CISO Executive Intelligence Series

Zero Assumptions

Zero Assumptions is Ciptor's series for CISOs, CIOs, and IT leaders. Each volume addresses a common assumption in identity security, shows what actually happens, and outlines a target architecture with concrete steps.

Pillar 1 · Vol. 1–5

Attacker tactics and validation

Vol. 1 of 25

Endpoint illusion

Your EDR dashboard looks normal. The penetration test passed. The SOC team playbooks are in place. The unspoken assumption is that the EDR solution detects an attacker's lateral movement and that the team reacts in time. That assumption is rarely tested.

Vol. 1 of 25

Endpoint illusion

Your EDR dashboard looks normal. The penetration test passed. The SOC team playbooks are in place. The unspoken assumption is that the EDR solution detects an attacker's lateral movement and that the team reacts in time. That assumption is rarely tested.

Vol. 2 of 25

Network-delivered codes offer false security

SMS and push codes are perceived as a meaningful second layer of defence. Today, attackers have access to industrialised interception tools. The channel was never the defence. The shared secret is the weakness.

Vol. 2 of 25

Network-delivered codes offer false security

SMS and push codes are perceived as a meaningful second layer of defence. Today, attackers have access to industrialised interception tools. The channel was never the defence. The shared secret is the weakness.

Vol. 3 of 25

The open helpdesk door

The helpdesk is the only place where a human must be able to override the authentication system. Audio and video deepfake tools are now consumer products. This makes the helpdesk the point in your environment where attackers most frequently attempt to bypass controls.

Vol. 3 of 25

The open helpdesk door

The helpdesk is the only place where a human must be able to override the authentication system. Audio and video deepfake tools are now consumer products. This makes the helpdesk the point in your environment where attackers most frequently attempt to bypass controls.

Vol. 4 of 25

Sovereign hardware risk

FIDO2 certification tests the authentication protocol. It does not test the physical chip that executes the operations. The manufacturing location of the security key is rarely specified in procurement requirements. This is precisely why attackers target the supply chain.

Vol. 4 of 25

Sovereign hardware risk

FIDO2 certification tests the authentication protocol. It does not test the physical chip that executes the operations. The manufacturing location of the security key is rarely specified in procurement requirements. This is precisely why attackers target the supply chain.

Vol. 5 of 25

The blind spot of hybrid infrastructure

Cloud SSO may be protected while legacy on-premises systems are not. Attackers target the seam between them, where a unified policy is missing.

Vol. 5 of 25

The blind spot of hybrid infrastructure

Cloud SSO may be protected while legacy on-premises systems are not. Attackers target the seam between them, where a unified policy is missing.

Pillar 2 · Vol. 6–10

The software stack and contextual risk

Vol. 6 of 25

Risk assessment integration

Annual penetration tests provide a snapshot. Identity risk is continuous. Most incidents begin in the gap between two assessments, as permissions accumulate, contractor accounts remain active after projects end, and service accounts multiply without triggering alerts.

Vol. 6 of 25

Risk assessment integration

Annual penetration tests provide a snapshot. Identity risk is continuous. Most incidents begin in the gap between two assessments, as permissions accumulate, contractor accounts remain active after projects end, and service accounts multiply without triggering alerts.

Vol. 7 of 25

Session token vulnerability

Strong authentication at login assumes the session remains trusted until it expires. Stolen session tokens bypass authentication entirely. In your logs, a hijacked session looks identical to normal user behaviour.

Vol. 7 of 25

Session token vulnerability

Strong authentication at login assumes the session remains trusted until it expires. Stolen session tokens bypass authentication entirely. In your logs, a hijacked session looks identical to normal user behaviour.

Vol. 8 of 25

The shift in board liability under NIS2

NIS2 Article 20 designates the management body as responsible for managing cybersecurity risks. This goes beyond approving the budget. For essential entities, it also includes the power to suspend a member of the management body from exercising managerial functions in the event of severe or repeated non-compliance.

Vol. 8 of 25

The shift in board liability under NIS2

NIS2 Article 20 designates the management body as responsible for managing cybersecurity risks. This goes beyond approving the budget. For essential entities, it also includes the power to suspend a member of the management body from exercising managerial functions in the event of severe or repeated non-compliance.

Vol. 9 of 25

Real-time orchestration of security signals

Security tools generate signals in isolation. An impossible travel alert and a lateral movement alert triggered minutes apart may stem from the same attack. They are handled separately because they lack a common identity anchor.

Vol. 9 of 25

Real-time orchestration of security signals

Security tools generate signals in isolation. An impossible travel alert and a lateral movement alert triggered minutes apart may stem from the same attack. They are handled separately because they lack a common identity anchor.

Vol. 10 of 25

Convergence of physical and logical access

Physical security sits with facilities management and IT security with the SOC. Each system logs events that appear legitimate in isolation, but reveal the attack when combined. 64% of organisations lack integration between access control and IT security monitoring.

Vol. 10 of 25

Convergence of physical and logical access

Physical security sits with facilities management and IT security with the SOC. Each system logs events that appear legitimate in isolation, but reveal the attack when combined. 64% of organisations lack integration between access control and IT security monitoring.

Pillar 3 · Vol. 11–15

Hardware root of trust

Vol. 11 of 25

The chip provides control

FIDO2 certification covers the protocol. Common Criteria EAL6+ covers the chip. Hardware supply chain attacks occur in the gap between them. That gap is invisible in your dashboard and in your penetration test.

Vol. 11 of 25

The chip provides control

FIDO2 certification covers the protocol. Common Criteria EAL6+ covers the chip. Hardware supply chain attacks occur in the gap between them. That gap is invisible in your dashboard and in your penetration test.

Vol. 12 of 25

Supply chain identity vectors

Your supplier passed the audit. Their sub-contractors did not. Breaches increasingly occur via third-party credentials. NIS2 Article 21 now requires you to manage them.

Vol. 12 of 25

Supply chain identity vectors

Your supplier passed the audit. Their sub-contractors did not. Breaches increasingly occur via third-party credentials. NIS2 Article 21 now requires you to manage them.

Vol. 13 of 25

The reality of biometric spoofing

The fingerprint passed the check. The person did not. Biometrics are only as secure as the processing system. A compromised biometric template cannot be reset.

Vol. 13 of 25

The reality of biometric spoofing

The fingerprint passed the check. The person did not. Biometrics are only as secure as the processing system. A compromised biometric template cannot be reset.

Vol. 14 of 25

Token lifecycle management

Distributing security keys is straightforward. Risk accumulates in the gaps: keys left active after role changes, returned keys that remain registered, and spares omitted from asset registers. Unaccounted keys pose the highest likelihood of compromise.

Vol. 14 of 25

Token lifecycle management

Distributing security keys is straightforward. Risk accumulates in the gaps: keys left active after role changes, returned keys that remain registered, and spares omitted from asset registers. Unaccounted keys pose the highest likelihood of compromise.

Vol. 15 of 25

Physical access convergence | Zero Assumptions vol. 15 | Ciptor

Volumes 11–14 established the hardware root of trust: chip-level reliability in a security key, sovereign supply chains, biometric binding to the individual, and lifecycle management to prevent ghost credentials. Volume 15 concludes Pillar 3 with the architectural question these four volumes have led to: what happens when this same hardware root of trust also controls physical access?

Vol. 15 of 25

Physical access convergence | Zero Assumptions vol. 15 | Ciptor

Volumes 11–14 established the hardware root of trust: chip-level reliability in a security key, sovereign supply chains, biometric binding to the individual, and lifecycle management to prevent ghost credentials. Volume 15 concludes Pillar 3 with the architectural question these four volumes have led to: what happens when this same hardware root of trust also controls physical access?

Pillars 4 and 5, Regulatory Accountability and Governance and Leadership Alignment, will be published later.