The five pillars of Zero Trust
CISA's Zero Trust Maturity Model frames security across five core technology pillars — Identity, Devices, Networks, Applications, and Data — with Visibility and Automation as cross-cutting capabilities. This site started in the Identity pillar. It's expanding into the others, and one thread runs through all of them: PII redaction. Not as a Data-pillar afterthought, but as the discipline that keeps sensitive data from leaking out of every pillar at once.
1. Identity — the foundation
Identity is where this site earned its credibility. OAuth 2.0, OIDC, SAML, MFA bypass, session abuse — the attack chains that prove identity is the new perimeter. The full research archive lives in the blog, reproduced against FlawedToken.
The redaction angle: identity systems are PII factories. Every auth event writes logs full of JWTs, OAuth codes, bearer tokens, and session cookies. Those artifacts are exactly what redaction engines must catch — and most stop at names and SSNs.
2. Devices
Device identity, posture, and telemetry. MDM inventories, endpoint logs, and compliance data that describes who owns what hardware — and often, who the person behind it is.
The redaction angle: endpoint telemetry streams into data lakes carrying names, email addresses, and device identifiers. Scrubbing happens too late at the lake; it belongs at ingestion.
3. Networks
Segmentation, micro-perimeters, and encrypted traffic — but also DNS logs, NetFlow, and email gateway records that are quietly full of personal data.
The redaction angle: network metadata is identity data. DNS queries and mail flow logs need the same masking discipline as any other sensitive dataset.
4. Applications
Workload identity, API security, and the exploding surface of AI-enabled applications. Every API call is a potential PII exfil channel.
The redaction angle: this is the new frontier. RAG pipelines, support tickets, and LLM prompts carry customer data straight into third-party models. Redaction before the model — with reversible placeholders — is the discipline that keeps AI compliant.
5. Data
The crown jewel. DLP, classification, masking, tokenization, and verified-clean document redaction. Every other pillar exists to protect this one.
The redaction angle: where redaction becomes a product. Documents with audit trails, fail-closed verification, and zero retention by design. This is the Data pillar's answer to the question every pillar asks: what do we do with the sensitive data we touch?
Cross-cutting: Visibility & Automation
The two capabilities that make the pillars coherent. Visibility means the analytics pipeline sees everything; Automation means the response is systematic. Both have the same redaction requirement: the data that flows into SIEMs and SOAR playbooks must be scrubbed before it becomes a liability.
Where this is going
The Identity pillar archive is complete and stays. The Devices, Networks, Applications, and Data pillar content is being built now — with the PII redaction thread as the through-line, and ShroudCloud as the detection engine that operationalizes it.