“I personally think that this is actually the greatest time in history for ZT because machines and all these AI agents, they don't have an HR department and they're not going to complain about us telling them we don't trust them.”
CyberWire Daily · Software Engineering & Infra · October 2026
Cunningham is explaining why he contributed a chapter to John Kindervag's new book on zero trust (ZT), the security model in which nothing on a network is trusted by default. His point is that the human friction which slowed zero trust down doesn't apply to AI agents.
Transcript
…books, only great chapters. And so I reached out to 13 people that I really admire in this industry, including Dr. Chase Cunningham., and asked them to contribute a chapter. And I think we got a great book out of that because I would have maybe written a great chapter, but we got a great book.
Chase, what made you decide that this is a project that you wanted to sign on to?
Well, I mean, to be perfectly frank, if John says, hey, Chase, there's a building on fire. You should run in there. Like, I'll do it because that's just how it works. I mean, I've been working with John for so long and he's been such a great mentor. But as far as the book goes, like, I genuinely enjoy writing. The topic area was really interesting to me. And, you know, I agree with John. I personally think that this is actually the greatest time in history for ZT because machines and all these AI agents, they don't have an HR department and they're not going to complain about us telling them we don't trust them. So it really just lined up well. And John was kind enough to just kind of say, look, here's the broad scope, what I'd like you to write about and go. And, you know, I love writing. So when you turn me loose, I get after it.
Well, John, what was your organizing principle here? How did you divvy out the assignments to your co-collaborators?
Well, there's a five-step model for deploying zero trust. First, you define the protect surface, then you map the transaction flows. After that, you architect the network, the environment, decide what products need to go in, essentially. Step four is policy. So you instantiate the policy in the…
Well, Chase, let's dig into your specific chapter. Can you walk us through the topic that you covered?