Nicholas DiCola

VP @ZeroNetworks | Former @Microsoft | Retired @USMC. Author, Gamer, Classic Car Enthusiast and all around Techie / Security Human.

[Nicholas DiCola @MasterSecJedi]

TCP/IP was designed in 1974.

Every connection between every node: open by default.

Identity verification: not specified.

We've been bolting on security ever since.

If I could undo one architectural decision from the last 50 years – it's this one.

[Nicholas DiCola @MasterSecJedi]

Same attacker. Same month. Two casinos.

Caesars paid ~$15M. Operations continued. MGM didn't. $100M loss. 10 days of disruption.

The attacker's goal was never the data. It was the downtime.

If lateral movement is limited, the ransom calculus changes completely.

[Nicholas DiCola @MasterSecJedi]

IBM X-Force: 56% of ~40,000 tracked vulns last year required no authentication to exploit.

That's not an identity problem. It's a network problem.

If you can't reach a port, you can't exploit what's on it.

Network segmentation is non-negotiable.

https://t.co/cbVw39CcF9

[Nicholas DiCola @MasterSecJedi]

The Gentlemen RaaS: 332 victims in 5 months. Entry point – exposed Fortinet and Cisco edge devices.
Patch the perimeter. But the real question is what they reach once they're through it.
If the internal network is flat, initial access is all it takes.
https://t.co/rDTgNL3ifd

[Nicholas DiCola @MasterSecJedi]

WEF: 99% of highly resilient orgs have active board involvement in cybersecurity.

At low-resilience orgs, engagement is largely absent.

Priorities come from the top. If your board isn't asking what happens when an attacker gets in – start there.

https://t.co/sIVMKjuht0

[Nicholas DiCola @MasterSecJedi]

We just published a resilience guide built for security leaders who are done with reactive strategies.

Containment-first architecture. Measurable blast radius. Business continuity by design.

https://t.co/eR8CkMqTTn

[Nicholas DiCola @MasterSecJedi]

Jedis take time off to enjoy Star Wars Day! Happy May the 4th!

[Nicholas DiCola @MasterSecJedi]

Organizations say "when" a cyber event happens. Not "if."

The difference between a contained incident and a business outage isn't detection speed.

It's whether lateral movement was limited before the attack.

Resilience is an architecture decision.

#CyberResilience #ZeroTrust

[Zero Networks @ZeroNetworks]

CISA just flagged a vulnerability in Grassmarlin — a retired NSA tool used to map OT and ICS networks. No patch exists.

It's a reminder that OT security debt doesn't age out. It compounds. 🚧

Our CEO Benny Lakunishok talked to SDxCentral about why this matters beyond one tool — and why energy, water, transport, and manufacturing can't afford to ignore it.

The attack surface isn't just growing. In OT, it's been quietly accumulating for years.

Full article 👇
https://t.co/XuCUWE8s6C

[Nicholas DiCola @MasterSecJedi]

Zero Trust has four pillars: network, identity, application, data.

Most orgs haven't finished the first two.

Network closes broad exposure. Identity controls what's permitted on top.

Not separate problems. One foundation.

#ZeroTrust #Microsegmentation

[Nicholas DiCola @MasterSecJedi]

AI is great at things it was trained on at scale.

Security still needs more time and specialized data.

Where it works now: SOC playbooks, structured triage. Where it needs work: autonomous detection, nuanced judgment.

Be honest about the boundary.

#AI #CyberSecurity

[Nicholas DiCola @MasterSecJedi]

AI segmentation starts at the network layer – not authentication.

If the network is open, API keys get stolen, agents get bypassed.

Close the network first. Then layer identity. In that order.

Most teams have it backwards. https://t.co/NDJRdvHmig

#ZeroTrust #AISegmentation

[Nicholas DiCola @MasterSecJedi]

@disneytipsguy I concur

[Nicholas DiCola @MasterSecJedi]

5 stats. One conclusion.

→ 27s attacker breakout time → 60%+ of your network gone in under 1 hour → 241 days to contain a breach → 70% of alerts don't stop lateral movement → 86% of incidents still disrupt ops

Stop the spread.

[Nicholas DiCola @MasterSecJedi]

Final byte.

27 sec breakout. 60% down in an hour. 241 days to recover. 70% of alerts don't help.

Despite bigger budgets every year – 86% of incidents still disrupt operations.

More spend isn't the answer. Stopping lateral movement is.

#ZeroTrust #Microsegmentation

[Zero Networks @ZeroNetworks]

We analyzed 3.4 trillion activities across 400 enterprise environments.

Here's what we found:

One compromised system can reach 85% of your environment in a single hop.

71% of threat activity flows through just 4 protocols you can't disable: SMB, RDP, WinRM, RPC.

Attackers don't need sophistication. They use the same trusted paths your IT team uses every day.

The breach isn't the failure. The blast radius is.

📍How to secure the 4 protocols driving enterprise risk in 2026: https://t.co/uN6JYbNAwk

📖 Full threat analysis: https://t.co/AukvyQ0jhK

[Nicholas DiCola @MasterSecJedi]

Byte #4.

Only 30% of security alerts correlate to real lateral movement threat path elimination.

70% of the time your team is chasing noise that doesn't stop the attacker from spreading.

Busy and protected are not the same thing.

#ZeroTrust #SOC

[Zero Networks @ZeroNetworks]

Visibility 🤝 Control

Zero Networks is now a part of the Microsoft Sentinel connector ecosystem, enabling security teams to bring segmentation audit telemetry into Sentinel. The integration supports:
- Compliance monitoring
- Investigation of suspicious changes
- Faster detection of attempts to bypass lateral-movement controls

Learn more about the connector: https://t.co/FvFtc2teTy

[Nicholas DiCola @MasterSecJedi]

Byte #3.

181 days to find a breach. 60 to contain it. 241 days total.

Meanwhile last week – attackers hit 60% of your network in under an hour.

They're done in 60 minutes. You're cleaning up for 8 months.

Detection alone can't fix that math.

#ZeroTrust #CyberSecurity

[Zero Networks @ZeroNetworks]

🚨Coming soon to an arena near you! Contain the Breach: an in-person capture-the-flag competition 🚩

We're bringing hands-on containment challenges to three cities this spring and we want to see you on the leaderboard. You'll race against the clock (and your peers) to quarantine hackers using Zero Networks; top finishers take home custom prizes – everyone earns CPE credits and newly minted challenge coins.

Ready to contain the breach? Lock in your spot!
📍 Denver: F1 Arcade | Thursday, April 9th
📍 NYC: Chelsea Piers Golf Club | Thursday, April 16th
📍Chicago: Andretti Indoor Karting | Thursday, April 23rd

All you'll need is a laptop and the will to win. Get all the details and save your seat 👉 https://t.co/48DpM4H3fS