Knowledge Network · Nov 4, 2026
Zero Trust is for Vendors: Podcast Outtake
Third-party access is where many Zero Trust programs quietly fall apart. Organizations spend heavily on internal controls, then hand vendors VPN connectivity, broad IAM roles, and long-lived API keys that bypass the very...
Traditional VPN and perimeter-based access models fail because they create overprivilege and visibility across a flat network. Once a vendor lands on the network, discovery becomes easy: if an attacker can type an internal address and reach a login page, they can start probing for a path to access. Zero Trust Network Access (ZTNA) changes the shape of the problem by creating narrow, policy-driven connections from point A to point B, reducing “land and expand” opportunities. The security goal is segmentation down to the resource level and protection of specific protect surfaces such as critical apps, systems, and sensitive data. In a Zero Trust architecture guided by NIST 800-207 and the CISA Zero Trust Maturity Model, internal location stops being a trust signal, and every request must earn access.
Full Podcast: https://www.buzzsprout.com/2120821/episodes/19712560
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Privileged access
The free VAULTS™ training: 31 minutes on privileged access review, with a worked review.
Get the free training →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →