#268 - Zero Trust isn't a product (with George Finney)

Everyone talks about Zero Trust — but very few organizations actually know how to implement it successfully.

In this episode of CISO Tradecraft, host G. Mark Hardy is joined by George Finney, a practicing CISO who literally wrote the book on Zero Trust and has implemented it in one of the most challenging environments imaginable: higher education.

Together, they break down:

• Why Zero Trust is a strategy, not a product
• Why most Zero Trust initiatives fail due to people and politics, not technology
• How attackers exploit trust and lateral movement
• How to implement Zero Trust without destroying culture or productivity
• What changes when AI enters the trust model
• Why AI is effectively “100% trust” — and how to reduce the blast radius
• How CISOs should explain Zero Trust and AI risk to the board

George also shares practical analogies (including his now-famous restaurant model for AI) that make Zero Trust and AI security understandable for executives, IT teams, and non-technical leaders alike.

If you’re serious about:

• Preventing breaches instead of just responding to them
• Limiting lateral movement
• Securing AI-driven systems
• Turning Zero Trust from buzzword into business strategy

👉 This episode is a must-watch.

George's Books:

Rise of the Machine: https://www.amazon.com/Rise-Machines-Project-Trust-Story/dp/1394303718

Project Zero Trust: https://www.amazon.com/Project-Zero-Trust-Strategy-Aligning/dp/1119884845/