The Death of Castle-and-Moat Security: Why Zero Trust Is the New Currency of Cybersecurity

Remember the good old days, when IT security worked like a medieval fortress? We built high walls (firewalls), dug deep moats (DMZs), and lived in the comfortable belief that everything inside was safe. We had a "hard shell" and a "soft center." If you were in the office and plugged into the wall jack, you were one of us.

Well, I have news for you: that era is over. And it didn't end yesterday. It ended a good ten years ago.

Today, with the cloud, hybrid work, and increasingly clever attackers, the old "Castle-and-Moat" model isn't just outdated. It's dangerous. I went through an extensive report on the new Zero Trust paradigm and pulled out what matters most. Forget the dry definitions. Here's how the rules of the game are changing.

1. Trust Isn't a State. It's a Continuous Algorithm

The biggest mistake we made for years was treating trust as binary. You enter your password, and you're logged in for eight hours. Zero Trust throws that approach out the window.

In the new model, the heart of the system is the Trust Algorithm. Think of it as a real-time scoring system, a bit like a video game.

• Logging in from the office? +10 points.
• Using a company laptop? +20 points.
• But wait... your operating system is out of date? -30 points.
• Logging in at 3 a.m.? -15 points.

If your total doesn't clear the threshold, you don't get in. Or the system asks for additional verification, such as a hardware security key. It's the end of "authenticate once, trusted forever." Your session is evaluated continuously. It's a little paranoid, but these days paranoia is a virtue.

2. The Inverted Triad on the Factory Floor (IT vs. OT)

We all know the IT security triad: Confidentiality, Integrity, Availability. But what happens when you try to roll out Zero Trust in a factory or a power plant? The report sheds light on a fascinating paradox.

In industrial systems (OT), the priorities are reversed. Availability comes first. If your ultra-secure encryption system delays a signal to a PLC by a fraction of a second, it can halt a production line or cause a physical failure.

"Latency introduced by encryption systems or active port scanning can cause a PLC to fail or bring a production line to a halt."

That's why we don't encrypt everything blindly in critical infrastructure. Instead, we use "Security Overlays," digital layers that act as guards in front of old, defenseless machines. This is surgical cybersecurity, not carpet bombing.

3. AI: Your Best Friend and Your Worst Enemy

Artificial intelligence plays a dual role in Zero Trust, and it's one of the most intriguing threads in the report.

On one hand, AI is indispensable as a defender. No human can analyze logs from thousands of devices in real time to spot that Marek from accounting is suddenly uploading 5GB of data to a server in Asia. That's where UEBA (User and Entity Behavior Analytics) comes in.

On the other hand, there are deepfakes. If Zero Trust is built on identity, what happens when AI fakes your voice or face during biometric verification? Or when attackers "poison" the data your defensive system learns from (data poisoning)? We're entering the era of Zero Trust AI, where even AI models have to be treated as resources of limited trust.

4. It's No Longer a Choice. It's the Law (NIS2 and DORA)

If you think Zero Trust is just a buzzword cooked up by Silicon Valley salespeople, I have bad news. The European Union has written it into law.

• The NIS2 Directive explicitly requires "zero trust" practices.
• The DORA Regulation imposes such strict access and third-party vendor controls on the financial sector that meeting them without a Zero Trust architecture is close to impossible.

Polish banks such as PKO BP and mBank are already implementing it, for example through behavioral analytics that look at how fast you type and how you move your mouse. This isn't the future. It's the present, driven by regulation.

Summary

The Castle-and-Moat era is gone for good. Today, the network is always a hostile environment, even the one inside your office. Moving to Zero Trust isn't about buying a new box of software. It's a change in mindset.

Is your organization ready to treat every user and every device with default distrust in order to ultimately keep them safer? That's the question I'll leave you with.

Aleksander

Sources:

• NIST SP 800-207
• CISA Zero Trust Maturity Model
• NIS2 Directive
• DORA Regulation

See Also: Related Topics

Security Fundamentals

• Security Operations Center (SOC): The Complete Guide - How to build a security operations center aligned with Zero Trust principles and NIS2 requirements
• Threat Hunting: An Advanced Guide - Proactive threat hunting in a Zero Trust environment and the "Assumed Breach" philosophy
• SOAR: Security Operations Automation - How automation supports continuous verification and response in a Zero Trust architecture

Regulation and Compliance

• The NIS2 Directive in Poland: The Complete Guide - Zero Trust requirements in the context of Polish law and reporting deadlines
• GDPR and Cybersecurity: A Practical Guide to Strategy, Technology, and Operationalizing Compliance - Protecting personal data in a Zero Trust architecture
• ISO 27001: From Strategy to Implementation - Implementing ISO as part of your information security management system

Need Help Implementing Zero Trust?

Is your organization ready for a security transformation? Want to implement a Zero Trust architecture that meets NIS2 and DORA requirements? Contact us and we'll help you design and deploy a Zero Trust model tailored to your infrastructure.

What We Offer

• Security audit - an assessment of your current posture and readiness for Zero Trust
• Zero Trust roadmap - a detailed, step-by-step implementation plan with prioritized actions
• Architecture design - design of network microsegmentation, IAM policies, and continuous monitoring
• Technology deployment - implementation of IAM/MFA, SIEM/UEBA, ZTNA, PAM, and endpoint security tools
• NIS2/DORA compliance - aligning your architecture with legal and regulatory requirements
• Team training - preparing IT and security teams to operate in a Zero Trust environment
• Managed Zero Trust - a hybrid model with selected functions outsourced to an MSSP

📧 Talk to a Zero Trust expert →

Tags

#ZeroTrust #ZeroTrustArchitecture #NeverTrustAlwaysVerify #Cybersecurity #Cyberbezpieczeństwo #NIS2 #DORA #UEBA #TrustAlgorithm #IAM #MFA #NetworkSegmentation #ContinuousMonitoring #IdentityManagement #NIST #CISA #SecurityArchitecture #Deepfakes #AIinSecurity #IndustrialSecurity #OTSecurity

FAQ

What is Zero Trust Architecture?

Zero Trust Architecture (ZTA) is a security model built on the principle of "Never Trust, Always Verify." Unlike the traditional Castle-and-Moat model, Zero Trust assumes that no device or user, whether inside or outside the network, is trustworthy by default. Every request to access resources requires continuous verification of identity, device, and context.

Why did the traditional "Castle-and-Moat" model stop working?

The traditional model assumed the firewall formed a "hard shell" and everything inside the network was safe. That model broke down because of:

• Cloud computing - resources now sit outside the traditional perimeter
• Remote work - users connect from many different locations
• BYOD (Bring Your Own Device) - personal devices on the corporate network
• Advanced attacks - adversaries who get past the firewall have free rein inside the network
• Supply chains - access granted to partners and third-party vendors

How does the Trust Algorithm work in Zero Trust?

The Trust Algorithm is a real-time scoring system that continuously evaluates the level of trust for every user session. Example factors:

Positive (+):

• Logging in from the office (+10 pts)
• Company laptop (+20 pts)
• Up-to-date operating system (+15 pts)

Negative (-):

• Outdated OS (-30 pts)
• Logging in at 3 a.m. (-15 pts)
• Connecting from an unusual location (-20 pts)
• Attempting to access unusual resources (-25 pts)

If the total doesn't clear the threshold, access is blocked or additional verification is required (MFA, hardware security key).

What is UEBA and what role does it play in Zero Trust?

UEBA (User and Entity Behavior Analytics) is a technology that uses artificial intelligence to analyze user and device behavior in real time. UEBA detects behavioral anomalies that traditional systems miss, such as:

• An accountant who suddenly uploads 5GB of data to a server in Asia
• A service account active overnight with no business justification
• A user logging in from two places at once (physically impossible)

UEBA is critical to Zero Trust because it feeds behavioral context into the trust algorithm.

How does Zero Trust in IT differ from Zero Trust in OT (industrial environments)?

In industrial systems (OT, Operational Technology), the priorities of the security triad are reversed:

IT: Confidentiality → Integrity → Availability OT: Availability → Integrity → Confidentiality

In a factory or power plant, availability is king. A signal delayed by a fraction of a second can stop a production line or cause a physical failure. That's why critical infrastructure doesn't encrypt everything blindly. It relies on "Security Overlays," digital layers that act as guards in front of legacy machines.

How does AI threaten the Zero Trust model?

Artificial intelligence plays a dual role:

AI as a defender:

• Analyzes logs from thousands of devices in real time
• Detects behavioral anomalies (UEBA)
• Automates threat response

AI as a threat:

• Deepfakes - faking a voice or face during biometric verification
• Data Poisoning - corrupting the training data of defensive systems
• Adversarial AI - attacks designed specifically to fool ML models

That's what gave rise to the concept of Zero Trust AI, in which even AI models are treated as resources of limited trust and are subject to continuous verification.

Does NIS2 require Zero Trust?

Yes. The NIS2 Directive explicitly requires "zero trust" practices. Organizations in scope (essential and important entities) must implement:

• Network segmentation
• Access control based on the principle of least privilege
• Continuous monitoring and identity verification
• Supply chain security management

Without a Zero Trust architecture, meeting NIS2 requirements is nearly impossible.

What is DORA and how does it relate to Zero Trust?

DORA (Digital Operational Resilience Act) is an EU regulation that requires the financial sector (banks, investment firms, insurers) to implement strict controls over:

• Access to critical systems
• Security of third-party ICT providers
• Operational resilience against cyberattacks

DORA demands such granular access control and identity management that it can't realistically be achieved without a Zero Trust Architecture. Polish banks (PKO BP, mBank) are already deploying solutions based on behavioral analytics (how fast you type, how you move your mouse).

What does a typical Zero Trust implementation look like?

A typical Zero Trust implementation includes:

1. Asset inventory - detailed mapping of all systems, data, and users
2. Network segmentation - dividing the network into microsegments instead of one flat network
3. Identity and Access Management (IAM) - strict identity control, MFA, least privilege
4. Continuous Monitoring - ongoing monitoring of all activity
5. Device Trust - verifying devices (posture assessment) before granting access
6. Data Classification - classifying data by criticality
7. Security Overlays - in OT: security layers for legacy systems

How much does a Zero Trust implementation cost?

The cost of implementing Zero Trust depends on:

• The size of the organization
• The complexity of the infrastructure
• The maturity of existing systems

Estimates:

• Small companies (100-500 employees): PLN 100,000 - 500,000
• Mid-sized companies (500-2,000 employees): PLN 500,000 - 2,000,000
• Large companies (2,000+ employees): PLN 2,000,000 - 10,000,000+

The ROI comes quickly, though: lower breach risk (average cost: USD 4.45 million, according to IBM), regulatory compliance (avoiding NIS2 fines of up to EUR 10 million), and a smaller attack surface.

How do you start implementing Zero Trust in your organization?

Step by step:

1. Assess your current state - run a security audit and identify gaps
2. Define your "crown jewels" - which assets are the most critical?
3. Start with a pilot - pick one segment or application for your first ZT rollout
4. Deploy IAM and MFA - identity is the foundation of Zero Trust
5. Segment the network - break it into microsegments
6. Monitor and analyze - SIEM, UEBA, continuous monitoring
7. Iterate and expand - Zero Trust is a journey, not a project

Most important: Don't try to do everything at once. Zero Trust is a cultural and technical transformation, and it takes time.

What tools support Zero Trust?

Key tool categories:

• IAM/MFA: Okta, Azure AD, Ping Identity, Duo Security
• Network Segmentation: Palo Alto Networks, Cisco, VMware NSX
• SIEM/UEBA: Splunk, Microsoft Sentinel, IBM QRadar
• ZTNA (Zero Trust Network Access): Zscaler, Cloudflare Access, Akamai
• Endpoint Security: CrowdStrike, Microsoft Defender, SentinelOne
• PAM (Privileged Access Management): CyberArk, BeyondTrust, Thycotic