Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep128/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Zero trust asks whether something should be allowed. Zach Miller asks a different question: if it is allowed, and something blows up, how far does it go?

Zach is a cybersecurity engineer in Colorado Springs who came up through K-12 network support on a shoestring budget, defense contracting and managed services. On the side he runs Skip to Secure, where he publishes research on trust concentration and management-plane abuse, including his Blast Radius framework.

He and Aaron trace one pattern through five years of incidents. Kaseya and SaltStack in 2020 and 2021, then Stryker in 2026: each time the management platform itself became the way in, and the authority it already held decided how far the damage went. Segmentation is the fix everyone already knows. It is still a hard sell.

• Why trust is something you delegate, not a security control, and how to put a limit on it
• What Zach's blast radius framework measures: reach, scope crossing, standing privilege, human concentration, automation visibility and recoverability
• Why the same PLC with the same vulnerabilities is not the same risk on a turbine as it is on an ice machine
• Why attacks now look like a normal workday from a cloud address, not a foreign IP in the logs
• Why one any-any rule undoes 477 good ones, and why a firewall starts from deny
• Why you verify every piece of work an AI agent hands back, however good the prompt was

• 5:03 Sleeping under the conference table
• 8:30 The open proxy everyone borrowed
• 10:24 From K-12 to defense contracting
• 12:59 How careers really get built
• 16:36 Where is the puck going?
• 23:22 A heat map for the smoker
• 25:41 Verify everything the agent does
• 32:31 Attacks that look like a normal workday
• 34:33 The work laptop on the home network
• 39:15 Security is never done
• 41:39 Where the word firewall comes from
• 43:33 The same failure, five years apart
• 44:21 What blast radius measures
• 46:28 The turbine and the ice machine
• 49:43 When the right account does the wrong thing
• 51:53 A firewall with one any-any rule
• 54:08 Where to find Zach's research

Zach Miller is a cybersecurity engineer based in Colorado Springs. He started as a network and switching specialist supporting K-12 education, then moved through defense contracting, consulting and managed services into cybersecurity engineering. Through Skip to Secure, his independent research and training effort, he publishes white papers on trust concentration and management-plane abuse, including the Blast Radius framework and the LOLMgmt paper on living-off-the-land management attacks.

• Blast Radius white paper and scoring workbook: https://github.com/ridgestoneco/blast-radius
• LOLMgmt white paper: https://zenodo.org/records/21255394
• Zach on LinkedIn: https://www.linkedin...