Hard Truths About AI in Cybersecurity Reveal Truly Hardened Defenses

Summary

AI isn’t stopping lateral movement yet because it isn’t accurate enough to make enforcement decisions a business can trust. A bank can’t accept a tool that’s right “most of the time.” At Black Hat 2025, CyberRisk TV host Jackie McGuire talks with Zero Networks Field CTO Chris Boehm about explaining microsegmentation through a bank analogy, shadow IT in the cloud, where AI actually helps security today, and the red flags to watch for in AI-infused security tools.

Key takeaways

• Microsegmentation works like a bank. You verify at every layer, at the teller, the vault, and the deposit box, all the way down to each asset.
• Shadow IT makes it urgent. In the cloud, anyone can spin up services with loose controls. Microsegmentation applies verification on-prem and in the cloud, for users and service accounts alike.
• AI isn’t accurate enough to enforce. Attackers use AI too, and “90% accurate” fails when a wrong block takes down transactions worth millions an hour. Zero Networks uses automation that learns from each action instead.
• Summarization and guidance are AI’s real wins today. AI can summarize complex environments and guide analysts through incidents. Taking action on its own is the next step, and it’s not there yet.
• Black-box AI is a red flag. If an AI tool can’t explain what it’s doing or leave an audit trail, don’t trust it. For microsegmentation, ask how the product learns, whether it creates friction, and whether you can actually finish the project.

Speakers: Jackie McGuire, Host, CyberRisk TV · Chris Boehm, Field CTO, Zero Networks

Jackie McGuire: Welcome back, back to Black Hat 2025. We are almost fully caffeinated. We’re here live from the CyberRisk TV studios at the Mandalay Bay in Las Vegas. I’m your host, Jackie McGuire, and joining me is Chris Boehm. He’s the field CTO of Zero Networks. Welcome, Chris.

Chris Boehm: Thank you.

Jackie McGuire: Did I pronounce your last name properly?

Chris Boehm: Perfectly.

Jackie McGuire: That is honestly, like, 80% of getting an interview correct, is not mispronouncing my name during the intro and not mispronouncing your name.

Chris Boehm: It’s very — it’s common for me. So, I, I totally understand.

Jackie McGuire: Yeah. Um, my last name is McGuire, and you wouldn’t think that that would be, but I get McGiri. Yeah, I get all kinds of weird mispronunciations.

Chris Boehm: I can see that, though. I also occasionally mispronounce my own name when I’m, like, reading too much.

Who is Chris Boehm?

Jackie McGuire: Um, all right. So, you’re field CTO for Zero Networks. Um, and I actually have had the pleasure of working with Zero Networks a little bit. So, I already know what you guys do, but I thought it would be really good to kind of start out with a little bit of your background. I know you’ve got over 15 years of experience in tech, and how you got to Zero Networks, and then I’ll ask another question.

Chris Boehm: Sure. Uh, so, hey, my name is Chris Boehm. Um, I have been in the cybersecurity space, obviously, for 15 years. I started in state and local government, uh, one of one person reporting to the school districts, and fun stuff at that point. Uh, I joined enterprise, then I joined a small company called Microsoft. I did that for about seven years. Um, I started in identity, launching multiple products. When I left, and then I joined this other small company called SentinelOne. I was there for about three years. And —

Jackie McGuire: You like startups, huh?

Chris Boehm: Uh, yeah. Yeah. And then I went to another brilliant startup called Zero Networks, and that’s where I’m at today.

Jackie McGuire: Awesome.

Chris Boehm: So that’s a quick summary.

What is microsegmentation?

Jackie McGuire: Yeah. And one of the things that Zero Networks does that I, until I met the company, I had heard the term before but hadn’t really delved into it, but is microsegmentation. And it’s becoming increasingly important. So can you explain to me, like I’m in fifth grade, uh, what microsegmentation is?

Chris Boehm: Yeah. Like a fifth grader. Huh.

Jackie McGuire: Maybe, maybe like a —

Chris Boehm: No, fifth grade is fine.

Jackie McGuire: Slight, slightly precocious eighth grader.

Chris Boehm: Okay. So I would imagine microsegmentation like this. Imagine you walk into a bank today, and the first thing you assume, you see the tellers behind the, the counter. You’re like, “Okay, I need to give them my ID.” That’s first verification, saying, “I am who I say I am.” Well, I’m trying to pull out something within the bank. I have my own deposit box. So, they say, “Do you have your key?” “No, I don’t have the key.” They have a backup key, but they verify again. So, a multi-layer process to the bank to get my, my nuggets, whatever it is, my deeds, whatever information. Microsegmentation is down to that asset level. So, verification through each process, like a bank. That’s how I would describe it to a fifth grader.

Jackie McGuire: Okay. Awesome. So, the concept that just because I’m a teller, I don’t get access to the big vault. Just because I get access to the big vault, I don’t necessarily get after access to the safety deposit boxes inside it, that kind of thing.

Chris Boehm: Exactly. Yeah. So, on the average case, most people have been to a bank, uh, and they can understand, like, it’s a pain in the butt to go get everything throughout the process, but it is me through the whole entire time verifying I have access. And then, yeah, you might have to do a fingerprint scan, you might have to do multiple things of verification along the way, but allows you to segment down to each asset. So down to my box itself, even though I had to go through a vault door and a teller and even go through the basic security and making sure I’m not, like, acting bad at the bank. So —

Why does shadow IT make microsegmentation urgent?

Jackie McGuire: Yeah, and I think when we had our own routers and servers and those types of things, right, then you worried more about the physical barriers and whatnot. But now that everybody’s built in the cloud, microsegmentation is really important, because one of the things that I found interesting when I started building on AWS as a data scientist is you can just start, you can just spin things up. Like, if you’ve got credits in AWS, you can just, you can start running any services you want with very, you know, very strict or very lenient security controls. And it seems like with the next wave of — I made it 2 minutes, 3 minutes into the interview before I said AI — um, with AI becoming, you know, the, the huge thing that we’re all talking about now, that’s, like, exponentially increased, right?

Chris Boehm: Yeah, I mean, shadow IT is a real thing. I, I won’t deny it. Even when I was at Microsoft, it was a common challenge. Working with, when you start — I was working on the SIEM platform, and we’re pulling data from everything within a tenant. If you look at Microsoft, they’re like, “Where are these logs coming from?” “Oh, your dev team spun up their own test environment, and they had no control over it based on how the design was.” So shadow IT is a severe thing, and it’s been getting better, I would say, over time. Um, but when it comes to privilege access and making sure everyone’s doing the right thing, it’s a multi-layered process. There’s no perfect scenario today, and that’s why microsegmentation is that, not just for cloud but on premise, and multiple different levels of verification of saying that, you know, I am who I am, and that goes with service accounts and other actions. So it’s not just me as a user. I want to make sure that who’s accessing my database is that application and it’s authorized to talk to that application. So it’s definitely relevant, uh, when it comes to the world of our IT industry. So —

Why can’t AI stop lateral movement yet?

Jackie McGuire: Yeah, and when, so when we think about things like AI, um, you would think, so microsegmentation is especially helpful in stopping things like lateral movement, right? And so this is this whole concept that if somebody gets into one part of your cloud environment, if it’s not secured properly and it’s just one big segment, you can go wherever you want.

Chris Boehm: Yeah.

Jackie McGuire: So from your perspective, you would think that AI would be really effective at stopping things like lateral movement, but we haven’t really seen the rubber hitting the road there, at least I have not heard. And so why do you think, with more sophisticated types of attacks and movement, why are we having such a hard time stopping those things with AI, or spotting those things with AI? Is there something specific that’s making that more difficult?

Chris Boehm: There’s a, there’s a few things. A, AI — our attackers are leveraging AI as a service as well. So they’re leveraging the same kind of technology we’re combating with. And AI is not 100% accurate either. I’ve gone through multiple layers. I’ve built it out. I’ve even built out my own AI tools. In the end, it almost seems like it’s confused, or giving false positives, or it’s reassuring you, “I know what I’m talking about.” And unfortunately, you can’t do that in a real world scenario to business. If I told a bank — let’s go to the same scenario — “Hey, we’re going to micro segment everything, and AI is going to get it most the time right,” they’re going to be like, “We’re not interested.” Yeah. Because you can’t take down all of our transactions. You can’t take down our customers pulling out their money. That’s worth millions an hour. Uh, so that’s why at Zero Networks, we took it as, we’re going to take automation and learn on each action and take action. And it didn’t feel appropriate, even while looking at it. Artificial intelligence has their, the pros and cons. Massive data, petabytes of data, it can summarize that. Great. It gives you an idea. It’s 90% accurate. It’s good enough for me to know what to do next. But when it comes to my life, do you want a car to drive and only use artificial intelligence? No. You have machine learning and automation that says, “Hey, that’s a stop sign. I need to stop.” And it has to tell you, and I know it’s, “I need to stop,” instead of just kind of guessing, “I think that’s a stop sign. So, should we go or not?”

Where is AI actually working in security?

Jackie McGuire: Yeah. I’ve seen a few videos the last few days. It seems like that may be what’s going on. But, um, so this is a really fascinating — so when we think about agents, when we’re talking about, and agentic AI is really — I think LLMs were kind of the first thing we threw at every problem, but they’re really inefficient. They’re not necessarily — and to your point, they’re pretty prone to hallucination. I don’t like that term, because it makes it sound like they make things up. Just to be clear, the hallucination is stuff that was in the training data. We just don’t know why. Um, so when we go to, you know, microsegmentation is going to help stop that. So I guess we’ve established that AI is really not doing a great job there. Are there places where you’re seeing that AI is really effective in security? Like, are there — what’s the low-hanging fruit where people are actually having success? Because I think we need good news on AI and security.

Chris Boehm: Uh, there — okay, that’s fair, that’s fair. Uh, I’ve, I have worked on multiple AI projects. Um, probably the most successful platform is — I kind of already mentioned it — is summarization. Just saying what is happening in this very complicated metrics. As, as you may hear today in the market, there is platformization, um, large groups of products being acquired by big companies and saying, “Hey, we can do a little of everything.” The problem is, is now they’re doing a little of everything. What is going on in my own environment? I’m buy— I’m buying 14 different products from this one company. So AI is kind of summarizing what is happening based on my, um, environment. That’s what it’s trying to do. Now, I’ve seen the implementation of chat and, um, guidance. Guidance works pretty well, because you can tailor it and fine-tune it based on relevant information, and generative AI does a pretty good job getting that done at this moment in time, if it’s very controlled.

Jackie McGuire: So guidance is more, “You might want to think about looking at these things, because this is a common thing that we see,” blah, blah, blah.

Chris Boehm: Yeah. And in a cybersecurity scenario, I pull up an incident, and it says, “Hey, based on this MITRE, uh, ATT&CK, based on other assets that were attacked, you might want to look at these assets based on my discovery, and I — do you want to learn more about this?” And it will guide you through that process. So at that part, AI does a pretty good job. Where I would like to see AI go, and this is where it gets a little more scary, is offering true capabilities of saying, “Okay, based on that, let’s make an action, and I created this action for you.” Yeah. And I would love to see that in the future. It’s, it’s getting there. It’s just not there today. So —

How will AI and microsegmentation work together?

Jackie McGuire: So what do you think we need, is I guess — what’s the ideal balance of microsegmentation? Because with AI agents, you need them to be able to touch multiple things, and sometimes you need them to be able to be adaptable, because in — and that is, it is scary, right? Because I, I have also seen, like, we were just talking last night with one of my security friends, where he’s like, “Yeah, Jeff, and the AI told me to just drop this SQL table that I was having issues with.” I’m like, “Oh, just drop the table.” Um, he’s like, “No, we probably shouldn’t do that.” Uh, so what, what is the ideal balance there? Is it — so we’re using summarization, and then what’s the balance between that and microsegmentation? Do you think — I know this is a —

Chris Boehm: That’s a — if you could figure this out, you’d be the next billionaire. Probably. Probably. Um, the balance is, is providing information that’s relevant for me as a, probably, network cybersecurity professional. For example, let’s say I have my network security stack. Unfortunately, there’s been acquisitions. I have Palo Alto, Fortinet, like, I have so many different products, some old Cisco, but it was able to say, “Hey, based on what I understand in your environment, here’s the next guidance.” That’s probably where it’ll go next, is my suspicion. And then from there, it might say, “B, we can inject policies into those to make your life easier.” Um, how we do it, we do it agentless. So it doesn’t require configurations on a firewall level or even a Windows level. It just does it based on injection of agentless processes. So it allows you to not change your infrastructure. But I can kind of see the future of AI influencing microsegmentation going in that direction, like, how can we make it easier for the customer’s whole journey when it comes to policy management and verification through the, uh, through the whole entire stack, including identity. Identity is obviously a focus point.

Jackie McGuire: Yeah, I, I just wrote an article a couple days ago covering the Palo Alto CyberArk acquisition, and I used the very cliché term that identity is the new perimeter. Yeah. Because, you know, between remote work, contractors, agents, like, we have all these different things that need access, need identities. And with agents, it’s like, okay, they’re making kind of probabilistic decisions. Does that make them — they’re nonhuman, but they’re not machine, because machines make binary decisions. So, um, I, I don’t know that anybody’s really figured that out yet. Um —

Chris Boehm: I haven’t seen a perfect solution, no. But I have seen some good ideas. And I think that’s kind of where a lot of things just start grabbing traction. I mean, look at all the startups. They usually have one really good idea, um, and then everyone kind of copies it and expands on it, then it grows. So, I imagine it’s probably going to happen sooner than later, but it probably — yeah, you’re right. This probably next billion-dollar company. It’s going to revolutionize, uh, how artificial intelligence is mapping appropriately.

What makes a good security person?

Jackie McGuire: Well, and as soon as you find a good solution, I mean, being in security, we’re all kind of mischievous kids, right? And so, as soon as someone’s like, “Hey, I’ve got this bulletproof solution,” my first thing is like, all I want to do is find a way around it. All I want to do is — like, I was talking to a couple of my security friends last night, and they’re like, “Yeah, you know, we went to this party after hours, and there’s a big line at the door, and the bouncer was turning people away. So, we knew we had to find a way to sneak in.”

Chris Boehm: Good.

Jackie McGuire: Like, they could have just waited in the line and paid the bouncer the 40 bucks, right? But they were like, “No, we found a fire escape. We had —” and I’m like, this is security people. This is why we can’t bring you anywhere.

Chris Boehm: I don’t think a normal person could be a security person. Uh, I, I mean, I’ve been asked on stage, like, what would you do to transform our nation, or how are we — should train our citizens? And I’m like, they have to be all a little crazy. Like, that’s the only way. Because you have to, like, be almost a little paranoid, while at the same time being ambitious enough to take something apart and hopefully put it back together better.

Jackie McGuire: And insanely intellectually curious, and, like, have a hankering for good trouble. And I think that’s the, the good trouble part is what I think makes a really good security person.

Chris Boehm: As long as it’s good trouble. Yeah.

Jackie McGuire: Yeah. Yeah. Yeah. Sometimes the line’s a little, little blurry, but —

Chris Boehm: Skipping through a bouncer line, you know.

How should CISOs separate AI hype from real value?

Jackie McGuire: Yeah. So, I guess, uh, last question. Unfortunately, we have to wrap up because we don’t have a ton of time. I wish we had more time. But if I’m a CISO, and I’m trying to figure out, as my team are bringing me all these different AI tools, where — what is hype, and what is practical, and what will actually make an impact? Like, how — what kind of process would you use? Like, what, what would your decision-making process look like for that, where you’re like, okay, we have Zero Networks, we’re doing microsegmentation, how do I figure out whether this is just another AI hype tool, or whether this is actually something that’s going to benefit my organization?

Chris Boehm: Yeah. Um, I’ll start with the AI question first off. Any artificial intelligence platform that’s using generative AI, it better explain what it’s doing. So, if I click, “Hey, give me a summarization,” and it just is a black box — personally, I love the idea. Could be bulletproof, but I don’t believe it. Like, I, I still — it could give me a false positive. I don’t know where to look. I can’t verify. There’s no audit trail. That’s a red flag. I would just disconnect. Even if it’s the best product and the best name in the market, I’m sorry, I just — I don’t trust it today. That’s just me. As for Zero Networks, how the difference is, is I would look at it from a perspective of how is it learning, and how is it impacting your business, and is it creating friction, and is it a journey that’s success? Like, can you actually do it, or is it something you’re going to struggle on, the a constant, “Hey, I have to hire new people, new teams. I — it’s an ongoing effort. We’re not ever getting it done.” And that’s kind of the unfortunate part of microsegmentation, is it’s been known to fail or never get completed. And I would say a lot of our customers are not having that conversation. That’s why we have not lost any customers. We are very proud of that, and because they continuously use us, and it’s learning and doing what it’s supposed to do.

Jackie McGuire: So you are making the rubber hit the road.

Chris Boehm: We’re trying.

Jackie McGuire: That’s amazing. Chris Boehm, field CTO for Zero Networks, thank you so much for joining us. This was amazing. Really appreciate it.

Chris Boehm: Uh, thank you.

Jackie McGuire: Uh, live from CyberRisk TV, we are at Black Hat 2025. I’m Jackie McGuire. We are in Las Vegas, Nevada, and the air is actually clear today, so we can all breathe. Anybody who was here yesterday, you literally could not see more than half a mile. It was, it was insane. Um, but we are all happy to be here at Hacker Summer Camp. Stay tuned. We’ll be right back with lots more insights. If you’d like to check out more about Zero Networks, please visit zeronetworks.com.