Oct 20, 2026 · 34 min
Zero Trust Moves From Identity Checks to Action Control
Cloudy with a chance of outages.
As cloud services, remote work, and AI agents expand, limiting what authenticated identities can do becomes central to containing cyber risk.
- 1Authenticated identities can still be dangerous when their permissions exceed the specific action required.
- 2Mature zero-trust systems replace standing access with just-in-time network paths, sessions, credentials, and privileges.
- 3A hotel room allegedly served as the base for a phishing operation that sent nearly 480,000 fraudulent messages.
Don't miss
Roman Arutyunov reframes zero trust around controlling specific actions rather than simply authenticating identities.
The brief
The briefing surveys outages, government restrictions, ransomware, breaches, and cybersecurity hiring before turning to a deeper question: what should zero trust actually control?
Roman Arutyunov of Zage Security argues that authentication is only the starting point. In flat networks and broad-access systems, a legitimate identity can still take a risky action.
The case becomes more urgent as autonomous and agentic AI systems act at machine speed. Arutyunov says controls must govern specific actions, not merely whether access was granted.
His mature model replaces standing privileges and stale network paths with just-in-time provisioning across network paths, sessions, credentials, and privileges.
The episode closes with Japanese police allegations that two people used a Kobe hotel room, concealed a computer behind a refrigerator, and sent about 480,000 phishing messages.
Together, the discussion and case point to the same problem: security depends less on recognizing identities than on limiting what they can do, when, and where.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.