Evolution of Zero Trust: Adapting and Utilising CISA’s Zero Trust Maturity Model in an AI World
While the CISA Zero Trust Maturity Model 2.0 has successfully unified security posture for traditional assets, it faces a fundamental architectural blind spot: autonomous AI intent. Our existing security pillars – Identity, Devices, Networks, Applications, and Data – effectively enforce technical controls, but they lack the governance capacity to interpret, scope, and authorize the autonomous decisions of AI agents. We are currently facing a structural accountability vacuum where AI interactions bypass existing telemetry streams and security teams remain fragmented.
In this session, we will move beyond the theoretical and introduce an evolved hybrid architecture: the “6th Pillar for AI & Autonomous System.” This proposal does not require a wholesale re-tooling of your existing security stack. Instead, we define the 6th Pillar as the central Policy Authority responsible for AI model lifecycle governance, agent capability scope, and regulatory compliance (including ISO 42001 and the EU AI Act). The original five pillars continue to serve as the critical Enforcement Points, executing the policies defined by the AI governance layer.
Key Takeaways for CXOs and Practitioners:
- Operational Clarity: Understand why current pillar-based teams fail to govern AI and how to restructure accountability using a Policy Authority vs. Enforcement Point hybrid model.
- Regulatory Readiness: Learn how to map AI controls to ISO 42001, NIST AI RMF, and the EU AI Act to ensure audit-ready compliance.
- Actionable Roadmap: Gain a phase-based implementation strategy – from identifying “Shadow AI” and mapping agent identities to automating safety evaluation gates in the CI/CD pipeline.
- Maturity Measurement: Utilize a new AI-specific maturity scorecard to benchmark your organization’s progress from reactive, ad-hoc AI usage to a mature, fully instrumented, and defensible security program.
Mithilesh Kumar – Netskope
Mithilesh Kumar is Head of Zero Trust Strategy at Netskope, where he leads the company’s Zero Trust transformation. With over 20 years of experience, he turns complex security problems into practical roadmaps aligned with business priorities.
His central idea: in an agentic world, trust can’t be a one-time gate. It must stay continuous, contextual and measurable, so organisations can adopt AI with confidence.