DrZeroTrust: Good morning, good afternoon, good evening. I'm Chase Cunningham Doctor Zero Trust, none of that matters. I'm actually here with somebody that knows what they're doing and does important work, the security Jedi himself from Zero Networks. Nick, give a quick intro who you are and then we're gonna talk about the fact that you guys did a pretty bold experiment. We have some interesting results.

SecurityJedi: Yeah, cool. Thanks, man. Nicholas Dakota, the security Jedi and Chief Customer Officer here at Zero Networks. So we'll keep it short. Let's get into it.

DrZeroTrust: So you guys just published this report and this is timely because it's around the whole hugging face and all the other stuff. But the title and I'll share the link in here for all you folks that listen. So when autonomous AI attacks a segmented network, and this is great because God knows I've been trying to get people to understand for a long time segmentation actually is valuable if you do it correctly. And you guys pretty much prove that that's the case. So let me just run through a couple of pieces here. Anthropic analyzed 832 accounts that were banned from malicious cyber activity and found that 54 or 6.5% used AI to assist with lateral movement. More importantly, lateral movement was the strongest marker of high risk behavior in the data set. Anthropic also documented an actor using Claude code to connect autonomous recon. Harvest credentials move laterally across a victim cloud environment. Now for All the non nerds that listen to this give the breakdown on what that means.

SecurityJedi: Yeah, so basically, Andropic has a lot of folks using their platform and their models, which aren't, approved to to do cyber type work, actually running AI or ethical hacking or just hacking, using those models. Because why? It's easy. I can go to a prompt and say, Hey, do some recon on this company, see what we can find that would get me in there. And it will operate just like a human would, right? It'll reason, it'll try to go look on public data, what can I find out? What IPs are they using, these types of things and give them information and then go to that next step. It'll follow that same, ethical hacker model of, you know, recon, exploit, laterally move, you know, pwn, basically. And so the model just makes it easy for them. So they're basically finding people that are attempting to use these models publicly, still connected to the cloud, which you know most real good attackers are probably not doing that model. But you know Somebody's trying out there in the world to see what they can get away with using the AI models.

DrZeroTrust: So, everybody can be a a a threat actor nowadays, really, is what it boils down to. if you can access Claude, you could work your way through this. So there's some follow-on here too. so joint work with Carnegie Mellon Anthropic showed that LLMs, large language models equipped with a cyber toolkit, could autonomously execute multi-stage attacks across networks of twenty-five to fifty hosts, including initial access, lateral movement, data exfiltration. the recent surge in newly disclosed vulnerabilities is putting unprecedented pressure on cybersecurity teams. So the the experiment is cool because you guys actually put screenshots in from Claude here, which is cool. So let me read through the experiment side. So August 2026, Zero Networks tested the question or in a controlled lab environment, which was designed to resemble an enterprise estate rather than CTF. So you guys did it like a real thing. It wasn't CTF. It wasn't like totally game. So that's great. The environment included different operating systems Linux, Windows, Mac, OS endpoints, servers, Kubernetes databases, web, directory, internal DNS, PC. So it was a living, breathing, emblematic enterprise environment. And then your next step was to say, okay, zero network segmentation was deployed. You had two kind of sides of it. You had the same environment. You had one that had ZT zero networks on it doing its thing. And then you had the other, which was kind of just a typical environment without zero networks doing its thing. And then you basically said clawed code was placed on a domain joint workstation and both makes sense operated under a standard domain user identity. Again, the right way to game it. And then basically y'all said go and let it out of the box and said see what can happen. And where did it go from there?

SecurityJedi: Yeah, we actually did it in the a few phases, right? So we gave it some limitations. Hey, you can only do ten steps. Then we increased the number of steps because we want to see how far it could go each one. And we did about ten passes, all the way to like you're free to access the internet and get whatever tools and things that you want, and go forth and do great things and see what you can do. so yeah, we started small, worked bigger, which is great because we had a couple validations along the way, and it was just it tried to do exactly what a hacker would do. And, nice thing is Claude prompts you with what it's trying. Hey, I'm downloading this tool. that tool got blocked by the local EDR. So we didn't do everything. Obviously, basic security tools matter. We downloaded some internet tools. They're easily discovered by EDR. Great. Wonderful. Went and got another tool, not easily discovered by EDR. Tried that. Okay, I'm not able to laterally move with that. Okay, let me do this. Let me try recon with something that is executable on the machine. So it did work through the phases and try to go, and at some points when we gave it lots of steps and said, Okay, you're allowed to do five hundred steps, certain points it stopped and was like, I can't do anything at this point. I'm just I'm gonna give up now. of course on the open side, where

DrZeroTrust: Where it hit the wall.

SecurityJedi: the yeah, where the machines were segmented, it immediately was able to laterally move. And basically we said to prove you laterally moved, get over there and drop a file in C call and windows. So you have to have some administration pr privilege. So it did some things get either escalation or get a privilege from the source host to move laterally, but it proved it was able to get with a text file into C colon Windows, which means it has some privilege on the machine that it's connected.

DrZeroTrust: that's what we did when we were proving that we were there red team wise, right? Was drop a file. Usually it was something like gotcha or some stupid comment. So yeah. Was it did you see Claude in both scenarios like invoking PowerShell?

SecurityJedi: commands and PowerShell. Again, once we let it have internet access, then it started to look like what's available out there. And so it, you know, definitely tried some different things. use some Python tools too. so it's just like a human, I think, as close as a human could be, to say, hey, what tools are available? I download a tool. okay, it's caught by EDR. Let me go get another tool that seems a little more sophisticated, maybe won't get caught by an EDR. Like it follows the same thing that I would do. You would do, you know, maybe you know these tools. But assume you didn't and you're new to the red team, that's the steps you would follow. but if you know a tool, hey is Windows Defender and I know I can run this tool, then obviously it would just go get that first. But it didn't have that context, right? Because we didn't give it that piece.

DrZeroTrust: Yeah, it's pretty cool when you look at the screenshot. So, it's like I've reached the design containment boundary. Here's the complete picture. It tells you, this is from the side of where things did its approach. So compromise, what happened, what it did, how I got here, you know, it tells you identity recon, domain, key discovery, testing, blah, blah, blah. And then it tells you kind of how it moved laterally. and then it also tells you like what it ruled out as a non starter. So that's pretty cool because. a quad is literally like walking us through what it was doing and how you guys were either able to defend it with the zero networks approach or that it slid by on the other side. It's it's very interesting just to see, like you say, this is if I brought in a a pen tester, a red teamer, this is what they would do.

SecurityJedi: Yeah. I think a pen test report is always much more detailed. I think guys that do pen testing do a great job of detailing it. But yeah, Claude did a pretty job of pen test report, right? Like of I tried this, it didn't work, I tried this, it worked, here's what I got, and you know, gave us steps along the way as it went, within the boundaries of the the test experiment or the research that we did.

DrZeroTrust: So across the exercise, Claude attempted 18 different attack approaches, used twenty three different tools, touched twenty two miter attack techniques. So it was throwing everything but the kitchen sink at it. it looked at active directory, curber roasting, it did GPO stuff, active ACL things, local privilege, those things. I mean, it did pass the hash, pass the ticket, password cracking. It even tried firewall manipulation. so there was a what you would consider to be a capable hacker in a bad, potentially bad time. And the the other side of the equation was that Claude did succeed where a path existed. And this is the lateral movement story, right? If it was available and it was viable, it was doing its thing. On the deliberately unsegmented host, the one that you guys just kind of said, like it's an architecture environment with the regular controls, it gained local admin access, took creds, planted the proof file. And then basically was like, Yep, I did it, I got it, I win.

SecurityJedi: Yep. Yeah, yeah. It's again, exactly like folks would do. And it just really proves the point that at you know, I always go back to my o I was taught OSI really early on you had no OSI, right? Please do not throw sausage pieces away. And it all starts down at the if it ain't plugged in, you can't talk to it. Well, everything's plugged in nowadays, so that goes away. At a network layer, if I can't talk to it, I can't talk to it. So if you microsegment, you take away all of the attacker's ability. To laterally move. Yeah, they might be able to do some things on that machine. Okay. Hopefully they don't click a spearfish to the CEO and they can read the CEO's email. But more importantly, they can't spread laterally and ransom every machine in the environment or steal data from everywhere in the environment. They can only get that one machine. If you literally take the network piece away with micro segmentation, right? And this proves it, exactly.

DrZeroTrust: Yeah, there's actually a some piece in one of the graphics here that says what the segmentation successfully contained. And then it runs through domain admin, and then Claude's it's interesting to see the Claude's thinking Claude is saying, I ruled out built in compatible, etcetera. And it it talks itself out of continuing to try and go down the failure route. And it's like I I okay, you got me like I'm done. That's and that That's actually where you're trying to get to as as a defender is like you okay, you're on our system, compromise occurred because we're plugged in, like you're saying, but you can't really do anything. You can't go anywhere. It's not it's not a cataclysmic event.

SecurityJedi: Yeah. I always tell people my favorite cyber joke, but in all realistic maybe sarcasti sarcastic joke is what does an attacker do when they get into an environment that's microsegmented and they can't laterally move? They leave and go to the environment that they can, right? Because

DrZeroTrust: They quit. Yeah.

SecurityJedi: their job is to make money too. So if you make it really hard, like Claude, at a certain point they're gonna go, Okay, I tried Nmap, I can't find anything on the network, I tried this, can't get there. Okay, there's no point in doing this anymore. Let's go somewhere else that's fully open that we can just, pwn within forty eight hours. So Claude proves the the same thing again. There's an ROI. At a certain point he's gonna say, Hey, I'm burning tokens. There ain't no point in me keeping doing this. Same thing a human would do. There's no point in me keep working on this or burning my tokens if they're using AI to do it, right? At a certain point they're just gonna stop, move to another organization where they can get in and actually laterally move.

DrZeroTrust: That's a real good point. I I hadn't considered the token burn 'cause that is a viable thing. And if I was the adversary running this, I would set a threshold for token burn on all this stuff 'cause you could just burn tokens for nothing, which would not be good. And then

SecurityJedi: They they're operating on ROI just like everybody else.

DrZeroTrust: There's a budget. when it said where the attack stopped, Claude continued trying to expand its access. It dumped Windows creds, did the pass the hash, and then it even tried to disable firewalls and things along those lines. But Claude actually comes back on the zero network side of things and says, I've reached the dis the containment boundary. Like it kind of goes, That's the game set match, wherever we're finished.

SecurityJedi: Yeah. Yeah. if you think about the miter attack framework, right, the real impact to customers doesn't happen during recon or during the initial exploitation. It's the lateral movement, right? Again, if I get in and I get to one machine, maybe I can do something with that user's capability and hopefully it's not the CEO or someone that has lots of access and and lots of things, lots of, you know, capability in the company. But if I can only get to one laptop First of all, your SOC is going to be way happier because they can just throw that laptop away and not have to spend weeks investigating, especially when they can look in your microsegmentation logs and see, it tried to access all these things, couldn't go anywhere. Okay. Wipe the laptop, reload, let's move on with our day. so yeah, it's like at a certain point, you're the attacker's gonna do the same thing. Like I'm contained on this machine. Yes, I can do a bunch of stuff to this machine. Maybe I could disable EDR, maybe I can disable the firewall, maybe I could disable microsegmentation on that machine, but If you can't talk inbound to the next machine, you can't do anything on the next machine. You you're stuck. so you're basically contained to that original host.

DrZeroTrust: And it's it's holding up recon and all those other things too. The the fallout was basically for your research, segmentation mattered the most out of all defenses, which makes tons of sense to me. So while there were other defenses, including OS hardening, EDR, XDR, blah, blah, blah, most of them Claude was able to disable, because once you get admin and those types of things, you can. And literally it says the only real quote wall was the network. the attacker repeatedly lacked reachability from compromised systems to protect the assets over. The management path that it attempted. Claude could identify targets, obtain elevated privileges on the unprotected machine and acquire creds and those types of things, but it could not establish the network path required it was able to do some stuff and it kind of bypassed security controls, especially endpoint and some of those, but big deal. It it it the the building didn't burn down, the fire was contained.

SecurityJedi: Yeah. look at how many companies we see in the news, they have major ransomware attacks down for weeks, or they pay the ransom, or they're just out and they start rebuilding and they're paying all these people to rebuild their network, the cost of that compared to I always again joke, Okay, you got one laptop, it's a few thousand dollars, I'll go buy another one if I'm really worried about it, or I'll just wipe it and reload it and move on with my day, right? Like assuming they need to get some firmware hacks in there. But again, throw it away, get a new one, it's not really that big of a deal. and it all comes down to

DrZeroTrust: Right. It's survival.

SecurityJedi: micro segmentation that again been around for years. we really a basic that we just need everybody to be doing these days because it's ultimately going stop AI based attacks, people using AI in the environment to laterally move, et cetera, et cetera.

DrZeroTrust: Yeah. So here's what the results of this show, and this is the the final piece of y'all's research. So the one machine that fell was our control and it answered questions everyone answered, right? Everything in the lab had the same OS, same patch level, same EDR, same OS hardening baselines and same services. And it all faced the same adversary. The only variable was micro-segmentation. And that's like there's no better proof positive, I would think, of this there's some conversation here about the variables was time. So against segmented host, the agent Claude kept working, kept trying to do its thing and basically couldn't go anywhere. Whereas on the open side, compromise and you guys say this flat out happened at machine speed, which is super fast. And it's not because the attack got smarter. But because it was able to do that and it moved at the speed of a machine. That's pretty telling to say to folks of you have two choices, right? Of either do this and segment and isolate and it's what it is, or you're thinking you can be faster than machine speed.

SecurityJedi: Yeah. You can't. we we haven't been winning in the non machine speed era, although machine speed is the new buzzword, right, that everybody's r running around with. but you know, before AI came the last few years, attackers were still fast. You know, many times we've seen reports from Microsoft attackers get in, they domain admins within forty eight hours, right? I did some IRs at Microsoft, that's what we typically saw. They were very, very fast, very quickly into Spreading laterally and got domain admin very, very quickly. And once you have that, you have everything. And now the AI will just do it for them, it'll be even faster, right? Because the computer doesn't sleep, it doesn't have to take breaks, it'll just keep running until it it finds that thing. But again, if that thing's really, really hard, it'll also give up. so that's what we need to do, is we we need to make the boundaries hard. So it just stops and gives up.

DrZeroTrust: I guess one question that comes to mind here, how difficult would it be to put these type of segmentation and control rules in place if you were trying to do this without a piece of tech? if I try to do this as an admin that kind of knows something about what I'm doing on legacy approaches, I mean the rule sets make my mind hurt and the you know, ability to do this at scale. How difficult would this be to do it without something like zero?

SecurityJedi: Yeah, at the end of the day, I look, I think there's some basic things you can do to pretty much harden the environment in a pretty decent way. I was talking to another consultant over here in Europe and he had this model of create a rule that says no workstation should ever talk to any other workstation, in your firewall. It's pretty simple. That's one rule, but s stops lateral movement. Okay, nothing should ever talk, RDP, SSH, privilege access to all of my servers except, these few hosts. Okay, cool. Now you've, a few rules and you've got a pretty good What I call sixty, seventy percent micro segmented network. So you can do it. It is possible. It does take some time. It takes some thinking. It takes writing the rules, figuring out how to implement them in GPOs. But again, I think a solution like Zero Networks makes it way, way easier and you're talking weeks and months, not months and years.

DrZeroTrust: Yeah, and that's the the side of it is you can like like you said, you can choose to dig the Suez Canal with a shovel. It sucks, but it's theoretically doable. I would rather use like power equipment, right? I mean, that's kind of where we are.

SecurityJedi: Yeah, an

DrZeroTrust: I guess the the other side of of the question really is like, is it at enterprise scale, is it possible to do this type of stuff and be get it right? Because I would say it's not. If you're not using a solution or

SecurityJedi: Manually? No.

DrZeroTrust: a Yeah, manually? Like how

SecurityJedi: Yeah.

DrZeroTrust: would you do this if you had ten thousand hosts?

SecurityJedi: Yeah, I I don't I don't think you realistically can just because even if you broke that into the number of applications, that's a few hundred to a few thousand applications, and building the rules of, this is dev, this is prod for that app, that app, that app, and then writing the rules of what can talk to what. I still think and then you're you're mainly doing it with a lot of IPs. Well, what happens when you add a new one? Just the maintenance on that alone, let's say you could get through it in a year or two. The maintenance on it alone, you want to add a new host. now there's some companies that built some tools and did it themselves with some, you know, internal development. So yeah, everything's possible, right? Everybody has code ship. People have A AI access now. They could probably figure out some of it. but I still think, you know, when you when you have a solution from a tech vendor like ourselves that focuses in it, it's always going to be much better, much faster, much easier than you know something built in house.

DrZeroTrust: So I where's the where's this next step for this go? Are you guys gonna do some more research in it? Like what does it look like future state for you guys? Cause this is a great example of forward thinking and y'all being willing to test out the problems people are really dealing with. But what's gonna be the follow-on to this? Cause there's gonna be more problems coming. Are you gonna like a vulnerable pocalypse demo or something along those lines?

SecurityJedi: That's a good idea. I won't share anything specific. We're having some talks about what we want to do, right? We don't want anybody to steal our our ideas. But yeah, we have some ideas on on some things we want to do. but yeah, we wanna continue to do some more security research. We also wanna see, okay, what can we do to make it even easier for customers to actually get microsegmented because again, the power of this is just so fantastic and again, you take away the ability to communicate between assets in a network, hosts in a network, you take away the ability for the attacker to laterally move, right? So If we can solve this, this solves a lot of problems for customers, even makes patching easier, even reduces risk on vulnerabilities. there's a lot of other side effects that come from microsegmentation that I think we need to figure out how do we even make it easier for them. And that's some things we're working

DrZeroTrust: Easier is always better. Nick, thanks for jumping on.

SecurityJedi: Yeah, for sure.

DrZeroTrust: Appreciate the rundown, especially since you're overseas

SecurityJedi: So I appreciate you having me and always love spreading the good word about, microsegmentation and the problems that we're solving, especially in today's era because it's to me it's the next annuis. everybody's gonna have to have it, like in in the AI era.

DrZeroTrust: Good way to put it. You heard it here, folks. Nick, thanks again.

SecurityJedi: There you go. See ya, man.