Get the basics right — Zero Trust

Zero Trust · Get the basics right

Zero Trust works when
the architecture is right.

Strategy and policy are only as good as their implementation. These deep dives go to the architectural layer — how AUXO™ processes Zero Trust natively, how AI agents change the identity problem, how protect surfaces drift in cloud environments, and how to plug your ZT controls directly into your AI toolchain.

For Security Architects · DevSecOps · SOC Engineers · Cloud Architects

Architecture Difference

Every SIEM and SOAR bolts Zero Trust on after the fact. AUXO™ uses the protect surface as its native data schema — ZT context is not a report, it is the database.

Non-Human Identity

In agentic AI environments, software identities outnumber human ones 10:1. The standard CISA five-pillar model does not cover this. These deep dives do.

Toolchain Integration

AUXO™ MCP server surfaces Zero Trust controls inside Claude, Cursor, VS Code, and any MCP-compatible agent — without leaving your workflow.

Technical Deep Dives

Architectural & Operational Intelligence

For security architects, engineers, and practitioners building Zero Trust in production

5 deep dives · 4–8 min each

Platform Architecture

~8 min

AUXO™ — Built on Zero Trust. Every Other Platform Is Not.

The architectural difference that matters: every SIEM, SOAR, and MDR platform handles Zero Trust as event pipeline first, ZT reporting bolted on. AUXO™ uses the protect surface as its native data schema. EventFlow's ZT-context-enriched agentic AI reduces 69 events to 3 analyst investigations.

ON2IT Product · AUXO™ Architecture

→

Tech Deep Dive

~7 min

Zero Trust for AI Agents

Non-human identities outnumber human ones 10:1 and growing. The CISA five pillars mapped for agentic environments — what each pillar means when the actor is software — plus JIT credentials, runtime trust scoring, and four additional controls the standard model doesn't cover.

Rob Maas · Lead Architect, ON2IT

→

Tech Note

~4 min

Your Protect Surface Is Already Out of Date

In cloud environments, protect surface metadata drifts by default. The five-stage maturity ladder — and why Stage 4 automated CMDB sync still isn't enough. AUXO™'s Azure API is Stage 5: real-time source capture.

Johan Bogema · Lead Cloud Architect, ON2IT

→

Operational Brief

~6 min

Your Zero Trust Platform, Directly Inside Your AI Toolchain

AUXO™ MCP server integration — Zero Trust controls surfaced inside Claude, Cursor, VS Code, and any MCP-compatible agent. What DevSecOps can do directly from their toolchain without leaving their workflow.

ON2IT Product · AUXO™ MCP Server

→

Case Analysis

~8 min

How Zero Trust Stops What You Can't See

The SalesLoft Drift breach — 700+ organisations hit by valid credentials from a slightly wrong IP range. No CVE. No IOC. The Kipling WHERE question would have stopped it. A detailed policy and architecture analysis.

Lieuwe Jan Koning · CTO, ON2IT

→

Canonical Reference · Definitions by John Kindervag · Updated 2026

The Zero Trust Dictionary

The authoritative Zero Trust lexicon updated for the AI era — with nine new terms covering Non-Human Identity, Ephemeral Privilege, Intent Validation, Behavioral Monitoring, and more. One shared language across board, management, and engineering. No ambiguity.

Zero TrustDAASProtect Surface Kipling MethodMaturity Model Non-Human IdentityEphemeral PrivilegeAI Era

Open Dictionary

17 core terms · 9 AI extensions

AUXO™ Platform · ON2IT

The only SIEM/SOAR built on Zero Trust architecture

Every other platform in the market was built as an event pipeline first and bolted Zero Trust reporting on later. AUXO™ was built differently — the protect surface is its native data schema. That architectural difference is what makes EventFlow's agentic AI work: it enriches events with ZT context before analysis, not after. The result is a detection and response capability that scales with Zero Trust maturity, not despite it.

69 → 3

Events to analyst investigations via EventFlow AI

24/7

Managed GSOC — detection, response, prevention

100%

ZT-native data schema — not a reporting layer

Zero Trust Intelligence Hub

See the full library — board to engineering

Board briefs, implementation guides, technical deep dives — 15 pieces across all audiences in one place.

Open the hub →

Technical Assessment

30 minutes. No slides. Bring your architecture questions.

A direct conversation with ON2IT's lead architects. Built for engineers ready to design or validate a Zero Trust environment.

Book a session →

Frequently Asked Questions

What makes AUXO™ different from other SIEM/SOAR platforms?

Every other SIEM, SOAR, and MDR platform handles Zero Trust as an event pipeline first, with ZT reporting bolted on afterwards. AUXO™ uses the protect surface as its native data schema, which is what lets EventFlow's agentic AI reduce 69 events to 3 analyst investigations.

Why does non-human identity matter for Zero Trust?

In agentic AI environments, non-human identities outnumber human ones 10:1, and the standard CISA five-pillar model does not cover this. Zero Trust for AI agents maps each pillar to what it means when the actor is software.

How current does protect surface metadata need to be?

In cloud environments, protect surface metadata drifts by default. There is a five-stage maturity ladder for keeping it current, and AUXO™'s Azure API reaches Stage 5: real-time source capture.

What is the Zero Trust Dictionary?

The Zero Trust Dictionary is the authoritative Zero Trust lexicon, with definitions by John Kindervag, updated for 2026 with nine new terms covering Non-Human Identity, Ephemeral Privilege, Intent Validation, and more.

Can Zero Trust stop attacks that don't use malware or a known vulnerability?

Yes. In the SalesLoft Drift breach, 700+ organisations were hit by valid credentials used from a slightly wrong IP range, with no CVE and no IOC involved. The Kipling Method's WHERE question would have stopped it.