Everyone talks about Zero Trust — but very few organizations actually know how to implement it successfully.

In this episode of CISO Tradecraft, host G. Mark Hardy is joined by George Finney, a practicing CISO who literally wrote the book on Zero Trust and has implemented it in one of the most challenging environments imaginable: higher education.

Together, they break down:

• Why Zero Trust is a strategy, not a product
• Why most Zero Trust initiatives fail due to people and politics, not technology
• How attackers exploit trust and lateral movement
• How to implement Zero Trust without destroying culture or productivity
• What changes when AI enters the trust model
• Why AI is effectively “100% trust” — and how to reduce the blast radius
• How CISOs should explain Zero Trust and AI risk to the board

George also shares practical analogies (including his now-famous restaurant model for AI) that make Zero Trust and AI security understandable for executives, IT teams, and non-technical leaders alike.

If you’re serious about:

• Preventing breaches instead of just responding to them
• Limiting lateral movement
• Securing AI-driven systems
• Turning Zero Trust from buzzword into business strategy

👉 This episode is a must-watch.

George's Books:

Rise of the Machine: https://www.amazon.com/Rise-Machines-Project-Trust-Story/dp/1394303718

Project Zero Trust: https://www.amazon.com/Project-Zero-Trust-Strategy-Aligning/dp/1119884845/

You’re working longer hours than ever… yet somehow getting less done. Sound familiar?

In this episode of CISO Tradecraft, we break down why busy has become the enemy of effectiveness and why “Busy is the New Stupid.” This isn’t about working harder or faster. It’s about understanding how your time gets attacked, how distractions persist, and how even high-performing leaders fall into productivity traps.

We introduce a practical framework inspired by MITRE ATT&CK to show: How meetings, emails, and interruptions gain initial access to your day Why multitasking and constant context-switching kill execution How “always-on” culture and people-pleasing create persistence What effective CISOs do to defend their time and focus on impact, not noise

If you’re a CISO, security leader, or executive who feels constantly busy but strategically behind, this episode will challenge how you think about productivity—and give you a better way forward.

👉 Grab the Busy Is the New Stupid template for free https://www.cisotradecraft.com/bitns

👉 Share what’s missing and help us evolve the framework

👉 Follow CISO Tradecraft for more insights on leadership, strategy, and security

Because being busy isn’t the goal. Being effective is.

CISOs are expected to anticipate the next major security failure, yet the cybersecurity market is moving too fast, too fragmented, and too noisily for any leader to clearly see what’s coming next.

AI is accelerating vendor sprawl, threat models are shifting mid-year, and every product claims to be “critical.” CISOs aren’t missing threats because they’re uninformed; they’re overwhelmed. By the time a risk is obvious, it’s already budgeted, deployed, and exploited. Boards ask “How did we not see this?” while CISOs are left defending decisions made with incomplete signals and outdated market maps.

In this episode of CISO Tradecraft, G Mark Hardy and industry analyst Richard Stiennon break down how CISOs can regain strategic foresight. Drawing on Richard’s experience at Gartner, IT Harvest, and the Security Yearbook, they share practical ways to cut through market noise, understand where AI is truly changing security, and identify emerging risks before they become incidents giving CISOs a clearer view of what matters next.