Blog
Research and perspectives on zero trust, data security, and decentralized systems.
September 10, 2026
Modern ransomware exfiltrates before it encrypts and demands payment under the threat of public release. Neither lever works when the data is already encrypted and policy-bound at the object layer.
July 30, 2026
Adversaries do not need a working quantum computer today to compromise tomorrow's cryptography. They need storage, patience, and a sufficiently long-lived secret. The act that matters has already happened by the time the cryptanalysis is feasible.
June 4, 2026
CMMC Level 2 requires 110 practices across 14 domains. Data-centric security maps to 76 of them through a single architectural primitive bound to the CUI object.
May 21, 2026
You cannot enforce a policy you have not defined, and you cannot define a policy on data you have not classified. Classification is where zero trust actually begins.
May 13, 2026
Vercel's April 19, 2026 security bulletin documented an OAuth compromise that exfiltrated environment variables through an authorized AI integration. Identity, network, and device controls all evaluated correctly. The data did not enforce its own policy.
May 12, 2026
NSA published Phase One of its Zero Trust Implementation Guidelines in January 2026 and Phase Two later that month. The market did not need another zero trust definition. It needed the sequence, and the guidelines provide it.
May 7, 2026
Role-based access grants standing privileges that outlive their purpose. Attribute-based access evaluates every request in context. For zero trust, only one of these actually works.
DoD Zero Trust Strategy 2.0, published March 2026, brings operational technology, IoT, defense critical infrastructure, and weapon systems under the same target-level maturity expectations as enterprise IT. The data pillar is where the new scope hits hardest.
May 6, 2026
CISA's April 2026 binding directive sets Q3/Q4 2026 deadlines for identity, network, and device zero trust controls. The data layer remains optional. Programs that hit every milestone without object-level enforcement still fail on a compromised service account.
May 5, 2026
On April 30, 2026, CISA and four federal partners released a joint guide adapting zero trust principles to operational technology. The guide advances identity, network, and visibility maturity for OT. The data plane remains an open enforcement gap.
NSA's April 2026 clarification narrowed the post-quantum field for National Security Systems to ML-KEM-1024 and ML-DSA-87. ML-KEM-768 will not clear NSS. Vendors that staked PQC-ready claims on the smaller parameter set need new statements.
May 4, 2026
Two PQC deadlines are already running. September 21, 2026 sunsets FIPS 140-2 for federal procurement. January 2027 binds CNSA 2.0 for National Security Systems. The migration that matters is not the algorithm. It is the cryptographic agility to swap one.
April 24, 2026
AI agents acting on injected instructions are now the dominant exfiltration vector. Two April 2026 incidents show why ABAC enforcement at the data object, not the network or the identity plane, is the control that actually contains MCP.
April 22, 2026
Lattix has published the public developer preview of the Rust, Go, and Python SDKs and the Platform API. The SDKs add in-process helpers for envelope, TDF, and detached-signature flows that keep artifact bytes and key material inside the caller.
CISA added the April SharePoint spoofing zero-day to KEV on April 14 with an FCEB remediation deadline of April 28. Patching closes the vector. It does not answer what an attacker read, modified, or signed before the update landed.
April 17, 2026
A malicious LiteLLM package pushed March 27, 2026 cascaded into a four-terabyte exfiltration from an AI training-data vendor whose customer list reads like the frontier lab leaderboard. Identity controls were present. They were not the control that mattered.
May 13, 2025
AI systems are only as trustworthy as the data they train on. A data-centric security approach shifts protection from infrastructure to the data itself.
April 29, 2025
Blockchain technology offers unique capabilities for cybersecurity: tamper-proof audit trails, smart contracts for access control, and decentralized identity management.
April 15, 2025
AI trustworthiness depends entirely on training data integrity. Without securing the data pipeline, AI outputs cannot be trusted.
February 9, 2025
ZTDF creates a self-enforcing security boundary around every data object with embedded encryption, access policies, and audit capabilities.
Traditional perimeter-based security is failing. Zero Trust architecture operates on a simple principle: never trust, always verify.