Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep128/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Zero trust asks whether something should be allowed. Zach Miller asks a different question: if it is allowed, and something blows up, how far does it go?

Zach is a cybersecurity engineer in Colorado Springs who came up through K-12 network support on a shoestring budget, defense contracting and managed services. On the side he runs Skip to Secure, where he publishes research on trust concentration and management-plane abuse, including his Blast Radius framework.

He and Aaron trace one pattern through five years of incidents. Kaseya and SaltStack in 2020 and 2021, then Stryker in 2026: each time the management platform itself became the way in, and the authority it already held decided how far the damage went. Segmentation is the fix everyone already knows. It is still a hard sell.

• Why trust is something you delegate, not a security control, and how to put a limit on it
• What Zach's blast radius framework measures: reach, scope crossing, standing privilege, human concentration, automation visibility and recoverability
• Why the same PLC with the same vulnerabilities is not the same risk on a turbine as it is on an ice machine
• Why attacks now look like a normal workday from a cloud address, not a foreign IP in the logs
• Why one any-any rule undoes 477 good ones, and why a firewall starts from deny
• Why you verify every piece of work an AI agent hands back, however good the prompt was

• 5:03 Sleeping under the conference table
• 8:30 The open proxy everyone borrowed
• 10:24 From K-12 to defense contracting
• 12:59 How careers really get built
• 16:36 Where is the puck going?
• 23:22 A heat map for the smoker
• 25:41 Verify everything the agent does
• 32:31 Attacks that look like a normal workday
• 34:33 The work laptop on the home network
• 39:15 Security is never done
• 41:39 Where the word firewall comes from
• 43:33 The same failure, five years apart
• 44:21 What blast radius measures
• 46:28 The turbine and the ice machine
• 49:43 When the right account does the wrong thing
• 51:53 A firewall with one any-any rule
• 54:08 Where to find Zach's research

Zach Miller is a cybersecurity engineer based in Colorado Springs. He started as a network and switching specialist supporting K-12 education, then moved through defense contracting, consulting and managed services into cybersecurity engineering. Through Skip to Secure, his independent research and training effort, he publishes white papers on trust concentration and management-plane abuse, including the Blast Radius framework and the LOLMgmt paper on living-off-the-land management attacks.

• Blast Radius white paper and scoring workbook: https://github.com/ridgestoneco/blast-radius
• LOLMgmt white paper: https://zenodo.org/records/21255394
• Zach on LinkedIn: https://www.linkedin...

Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep127/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Three months ago Ben Wilcox's company was running roughly 200 AI agents. When he checked the day before we recorded, it was 900. Nobody stood them up on purpose, and every one of them runs under somebody's identity.

Ben Wilcox is CTO and CISO at ProArch, which means he carries both sides of the argument: the pressure to adopt AI and move fast, and the job of answering for identity, governance and compliance when the moving fast gets ahead of the preparation. Most conversations about AI risk are one of those two people talking about the other. This one is held by somebody who cannot pass the problem across the table.

His position is not that AI is dangerous. It is that AI security does not start with securing the model, it starts with securing the environment you drop the model into: identity, access, data scope, logging and ownership. All things security teams already know how to do.

• Why agent sprawl is already here, and why the real question is who owns an agent when the person who built it leaves
• How to say no to a risky request and still give the business a path, so the work does not go to shadow AI
• Why you fork a community MCP server and keep only the 20 of its 107 tools you actually need
• The vendor due diligence question the questionnaire never asks: who can read the key, and can you get the log
• Why physical segmentation is coming back for truly critical systems, and why OT never left it
• How security review can finally run at the speed AI-built code is written

• 2:42 Plan for when something breaks
• 6:31 The risks people are ignoring
• 10:03 Build it yourself and you support it forever
• 12:51 200 agents to 900 in three months
• 20:40 Defending at machine speed
• 21:46 Physical segmentation is coming back
• 24:06 107 tools and you only need 20
• 26:46 How the conversation changes by industry
• 30:11 Still working on the fundamentals
• 31:17 Third parties and the weakest link
• 36:25 A guardrail, not a stop sign
• 41:46 Bring only the data you need
• 49:30 Did AI write the book?
• 51:20 Security finally at development speed

Ben Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, a global technology consulting and services firm specializing in cybersecurity, cloud, data and AI, and software development. With more than 25 years of experience in technology, Ben has led enterprise architecture, cybersecurity strategy, regulatory compliance, incident response and large-scale business transformation initiatives. In his dual CTO and CISO role, he helps organizations balance innovation with security, evaluating emerging technologies from both a business and a risk perspective.

• ProArch: https://www.proarch.com
• Ben on LinkedIn: https://www.linkedin.com/in/ben-wilcox/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep126/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Shadow IT used to be a server in a closet. Today it is Linda from sales uploading confidential quotes to whatever AI tool she found first, and your corporate data leaving with it.

Jack Smith has spent more than 25 years in enterprise IT, across infrastructure, networks, datacenters, cloud and incident management, and he hosts the IT Horror Stories podcast. His argument is that AI is not a new problem, it is the latest version of an old one, and that the reflex to block it at the firewall has never worked and will not work now.

Aaron and Jack get into where AI genuinely helps, where it quietly does not, and the question of what happens when a system that gives a different answer every time is asked to make a decision that has to be the same every time.

• Why blocking AI tools fails the same way blocking USB sticks and webmail failed
• The difference between a tool that optimises your work and a tool you hand your work to
• Why analytics and diagnosis are the strong case for AI, and treatment is not
• The training gap: staff get GDPR training and security training, and no AI training at all
• A one question test anyone can apply before pasting company data anywhere

• 1:19 Twenty five years, from floppy disks to AI
• 10:45 Shadow IT used to be a box in a closet
• 12:31 Why blocking it never works
• 19:53 You cannot throw people in the deep end
• 21:48 When a wrong answer can kill someone
• 25:40 The answer everybody hates: training
• 27:54 Never give AI your production environment
• 41:20 Ask who owns your AI policy
• 44:38 Who actually gets rich
• 47:08 The Times Square test

Jack Smith has spent more than 25 years working in enterprise IT across infrastructure, networks, datacenters, cloud and incident management. He hosts IT Horror Stories, a weekly podcast about real-world IT incidents, what went wrong, how they were fixed, and what we can learn from them.

• IT Horror Stories podcast: https://ithorrorstories.eu/
• "AI Is The New Shadow IT": https://ithorrorstories.eu/#rant07
• Jack on LinkedIn: https://www.linkedin.com/in/franky/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep126/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/
YouTube: https://www.youtube.com/@PrOTectITAll
Email: info@protectitall.co
X: https://twitter.com/protectitall
Facebook: https://facebook.com/protectitallpodcast

To be a guest or suggest a...