Modern security conversations often fail not because the technology is lacking, but because organizations misunderstand what trust actually means and who owns it.
In this episode of #shifthappens, NBConsult CTO Nicolas Blank shares why Zero Trust is not a framework to implement or a product to buy, but a leadership mindset that demands clarity, accountability, and responsibility. Through human analogies and executive-level insight, he reframes Zero Trust as a way for leaders to answer one simple question: What do we trust and why?
As identities multiply, systems interact continuously, and AI begins acting autonomously, trust can no longer be assumed. Trust has to be defined and revisited.
Why Zero Trust Breaks Down in Practice
Zero Trust often fails not at the technical level, but at the decision-making one. Organizations rush to controls without aligning ownership, adopting frameworks without clarifying intent, and outsourcing responsibility to tools instead of leaders.
As Nicolas explains, security doesn’t operate on a finish line. Threats evolve, dependencies shift, and assumptions age faster than defenses. Treating security as something the organization can “complete” creates blind spots that only surface after something goes wrong.
This is where Zero Trust becomes less about architecture and more about mindset. It forces leaders to confront uncomfortable but necessary questions early, before complexity does that work for them.
Decide Who Owns Trust
Zero Trust becomes actionable only when leaders can answer a deceptively simple question: Who is accountable when something goes wrong?
If responsibility for trust decisions is vague or diffused, spread across teams, vendors, or tools, the model collapses under pressure. Accountability can’t be abstract. Someone must ultimately own trust decisions in the same way leaders own financial risk or operational outcomes.
Nicolas makes this tangible through analogies. In everyday life, people intuitively understand accountability. You don’t hand your car keys to just anyone because ownership implies responsibility. You know exactly who you trust and why. Yet in organizations, access often accumulates through convenience rather than intention, and accountability becomes blurred.
Zero Trust brings that clarity back. It doesn’t require leaders to micromanage controls, but it does require them to clearly own the decision of what matters most and who is responsible for protecting it. Without that ownership, trust becomes an assumption rather than a managed risk.
Clarify the Guardrails First
Before adding controls, organizations need to define guardrails.
Guardrails answer what controls often can’t on their own: what is acceptable, what isn’t, and where scrutiny should increase. They provide direction without creating friction and allow teams to move quickly without guessing where the boundaries are.
A recurring theme in the episode is that technology cannot compensate for undefined intent. As Nicolas puts it, a product is not a process. Tools only reinforce decisions that an organization has already made. When those decisions don’t exist, controls multiply without reducing risk.
Guardrails allow security to scale because they are rooted in principles rather than constant oversight. Once leaders articulate boundaries based on the business’s purpose and core assets, controls naturally follow. The result is more consistency, less reactive decision-making, and fewer surprises when systems behave in unexpected ways.
Question What You’re Trusting by Default
As work becomes more distributed, trust quietly shifts from a centralized perimeter to each individual interaction. Every identity, device, system, and request becomes its own decision point. Over time, trust persists not because it has been evaluated, but because it has always been there.
Nicolas captures this reality succinctly: “The perimeter is on everything.” That shift challenges long-standing assumptions about safety. Leaders must now ask not only what they trust, but why — and whether those reasons still hold.
This doesn’t mean defaulting to suspicion. Zero Trust reframes trust as something to be examined deliberately, not inherited passively. Much like driving with your car windows down in an unfamiliar city, risk isn’t always visible at first, but assumptions compound over time.
By questioning what is trusted by default, organizations surface aging access patterns, implicit dependencies, and conveniences that no longer make sense in modern environments. Trust becomes something that is reviewable and adaptive, rather than static and invisible.
Revisit Trust as AI Acts on Your Behalf
When AI systems and agents begin acting autonomously, trust takes on a new meaning. It is no longer just about access — it becomes about delegated responsibility.
Every time an organization allows an AI agent to act, it implicitly decides which judgments it is comfortable outsourcing and under what conditions. That decision cannot be left to configuration alone. It is a leadership responsibility.
Nicolas reframes this challenge using a deeply human lens. Just as you wouldn’t hand your newborn to a stranger without asking basic questions of identity and intent, organizations cannot abdicate responsibility simply because systems are efficient or automated.
AI may operate at scale and speed, but accountability remains human. Leadership must define the limits within which AI can act, the guardrails that constrain behavior, and the ownership model that applies when outcomes don’t align with expectations. Trust, in this context, becomes conditional and contextual — never absolute.
Trust as a Leadership Discipline
Across the episode, one idea remains consistent: Zero Trust works when leaders stop treating security as a technical problem and start treating it as a decision-making discipline. Trust should be clarified, assumptions revisited, and responsibility owned.
In environments where change is constant, and systems act on an employee’s behalf, implicit trust becomes a liability. Zero Trust offers leaders a way to make trust explicit, intentional, and resilient, where it is grounded in accountability, guardrails, and judgment.
Because ultimately, trust is not enforced by architecture but upheld by leadership.
Episode Resources
#shifthappens Research: The State of AI Report
#shifthappens Insights:
