Topic starter
12/07/2026 12:23 pm
TL;DR: DXC’s CISO argues that Zero Trust and AI should be treated as a paired strategy for reducing risk, improving access control, and accelerating response, while security graphs provide the data model needed to make policy enforcement and anomaly detection work at scale, according to Illumio. The governance shift is clear: resilience now depends on continuous visibility, not compliance theatre.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “The CISO’s Playbook: How DXC Is Aligning Security with Business Growth”.
Key questions
Q: How should security teams combine Zero Trust and AI in a resilience programme?
A: Treat Zero Trust as the policy framework and AI as the execution aid.
Q: Why do security graphs matter for modern access control?
A: Security graphs matter because access decisions depend on relationships, not isolated records.
Q: What breaks when microsegmentation is not tied to actual business flows?
A: Microsegmentation loses value when it is built around old network boundaries instead of real application and identity relationships.
Practitioner guidance
- Define Zero Trust as a runtime control model Map identity, device, application, and workload decisions to continuous verification rules instead of periodic checklists.
- Build a security graph around access relationships Join entitlement, traffic, and asset context so anomaly detection can see how access behaves across the environment.
- Limit blast radius with microsegmentation Segment systems and workloads by function and trust boundary so compromise in one area does not expose the wider environment.
Bottom line: Zero Trust and AI are converging into a resilience model that depends on continuous verification, context-rich policy, and faster enforcement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:36 pm
Zero Trust and AI are becoming a single resilience operating model, not two separate investments. The article reflects a broader shift away from static control ownership toward continuous decision-making across identity, device, and application layers. That matters because resilience now depends on whether policy can be applied at runtime, not whether controls exist on paper. Practitioners should treat this as a governance redesign, not a tooling refresh.
A question worth separating out:
Q: How do boards evaluate whether Zero Trust and AI are improving resilience?
A: Boards should look for evidence that the programme reduces exposure, shortens detection time, and limits blast radius when access goes wrong. If the reporting only shows control counts or compliance status, it does not prove resilience. The better test is whether the organisation can keep operating securely while adapting to change.
👉 Read our full editorial: Zero trust and AI are converging in cyber resilience strategy