March 2026 - RedSeal

What Happens When AI Finds Vulnerabilities Faster Than We Can Patch Them?

/by

We’re about to find out. 

A leaked draft blog from Anthropic reveals that their next model, Claude Mythos, may represent a turning point in the attacker-defender balance, one that tips decisively toward attackers. Their own assessment describes a potential wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders. 

If the people building these models are saying this openly, the question for every security leader is simple: is your architecture ready for what’s coming? 

The Patch-and-Pray Era Is Over 

For years, the dominant security strategy has been reactive: find vulnerabilities, patch them, repeat. That model was already straining under today’s software landscape. In an AI-accelerated world where zero-days can be discovered and weaponized faster than patches can be written and deployed, it breaks entirely. 

You cannot patch your way out of a world where attackers have AI and defenders are still running manual processes. 

What Actually Works: Breaking the Attack Path 

The question organizations need to answer isn’t just “are we vulnerable?”  it’s “can an attacker actually reach our critical assets from the outside?” 

These are very different questions, and the gap between them is where RedSeal operates. 

Our digital twin continuously models your hybrid environment, IT, OT, cloud, and on-premises, mapping every path between your Internet-facing attack surface and your most critical internal systems. Even before that zero-day is known to be in your environment, RedSeal assumes possible compromises and prioritizes based on validated attack paths. This is the foundation of preemptive exposure management : not waiting for attackers to find a path, but ensuring no viable path exists in the first place. 

Three Things Organizations Should Do Now 

In light of what’s coming, here’s where to focus: 

  1. Enforce segmentation and validate it continuously. Segmentation is only effective if it’s actually working as intended. Misconfigurations, policy drift, and shadow connectivity regularly create unintended paths that bypass controls. RedSeal’s enhanced network segmentation capabilities continuously validates that boundaries between your Internet-accessible systems and critical assets are intact and alerts you when they’re not. 
  2. Know your exposure before attackers do. When a zero-day emerges, the organizations that respond in minutes, not days, are the ones with a current, accurate model of their environment. RedSeal’s Risk Radius™ prioritizes exposures by actual business impact, so your team knows exactly where to focus when time is critical.
  3. Build rapid response workflows now, not after an incident. Workarounds, compensating controls, and isolation playbooks need to exist before you need them. RedSeal’s workflow automation capabilities help security and network teams operationalize response, coordinating across tools and teams to reduce exposure fast, even when a patch isn’t yet available. 

There’s a certain irony in a warning about AI-powered cyber risk being leaked because a draft blog was left in a publicly accessible data store. It’s a reminder that some of the most consequential exposures are misconfigurations. The kind RedSeal finds every day. 

 RedSeal helps organizations see every exposure, prioritize what matters, and act with confidence before attackers do. Contact RedSeal today to learn more.  

How the DOE’s New Energy Security Strategy Changes the Game for Infrastructure Operators. A practical guide to aligning with the CESER Strategic Plan 2026-2030.

/by

The Department of Energy just did something it has never done before.

On March 19, 2026, the Office of Cybersecurity, Energy Security, and Emergency Response (CESER) released its first-ever comprehensive five-year strategic plan. This isn’t just another government report—it’s a clear signal that the federal government expects measurable progress on energy infrastructure security, and it expects it soon.

For energy sector operators, this plan fundamentally changes the conversation around cybersecurity investment and prioritization. Here’s what you need to know and how to prepare.

__________________________________________________

The Three Pillars of the CESER Strategy

The strategic plan is organized around three goals that will shape federal energy security policy through 2030:

Goal 1: Develop World-Class Security Technologies

CESER is investing heavily in advanced security capabilities, including AI-FORTS (Artificial Intelligence for Operationally Resilient Technologies and Systems). This program aims to leverage artificial intelligence to detect threats, maintain operations during incidents, and secure AI-based systems used in energy operations.

What this means for operators: The government is betting on AI-powered security, but these systems require something often overlooked—a comprehensive, accurate model of your network infrastructure. AI can only protect what it can see and understand. Before implementing AI-powered defenses, organizations need to establish foundational visibility into their cyber terrain.

Goal 2: Harden U.S. Energy Infrastructure

This is where the rubber meets the road. CESER’s Project ARMOR initiative has a specific objective: “Within a two-year period, rank and harden defense critical energy infrastructure for national security sites.”

The plan also extends beyond defense-critical facilities, calling for industry-wide hardening across generation, transmission, distribution, and supply chain infrastructure.

What this means for operators: The two-year timeline is significant. It suggests that regulators and federal partners will be looking for demonstrable evidence of infrastructure hardening—not just good intentions or compliance checklists. Operators should prepare to answer questions like:

  • What is your current attack surface across IT and OT environments?
  • Which vulnerabilities pose the greatest risk to your critical assets?
  • How are you prioritizing remediation efforts?
  • Can you demonstrate measurable risk reduction over time?

Goal 3: Respond and Recover from Incidents

CESER serves as the lead federal coordinating agency for energy sector emergencies. The plan emphasizes streamlining preparedness processes and standardizing emergency response capabilities.

What this means for operators: Organizations that have documented their network infrastructure and attack paths will be better positioned to respond effectively during incidents. When every minute counts, understanding how systems are connected and how attackers could move laterally becomes critical for containment and recovery.

__________________________________________________

The Challenge You’re Probably Facing

If you’re like most energy sector security leaders, you’re dealing with a familiar set of problems:

Too many vulnerabilities, too little context. Traditional vulnerability scanners can identify thousands of issues, but they can’t tell you which ones actually threaten your most critical assets. You end up with a backlog that grows faster than you can remediate.

IT/OT convergence creates blind spots. As operational technology becomes more connected, the attack surface expands. But many security tools weren’t designed for OT environments, creating visibility gaps precisely where risk is highest.

Cloud solutions don’t work everywhere. Many security platforms require internet connectivity, which simply isn’t an option for air-gapped control rooms and sensitive OT environments. This leaves critical infrastructure with fewer security options than typical enterprise IT.

Resource constraints are real. The CESER plan itself acknowledges that budget pressures are forcing the agency to “do more with less.” Energy operators face the same challenge—smaller teams, larger attack surfaces, increasing threat levels.

__________________________________________________

A Different Approach: From Vulnerability Lists to Continuous Threat Exposure Management

The CESER strategy emphasizes resilience—the ability to maintain operations through adverse conditions and recover quickly from disruptions. This requires a fundamentally different approach to security—one that aligns closely with Gartner’s Continuous Threat Exposure Management (CTEM) framework.

Gartner introduced CTEM as a strategic approach that shifts organizations from reactive vulnerability management to proactive, continuous exposure reduction. The framework consists of five stages: scoping, discovery, validation, prioritization, and mobilization. It’s no longer enough to simply find vulnerabilities; organizations must continuously identify which exposures actually matter and drive remediation of the highest-risk issues.

RedSeal is recognized in Gartner’s Exposure Management market, and for good reason. Our platform directly supports the CTEM methodology:

CTEM Stage Traditional Approach RedSeal Approach
Scoping Asset inventories that are often incomplete or outdated Cyber terrain mapping that reveals all connected assets—including shadow IT and OT
Discovery Vulnerability scans that produce thousands of findings Attack path analysis that identifies which vulnerabilities create actual risk
Validation Theoretical severity scores (CVSS) Real-world exploitability based on network topology and attacker reachability
Prioritization Remediate by severity score Remediate by attack path risk to critical assets
Mobilization Tickets assigned without context Prioritized remediation with clear risk context and measurable outcomes

The CESER plan’s emphasis on “measurable hardening progress” and “two-year objectives” aligns perfectly with CTEM principles. Energy operators need to demonstrate not just that they’re finding issues, but that they’re systematically reducing their exposure over time.

This is the shift from asking “What vulnerabilities do we have?” to “How could an attacker reach our critical assets?”—and ultimately to “Can we prove our exposure is decreasing?”

Attack path analysis models your network topology to understand how systems are connected and how an attacker could move from an initial access point to critical assets. Combined with CTEM’s continuous methodology, this transforms security from an endless list of problems into a focused, measurable exposure reduction program—exactly what CESER is expecting operators to demonstrate.

__________________________________________________

Aligning with CESER’s Two-Year Hardening Mandate

With Project ARMOR’s two-year timeline for infrastructure hardening, energy operators need a structured approach to demonstrate progress. Here’s a practical framework:

Phase 1: Establish Baseline (0-90 days)

Before you can harden infrastructure, you need to know what you’re hardening. This phase focuses on:

  • Mapping your cyber terrain across IT and OT environments
  • Identifying all network connections, including third-party and vendor access
  • Establishing an attack surface baseline
  • Documenting critical asset inventory and dependencies

Phase 2: Prioritize and Plan (90-180 days)

With visibility established, focus on what matters most:

  • Identify attack paths that pose the greatest risk to critical assets
  • Prioritize vulnerabilities based on actual exploitability, not just severity scores
  • Develop remediation roadmap aligned with operational constraints
  • Establish metrics for measuring hardening progress

Phase 3: Execute and Verify (180+ days)

Implementation with accountability:

  • Execute prioritized remediation actions
  • Verify hardening effectiveness through continuous modeling
  • Document before/after risk posture
  • Prepare evidence for regulatory and stakeholder inquiries

__________________________________________________

The Air-Gapped Reality

One aspect of the CESER strategy that deserves particular attention is its focus on operational technology environments. The plan explicitly prioritizes securing control systems—the physical processes that keep energy flowing.

For many energy operators, this means securing environments where cloud connectivity is prohibited. Control rooms, SCADA systems, and industrial control systems often operate in air-gapped or highly restricted networks.

This creates a significant challenge: many modern security platforms are cloud-native or require internet connectivity for full functionality. When evaluating security solutions, energy operators should ask:

  • Does this tool work without internet connectivity?
  • Can it be deployed entirely on-premise?
  • Will it function in our OT environment without introducing new risk?

The ability to operate in air-gapped environments isn’t a nice-to-have for energy security—it’s a requirement.

__________________________________________________

Automation Without Cloud Dependency

The CESER plan also emphasizes the need for automation and AI to scale security capabilities. With limited staff and expanding attack surfaces, automation is essential for keeping pace with threats.

But automation in OT environments requires careful consideration. Cloud-based automation platforms may not be suitable for air-gapped infrastructure. On-premise workflow automation that can operate without internet connectivity offers a path forward.

When evaluating automation capabilities, consider:

  • Can security workflows run entirely on-premise?
  • Does the automation integrate with existing OT security tools?
  • Can incident response processes be automated without introducing operational risk?

__________________________________________________

What Success Looks Like

As the CESER strategy moves from plan to implementation, energy operators will increasingly be asked to demonstrate security progress. Success looks like:

Measurable risk reduction. Instead of vulnerability counts going up, risk scores going down. Attack paths being eliminated, not just vulnerabilities being patched.

Documented due diligence. Clear evidence that leadership has visibility into the attack surface and is making informed decisions about where to invest security resources.

Operational resilience. The ability to maintain critical operations during adverse conditions and recover quickly from incidents.

Regulatory readiness. Documentation and evidence prepared for NERC CIP compliance, federal inquiries, and stakeholder questions about security posture.

__________________________________________________

The Bottom Line

The DOE’s CESER Strategic Plan 2026-2030 represents a significant milestone in federal energy security policy. For the first time, there’s a clear expectation of measurable progress on infrastructure hardening within a defined timeframe.

Energy operators who can demonstrate visibility into their attack surface, prioritize remediation based on actual risk, and operate security capabilities in OT environments will be well-positioned to meet these expectations.

The strategy is clear. The timeline is defined. The question now is execution.

__________________________________________________

At RedSeal, we help energy sector organizations implement Continuous Threat Exposure Management (CTEM) by mapping their cyber terrain, identifying attack paths that matter, and operating security capabilities entirely on-premise—including in air-gapped OT environments. Recognized in Gartner’s Exposure Management market, our platform is trusted by organizations across power generation, pipeline operations, and federal energy laboratories to continuously measure and reduce their exposure.

Report Studio

RedSeal Expands Exposure Management Platform with Report Studio and Network Segmentation

/by

New capabilities deliver flexible, board-ready reporting and expose configuration gaps and improper access paths to provide a more complete view of organizational attack surface risk 

Menlo Park, CA – March 24 2026 – RedSeal, a pioneer in AI powered exposure management for hybrid enterprise environments, today announced an expansion to the RedSeal platform with the introduction of RedSeal Report Studio and Network Segmentation capabilities. Together, these enhancements help security and network teams better understand, communicate, and reduce risk across complex enterprise and operational technology (OT) environments. 

Security teams today face growing pressure to demonstrate measurable risk reduction, communicate clearly with executives and boards, and meet a widening set of compliance and regulatory requirements. At the same time, organizations must manage exposures that extend beyond traditional vulnerabilities, including configuration weaknesses and unintended network access paths. 

RedSeal delivers exposure management through a proven, architecture-driven foundation powered by AI and Agentic capabilities, enabling organizations to move from insight to action with confidence. The latest release addresses security teams growing challenges, making it easier to understand exposure across the network and communicate that risk effectively to stakeholders. 

“With these new capabilities, RedSeal is helping organizations see their true attack surface and clearly communicate and reduce that risk,” said Joseph Ward, Chief Technology and Product Officer at RedSeal. “Security leaders need visibility into how exposures connect across their environment and the ability to explain that risk to executives and boards. Report Studio and Network Segmentation deliver both.” 

Report Studio: Flexible, Board-Ready Security Reporting 

RedSeal Report Studio provides security and networking teams with a flexible, drag-and-drop reporting experience built directly into the RedSeal platform. The capability allows organizations to build customized reports without coding or reliance on consultants. 

While many security teams rely on static, pre-built reports that fail to reflect the complexity of modern environments, Report Studio enables organizations to tailor reporting their architecture, operational priorities, and compliance frameworks. 

Using an intuitive interface, teams can assemble reports with tables, charts, and heatmaps drawn from RedSeal’s exposure model, network topology, vulnerability data, compliance checks (including CIS and STIG), and custom scopes. 

Key capabilities include: 

  • Drag-and-drop report creation using pre-built query blocks and visualizations 
  • Support for vulnerability, exposure, topology, and compliance reporting 
  • Customizable reports for executives, analysts, auditors, and operational teams 
  • Built-in branding with corporate logos, labels, and terminology for board-ready deliverables 
  • Reduced dependence on manual report building or third-party services 

By enabling teams to present exposure trends, segmentation posture, and remediation progress clearly, Report Studio helps organizations communicate risk reduction and operational progress across technical and executive audiences. 

Network Segmentation: Visibility Beyond Vulnerabilities 

While vulnerability scanners focus primarily on CVEs, many real-world exposures stem from misconfigurations, overly permissive access policies, and segmentation failures that create unintended pathways across the network. 

RedSeal’s new Network Segmentation capability extends exposure analysis beyond vulnerabilities to reveal these architectural risks. 

Using RedSeal’s network digital twin, security teams can analyze reachability across hybrid and cloud environments to identify configuration gaps and improper access paths that could allow attackers to move laterally toward critical assets. 

With Network Segmentation, organizations can: 

  • Identify misconfigured network boundaries that create unintended attack paths 
  • Detect improper access between segments that violate least-privilege policies 
  • Understand how vulnerabilities combine with network access to create real exposure 
  • Prioritize remediation based on business impact rather than CVSS scores alone 
  • Continuously validate segmentation across hybrid IT and OT environments 

By combining segmentation visibility with RedSeal’s exposure analysis, organizations gain a more complete understanding of their attack surface and the architectural controls required to reduce risk. 

These enhancements reinforce RedSeal’s mission to help enterprise security teams move from reactive vulnerability management to preemptive exposure management , giving organizations the clarity and confidence to understand their network, communicate risk, and take decisive action. 

RedSeal Report Studio and Network Segmentation are available today. 

For more information, visit www.redseal.net. 

About RedSeal 

RedSeal, a pioneer in AI powered -exposure management and winner of the SC Award for Best Continuous Threat Exposure Management (CTEM) Solution, helps organizations see, understand, and secure hybrid digital environments across IT (on-prem, cloud, remote workers), OT, and IoT. Its patented modeling uncovers hidden assets, misconfigurations, and attack paths, prioritizes exposures by business impact with Risk Radius™, and validates compliance. Trusted by Fortune 1000 companies and U.S. military branches, RedSeal strengthens resilience and reduces business risk. Visit www.redseal.net.  

Best CTEM

RedSeal is a Finalist in the 2026 SC Awards

/by

RedSeal Honored as Finalist of the 2026 SC Awards in the Continuous Threat Exposure Management (CTEM) Solution Category

Menlo Park, CA March 18, 2026 — RedSeal, a pioneer in AI-enabled preemptive exposure management , is proud to announce that it has been named a finalist in the prestigious 2026 SC Awards. RedSeal has been recognized in the Continuous Threat Exposure Management (CTEM) Solution category, underscoring its commitment to excellence and leadership in the cybersecurity industry. The SC Awards, now in its 29th year, recognize the solutions, organizations, and individuals that have demonstrated outstanding achievement in advancing the security of information systems.

A complete list of 2026 SC Awards finalists is available on SC Media here: https://www.scworld.com/sc-awards-finalists

The 2026 SC Awards entries were evaluated across 33 specialty categories by a distinguished panel of judges, comprised of cybersecurity professionals, industry leaders, and members of the CyberRisk Alliance CISO community, representing sectors such as healthcare, financial services, education, and technology.

This year, all finalists are invited to the SC Awards Reception, where the 2026 winners will be announced on Tuesday, March 24, 2026, at RSAC in San Francisco.  Finalists will receive priority access to two reserved spots at the reception. Finalists will also have the opportunity to record interviews with the CyberRisk TV production team onsite at RSAC 2026. These interviews will highlight each finalists’ innovation, technology, or individual achievement, and will be published across SC Media channels to amplify SC Awards recognition.

“The SC Awards celebrate excellence and innovation in cybersecurity, recognizing the people and technologies driving real progress,” said CyberRisk Alliance Chief Content Officer Kelley Damore.  “Being named a finalist is a mark of credibility and trust — a powerful validation from peers and experts who understand what it takes to deliver real-world security impact.”

“After being honored last year, it’s incredibly rewarding to be recognized again by the SC Awards. Over the past year, we’ve focused on advancing our mission to enable organizations to secure their hybrid digital environments by revealing and prioritizing what is truly exposed,” said RedSeal CEO, Greg Enriquez. “We’ve worked to close critical gaps in Continuous Threat Exposure Management by connecting visibility to prioritization and adding AI-driven, automated action, enabling teams to understand their exposure and quickly and efficiently reduce it. In an increasingly complex threat landscape, our commitment is to give security leaders the clarity and confidence to protect what matters most.”

Throughout the month, SC Media’s editorial team will feature in-depth coverage of each finalist on SC Media’s website at www.scworld.com/sc-awards, along with promoting finalists across SC Media’s social media channels on LinkedIn and Twitter as well as RedSeal chanels

About RedSeal

RedSeal, a pioneer in preemptive exposure management and winner of the 2025 SC Award for Best Continuous Threat Exposure Management (CTEM) Solution, helps organizations see, understand, and secure hybrid digital environments across IT (on-prem, cloud, remote workers), OT, and IoT. Its patented modeling uncovers hidden assets, misconfigurations, and attack paths, prioritizes exposures by business impact with Risk Radius™, and validates compliance. Trusted by Fortune 1000 companies and U.S. military branches, RedSeal strengthens resilience and reduces business risk. Learn more  www.redseal.net.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through its trusted information brands, network of experts, and more than 250 annual events, CRA delivers actionable insights and serves as a powerful extension of cybersecurity marketing teams. Its brands include SC World, the Official Cybersecurity Summits, Identiverse, InfoSec World, CyberRisk Collaborative, Security Weekly, ChannelPro, ChannelE2E, MSSP Alert, ExecWeb, LaunchTech Communications, and CyberRisk TV.

Learn more at www.cyberriskalliance.com.

 

Project Zero Trust: What Security Leaders Can Learn and How RedSeal Helps You Get There

/by

Security transformation initiatives fail for reasons that have nothing to do with technology. They fail because organizations treat security as a technical problem rather than a strategic one. They fail because security teams operate in isolation, implementing controls that break business workflows. They fail because leadership cannot articulate risk in terms that resonate with the business. George Finney’s Project Zero Trust confronts these realities head-on through a compelling narrative about a new CISO navigating organizational resistance while modernizing an enterprise security strategy. The book’s central thesis carries profound implications for how organizations should approach Zero Trust implementation: security transformation succeeds only when security, IT, and the business align around risk and outcomes.

The Castle-and-Moat Model is Broken

The traditional castle-and-moat security model has crumbled under the weight of modern enterprise reality. This model operated on a seductively simple assumption that everything inside the network perimeter could be trusted. Once an attacker breached the perimeter, they gained access to a flat network where systems trusted each other implicitly, where excessive permissions created sprawling attack surfaces, and where lateral movement proceeded largely unimpeded. The model assumed that defenders could identify and fortify a clear boundary between trusted insiders and untrusted outsiders.

Cloud adoption, remote work, mobile devices, third-party integrations, and hybrid infrastructure have rendered this assumption not merely outdated but dangerous. Zero Trust replaces the castle-and-moat mentality with a fundamentally different principle: never trust, always verify. This principle, formalized in the National Institute of Standards and Technology’s Zero Trust Architecture publication (SP 800-207), acknowledges that trust must be earned continuously rather than granted implicitly based on network location.

Zero Trust is a Strategy, Not a Product

Zero Trust is a strategy, not a product. This distinction cannot be overstated because vendors have aggressively marketed Zero Trust solutions that promise transformation through procurement. The book methodically dismantles this misconception. Zero Trust cannot be purchased as a single technology, cannot be reduced to identity management alone, and cannot be achieved through microsegmentation in isolation. Real Zero Trust requires architecture redesign, governance restructuring, and process transformation.

The framework encompasses several key components that reinforce each other:

  • Identity verification across all users and services
  • Network segmentation that limits blast radius
  • Device trust assessment that evaluates endpoint posture
  • Continuous monitoring that detects anomalous behavior
  • Least privilege access that grants only necessary permissions

Implementing any component in isolation yields limited protection. The power of Zero Trust emerges from the integration of these elements into a cohesive security architecture.

Visibility is the Foundation

Visibility serves as the foundation for everything that follows in a Zero Trust journey. The book returns to this theme repeatedly because it represents the most common and consequential failure point in security transformation initiatives. Organizations cannot enforce Zero Trust policies without understanding their environment, yet many organizations proceed with implementation while harboring significant blind spots about network topology, asset inventory, data flows, trust relationships, and attack paths.

These visibility gaps transform Zero Trust from an operational security model into a theoretical exercise. Policies get written for environments that no longer exist or never existed as documented. Controls get deployed around assets that have been decommissioned or migrated. Trust relationships persist undiscovered in shadow IT environments. Attack paths remain open because nobody mapped the connectivity that enables them. Without visibility, Zero Trust becomes security theater.

From Attack Surfaces to Protect Surfaces

The book introduces a critical conceptual shift from attack surfaces to protect surfaces. Traditional security approaches attempt to protect everything, which effectively means protecting nothing with adequate depth. Zero Trust thought leader John Kindervag proposed focusing on protect surfaces instead—the critical assets that would cause the most damage if compromised.

Protect surfaces include:

  • Sensitive data repositories
  • Business-critical applications
  • Essential services
  • Foundational infrastructure components

The strategy proceeds in four phases:

  1. Identify protect surfaces to understand what matters most
  2. Map transaction flows to see how systems communicate with protect surfaces
  3. Build segmentation around protect surfaces to isolate them from less trusted network zones
  4. Enforce policy through continuous verification and monitoring

This focused approach concentrates security investments where they matter most rather than spreading resources thin across an expanding attack surface.

Business Alignment is Critical

Business alignment emerges as perhaps the most overlooked success factor in Zero Trust implementation. The book illustrates how security transformation fails when security teams work in isolation from the business units they serve. Controls that break business workflows generate resentment and workarounds that undermine security. Executives who do not understand risk cannot make informed decisions about security investments. Projects that cannot demonstrate business value lose funding and organizational support.

Successful Zero Trust programs connect security controls directly to business outcomes, risk reduction, and operational resilience. They speak the language of business impact rather than technical vulnerability. They position security as an enabler rather than an obstacle.

Where RedSeal Fits in the Zero Trust Model

RedSeal occupies a critical position in the Zero Trust ecosystem by addressing the visibility and validation requirements that the book identifies as foundational. The platform’s core capability of cyber terrain mapping directly supports the discovery and understanding phase that must precede any successful Zero Trust implementation. Before organizations can segment networks, enforce least privilege, or verify trust relationships, they must understand what exists, how it connects, and where exposure lies.

Zero Trust Requires Network Visibility

Network visibility requirements for Zero Trust extend far beyond asset inventories. Organizations must understand network topology at the routing layer, comprehend how firewall rules interact to permit or deny traffic, and map the trust relationships that exist between network segments.

RedSeal provides this depth of visibility through:

  • Network modeling that reveals actual connectivity patterns
  • Attack path analysis that shows how an attacker could traverse from any point to critical assets
  • Policy validation that confirms firewall rules behave as intended
  • Segmentation analysis that identifies gaps in network isolation

These capabilities directly support the book’s emphasis on environmental understanding as the prerequisite for policy enforcement.

Mapping Protect Surfaces

The concept of protect surfaces aligns naturally with RedSeal’s analytical capabilities. Organizations implementing Zero Trust must identify their critical assets and understand how those assets communicate with the broader environment.

RedSeal helps security teams:

  • Identify critical assets through exposure analysis that reveals which systems face the greatest risk
  • Map communication patterns that show how data and services flow to and from protect surfaces
  • Determine exposure paths that reveal which network routes could be exploited to reach critical assets

This analysis enables informed decisions about where segmentation should occur, which systems require isolation from the broader network, and which policies most effectively protect critical assets.

Identifying Lateral Movement Paths

Lateral movement represents one of the most significant threats that Zero Trust aims to address. Once an attacker gains initial access to an environment, they seek to expand their foothold by moving laterally through the network toward valuable targets. Traditional network architectures often facilitate this movement through flat network segments, excessive trust relationships, and permissive firewall rules.

RedSeal analyzes firewall rule sets, network paths, and access relationships to reveal:

  • Potential lateral movement routes that attackers could exploit
  • Over-permissive access that violates least privilege principles
  • Segmentation gaps that allow unauthorized connectivity between network zones

This visibility enables security teams to close lateral movement paths before attackers discover them.

Validating Segmentation and Policy

Validation represents the often-neglected final phase of Zero Trust implementation. Organizations deploy segmentation policies, configure access controls, and implement verification mechanisms, but they frequently lack the capability to confirm that these controls work as intended.

RedSeal addresses this gap through simulation capabilities that:

  • Model attack paths across the network environment
  • Test network reachability between segments to confirm isolation
  • Validate policy enforcement to ensure rules behave as documented

These capabilities allow security teams to confirm that segmentation policies effectively isolate protect surfaces, access controls enforce least privilege across all paths, and trust relationships have been reduced to minimum necessary levels. Validation transforms Zero Trust from a design intention into a verified operational state.

How RedSeal Aligns to a Zero Trust Implementation Journey

Zero Trust Phase What the Book Describes Where RedSeal Helps
Discover Understand environment Network topology mapping
Protect Surfaces Identify critical assets Asset exposure analysis
Map Flows Understand communication paths Traffic and connectivity modeling
Architect Design segmentation Segmentation planning
Enforce Implement policies Policy validation
Monitor Continuously assess exposure Attack path analysis

 

Positioning RedSeal in Your Zero Trust Initiative

RedSeal supports the “visibility and validation” layer of Zero Trust. It answers critical questions that security leaders must address:

  • What systems can reach my critical assets?
  • Are my segmentation policies actually working?
  • What attack paths exist in my network?
  • How exposed is my environment?

In Zero Trust terms, RedSeal helps organizations understand and validate trust relationships across the network. This foundational capability enables the strategic transformation that Project Zero Trust advocates—the alignment of security, IT, and the business around risk and outcomes.

The Bottom Line

Project Zero Trust teaches that Zero Trust is a strategic transformation requiring security and business alignment, built on a foundation of visibility and environmental understanding. RedSeal supports this strategy by mapping network trust relationships, identifying exposure paths, validating segmentation policies, and enabling organizations to operationalize Zero Trust architecture.

Without visibility, there is no Zero Trust—only assumptions. RedSeal provides the visibility that transforms Zero Trust from concept to reality.  Contact us today to learn more.

When OT Is Targeted, “Best Practices” Aren’t Enough

/by

The FBI’s recent advisory regarding anticipated Iranian retaliation against U.S. organizations was direct and grounded in real investigations. The recommended actions were clear: 

  • Disconnect OT/ICS assets from the public internet 
  • Change default passwords 
  • Implement phish-resistant MFA for OT access 
  • Patch internet-facing systems 
  • Rehearse incident response plans 

These aren’t theoretical mitigations. Iranian-affiliated actors have already compromised programmable logic controllers (PLCs) and human-machine interfaces (HMIs) in U.S. critical infrastructure by exploiting known vulnerabilities and factory-default credentials on internet-connected systems. But here’s the uncomfortable reality most security leaders already sense: most organizations believe they’ve already implemented these controls. And yet, pathways still exist. 

The Real Problem Is Architectural Drift, Not Negligence 

Very few OT environments are intentionally exposed to the public internet. The problem is rarely a deliberate configuration, it’s what happens over time. Operational changes introduce complexity: vendor remote access exceptions, firewall rule updates, cloud integrations, temporary workarounds that quietly become permanent. A misconfigured route here. A legacy trust relationship there. A VPN that terminates deeper into the network than anyone realized. 

The result isn’t “OT on the internet.” The result is a reachable path from the internet to OT. Attackers don’t require direct exposure. They require connectivity. 

Disconnecting OT Is Harder Than It Sounds 

The FBI’s guidance assumes something foundational: that you actually understand how access flows through your environment. If a credential is phished and used to authenticate via VPN, where does that session terminate? What segmentation controls prevent lateral movement from there? Is there a route from a compromised IT system to an OT subnet? Does “deny by default” function as intended, or are legacy rules quietly permitting access nobody remembers approving? 

Without real visibility into reachability, segmentation becomes an assumption, not a verified control. And in OT environments, assumptions are expensive. 

OT Simply Doesn’t Protect Itself the Way IT Does 

In traditional IT environments, organizations lean on endpoint detection and response, rapid patching cycles, and automated isolation. In OT environments, most of those controls are impractical or impossible. Devices are often legacy or vendor-controlled. Patching windows are constrained by production schedules. Downtime carries real physical and financial consequences.  

Because OT systems often can’t be hardened the way IT systems can, the most reliable defensive strategy is architectural: make them unreachable. If an attacker can’t reach OT systems, they can’t disrupt them. That’s not a workaround, it’s the right design principle for these environments. 

Prioritization Is the Missing Piece 

“Patch internet-facing systems” is good advice. It’s also incomplete. Security teams are staring down thousands of vulnerabilities, and not all of them carry equal risk.  The critical question isn’t: What is vulnerable? It’s: Which vulnerabilities create a pathway to high-value OT assets? 

A medium-severity vulnerability with network connectivity into an operational environment may represent far greater business risk than a critical CVE sitting isolated inside a segmented IT enclave. Without understanding reachability, remediation becomes reactive and teams end up patching loudly while the actual exposure goes unaddressed. 

Destructive OT Attacks Are a Different Category of Risk 

When manufacturing lines go down, when water treatment is disrupted, when power generation is interrupted the consequences extend well beyond financial or reputational damage. They become physical. They become societal. That’s why eliminating unintended connectivity between internet-accessible systems and OT assets is a resilience imperative. 

Moving From Checklist to Actual Assurance 

The FBI’s recommendations reflect the gaps adversaries consistently exploit: simple weaknesses in consequential environments. But closing those gaps sustainably requires more than changing passwords and applying patches. It requires being able to answer one question with confidence: 

If an internet-facing system is compromised today, what can the attacker actually reach? 

If the answer includes OT assets, the risk remains regardless of how many checklist items are marked complete. If the answer is confidently “nothing in OT,” the architecture is working as intended. That’s the difference between compliance and assurance. But how do you know? 

See Every Asset. Understand Every Risk. Close Every Gap. 

RedSeal gives security teams a unified, business-contextual view of the entire hybrid environment across IT (on-prem, cloud, remote workers), OT, and IoT so you can identify unintended pathways and validate that segmentation is actually doing what you think it’s doing. 

By understanding reachability, not just vulnerability scores, teams can prioritize remediation where it matters most and confirm that critical operational systems remain inaccessible to attackers. 

In today’s threat environment, exposure isn’t defined by what’s vulnerable but is defined by what’s reachable. And for OT environments, reachability is everything. 

We’d love to walk through what this looks like in your environment, contact the RedSeal team today to learn more. 

Get the latest news, invites to events, and threat alerts

CONTACT US
Distinguished Vendor badge 2025

NEW Gartner® Report, Emerging Tech: The Future of Exposure Management is Preemptive.Download Report.
Footer
Connect on LinkedIn