated patching
The race to patchcritical device flaws has accelerated as AI-driven vulnerability discovery and exploitation intensify. Teams must quickly determine the appropriate device state for their environment and how to achieve it. AI-driven automation can help network engineers prioritize critical flaws and deploy the version that best fits business protocols. The latest vendor version isn’t always the right choice; the goal is to strengthen security while maintaining availability. Testing updates before pushing them into production is essential, yet few organizations have lab environments that replicate every device type, model and version. Testing on a low-risk device is the next best option before broader deployment. In environments with 20,000 devices, even a 0.1% failure rate means a substantial number of devices could experience issues, making rapid rollback essential.




















