Cyber Resilience at Machine Speed: Author John Kindervag and contributor Dr. Chase Cunningham. [Special Edition]

Dave Bittner opens by asking John Kindervag why he created Cyber Resilience at Machine Speed. Kindervag says people had repeatedly asked him to address Zero Trust in the AI era, partly because skeptics kept arguing that Zero Trust would not work for particular technologies or situations. He already believed it worked for AI, but did not want to write the entire book alone. Recalling the advice that “there are no great books, only great chapters,” he invited 13 people he admired, including Dr. Chase Cunningham, to contribute. He says the collaboration produced a better book than the single chapter he might have written himself. Cunningham says he would agree to help if Kindervag asked, comparing it to running into a burning building because of their long mentoring relationship. He also genuinely enjoys writing and found the topic compelling. He argues that this may be the best time in history for Zero Trust because machines and AI agents do not have HR departments and will not complain when told they are not trusted. Kindervag organized the book around his five-step Zero Trust deployment model: define the protect surface, map transaction flows, architect the network or environment and choose products, instantiate policy, and then monitor and maintain. He assigned chapters to contributors according to their expertise. Cunningham’s chapter builds on his earlier work about policy and graph databases, particularly the contrast between attackers’ graph-based thinking and defenders’ tendency to rely on lists.

Cunningham explains that his chapter focuses on applying an adversarial mindset to Zero Trust in the AI era. Security teams often begin from a defensive posture, imagining that their job is to prevent every bad event. He says that is incomplete because organizations must also respond to attacks and understand how adversaries approach a system. Drawing on his experience as a red teamer and government penetration tester, he says defenders need to think about where an attacker will maneuver, what context they will use, and which pivot points they will exploit. The distinction between lists and graphs is central. Legacy tools such as SIEM systems often present what Cunningham calls a “big glorified spreadsheet” of events, alerts, and blinky lights. An attacker, by contrast, tries to understand relationships: what connects to what, where to move, what to avoid, and which missed detail creates an opening. A list of alerts does not provide that battle-space context, while graph-oriented analysis can show the pathways and pivot points that matter. Cunningham does not say that older strategies are irrelevant. He says the fundamentals still matter, but AI gives attackers and defenders a scope and speed beyond normal human operation. The practical goal is to keep attention on methods that improve understanding and response rather than on “security theater.”

Kindervag defines cyber resilience as the ability to withstand an attack, return to a good state, and avoid completely going down. He distinguishes this from merely preventing incidents and says organizations should ultimately aim for anti-fragility, in which the environment becomes stronger over time under stress. He points to Target, TJ Maxx or TJX, and Jaguar Land Rover as examples of organizations that, in his telling, effectively fell over after attacks; Jaguar Land Rover could not make cars for weeks. He connects these failures to policy mistakes. His maxim is that “all bad things happen inside of an allow rule.” Traditional security products commonly use ordered policy lists in which the first rule matching traffic is applied, even if it is not the best rule. He recalls seeing organizations put an “any, any” allow rule at the top of a firewall simply to get it running, then never remove it. In that situation, he says, the firewall is little more useful than connecting two network jacks with a coupler. Graph-based policy is preferable because it reflects relationships and context rather than just list order. Asked how resilience relates to Zero Trust, Kindervag says resilience is the outcome and Zero Trust is a method for achieving it. He cites contributor Lee-Woo-Jahn Koenig’s formulation that Zero Trust is a verb: something an organization does. Continually applying it reduces the opportunity for attackers to move across open, flat, unrestricted networks and reach sensitive assets, making the environment more resilient, stable, and potentially anti-fragile.

Cunningham describes his red-team experience and says the traditional perimeter model became obviously unattractive once he understood Kindervag’s Zero Trust approach. As an attacker, he says, an infrastructure designed around Zero Trust would make his work miserable because it would prevent easy movement. The objective is to meet the adversary where the adversary is trying to maneuver and stay with them as the attack changes. Both speakers argue that AI does not change the fundamental security problem; it changes the speed and scale. Kindervag says organizations are entering an inflection point in which manual changes and lengthy change-control meetings cannot keep up. He compares cybersecurity automation to an automobile airbag: the sensor detects a problem and the airbag deploys immediately. Waiting for a meeting before deploying it would leave the passenger dead. Likewise, defenders should be able to identify an attack against critical systems, change policy, and insert a deny rule immediately. Cunningham notes that machines are not constrained by human reaction time and says AI can make ransomware and other attacks faster. Kindervag speculates that attackers could use autonomous agents for a distributed denial-of-service swarm comparable to the Mirai botnet, although neither speaker says they have seen such an attack. Cunningham says the absence of a huge new AI-agent DDoS wave makes him wonder what attackers are doing instead and when that capability will be used. Their conclusion is that defenders can also operate at machine speed; attackers do not own that advantage.

Bittner asks how defenders can address the asymmetry between AI-enabled attackers and slower organizations. Kindervag says cyber warfare gives defenders an advantage that kinetic warfare does not: attackers still have to use network protocols, typically TCP/IP, to transmit packets. They cannot hide beneath a literal ocean or bypass the visibility and constraints built into those protocols. Defenders can use network choke points and carefully designed policy to limit what an attacker can reach. Kindervag emphasizes that a new zero-day attack does not automatically need to reach a system with a new zero-day vulnerability. An organization can place controls between the attacker and the vulnerable asset. No policy should allow an unknown resource on the public internet to reach a credit-card database, financial systems, a power plant’s programmable logic controller, or similarly sensitive assets. He says the historical mistake was effectively opening everything and assuming everyone was a good actor. Cunningham broadens the point beyond security departments. Compromise crosses platforms, infrastructure, business units, and geographies, so organizational silos do not match the way attacks occur. He says teams must plan for what happens when things go wrong rather than treating every compromise as proof that the entire security program failed. Quoting the military principle that “no plan survives first contact with the enemy,” he argues that security must be designed for response and adaptation, not just prevention.

Kindervag identifies two common Zero Trust mistakes. First, organizations acquire a product without defining what they are trying to protect. His protect surface is the inversion of the attack surface: instead of attempting to control everything, an organization identifies specific critical assets such as a credit-card database, a bank’s SWIFT system or ATM network, or a DNS server whose failure would cripple operations. Second, organizations try to deploy Zero Trust across the entire company at once, which he says generally fails. His recommendation is to proceed in small, bite-sized chunks. Start with one protect surface, then repeat the process for another. This makes the effort incremental, iterative, and non-disruptive because the largest possible mistake is confined to one protect surface and can be reversed. Kindervag says one customer told him the organization argued about Zero Trust longer than it took to build its first Zero Trust environment. For large legacy systems, he recommends beginning with something small and low-value to learn the five-step process before moving toward the “keys to the kingdom.” He changed his own view after finding that nobody at many organizations still knew how their oldest systems worked. That is why mapping transaction flows became the second step: a map may be wrong, but it prevents the organization from being lost. Cunningham tells CISOs to explain success to boards as continued operation and the absence of damaging incidents, while also framing security as a business-wide enabler. “Everyone’s in sales” is familiar, he says, but everyone is also in security because everyone benefits from keeping the business operating securely.

Near the end, Kindervag previews other chapters in Cyber Resilience at Machine Speed. Rich Mogul contributes “Zero Trust or Zero Days, Your Choice,” a high-level treatment of the project. Illumio CEO Andrew Rubin writes about moving beyond a prevention-only mindset. Don Jeske, formerly the Zero Trust lead at the Navy and the Department of Homeland Security, explains the protect surface; Kindervag says Jeske wrote his master’s thesis on the concept. Clint Bruce, a former Navy SEAL and a friend of Cunningham’s, writes about “My Paper Weapon Is a Map” and the importance of visibility. George Finney contributes on policy and has also written Project Zero Trust and Rise of the Machines: A Project Zero Trust Story. Josh Woodruff and Michelle Savage address controls needed by AI agents; they previously wrote Agentic AI plus Zero Trust, for which Kindervag wrote the foreword. Cunningham contributes the chapter on creating policy. Illumio chief product officer Mario Espinosa writes about AI’s importance to Zero Trust, and Tony Scott, former CIO of the U.S. federal government, covers the business perspective. Kindervag describes the book as the work of 14 authors, including himself, and says the contributors were selected to cover the five-step deployment model from strategy and visibility through policy, AI, and organizational outcomes.