Skip to main content

Phen Zero Trust

Traditional network security models are no longer sufficient to protect against advanced cyber threats that frequently target large organizations. These threats often come from both external and internal sources, making it difficult to rely on perimeter defenses alone. In addition, the increasing use of cloud services and mobile devices has made it challenging to control access to sensitive data and applications.

To address these challenges, Zero Trust is the next evolution/addition in protecting networks and systems from insider threats and our adversaries. With zero-trust security, every user and device must be verified and authorized before being granted access to any network resource, regardless of whether they are inside or outside the network perimeter. This approach requires strict access controls, continuous monitoring, and multifactor authentication to prevent unauthorized access to sensitive information and systems.

Implementing a zero-trust security model introduces a new component that provides additional protection against cyber threats and increases the confidentiality, integrity, and availability of critical assets. By assuming that every user and device is a potential threat and requires continuous authentication and authorization, organizations can significantly reduce the risk of data breaches and other security incidents.

Zero Trust is a security model that assumes that no user, device, or network should be trusted by default, regardless of whether they are inside or outside an organization’s perimeter.

There are seven pillars of Zero Trust that organizations must consider when implementing this security model. These pillars include identity and access management (IAM), network segmentation, least privilege, data security, visibility and analytics, automation, and governance. Each pillar represents a different aspect of Zero Trust Architecture (ZTA) and is critical to the overall effectiveness of the security model.

In addition to these seven pillars, Zero Trust also includes several key capabilities that are necessary for effective implementation. These capabilities include multi-factor authentication (MFA), conditional access, micro-segmentation, and real-time monitoring. These capabilities help organizations protect against cyber threats by providing additional layers of security and increasing the organization’s ability to detect and respond to potential threats.

The maturity of Zero Trust can be measured in several ways. This includes the level of implementation of each of the seven pillars, the extent to which the organization has implemented the key capabilities of Zero Trust, the level of automation in the organization’s security processes, and the effectiveness of the organization’s security monitoring and response capabilities.

Artificial intelligence (AI) can be used to enhance the effectiveness of Zero Trust by providing advanced threat detection and response capabilities. AI can analyze vast amounts of data in real-time to identify potential threats and can also automate certain security processes to reduce the likelihood of human error. AI can be integrated with Zero Trust in several ways, including providing real-time threat detection and response capabilities, automating certain security processes, and enhancing the effectiveness of security monitoring and analysis tools.

In summary, Zero Trust is a security model that assumes no user, device, or network should be trusted by default, and it can help organizations protect against increasingly sophisticated cyber threats. The maturity of Zero Trust can be measured in several ways, and AI can be used to enhance the effectiveness of Zero Trust by providing advanced threat detection and response capabilities.


CCG’s CheckMate and Phen.AI provide a humanoid AI-driven and controlled Insider Threat – User Entity Behavioral Analytics (IT-UEBA) security solution that plays a critical role in detecting and responding to cyber-attacks. Phen.AI uses the Zero Trust framework to improve its real-time threat detection and response capabilities to identify and mitigate potential threats.

CheckMate and Phen.AI analyze vast amounts of data from multiple sources, including network logs, user behavior, and endpoint activity. It uses machine learning algorithms to identify patterns and anomalies that could indicate a potential cyber-attack and automatically take action to mitigate the threat.

In an attack scenario, Phen.AI would detect the cyber-attack early on before it causes significant damage to the organization’s systems and data.  Early detection is also key in reducing the expansion and damage of the attack and will minimize the high cost of resolution. Phen.AI immediately alerts the security team and takes automated actions to contain and remediate the threat.

CheckMate and Phen.AI automatically isolate infected endpoints from the rest of the network, block malicious traffic, stop user activity and access, and quarantine suspicious files for further analysis. The security solution provides real-time visibility and analytics, allowing the security team to monitor the situation and respond quickly and effectively.

To implement zero-trust security effectively, organizations need to adopt a comprehensive approach that encompasses several key capabilities and pillars and assess their maturity level through a maturity model.

A quick assessment of what CheckMate and Phen.AI cover within the 7 pillars and the Maturity Model of Zero Trust and a description of how this helps Phen.AI integrate smartly to deter threats. CheckMate performs as the SIEM on Steroids and provides oversight and ensures compliance to elevated levels.

7 Pillars, capabilities, and Maturity Model

Phen.AI leverages its knowledge to ensure compliance across various datasets, enabling the integration of knowledge and driving the implementation of the 7 pillars. Phen.AI provides complete coverage.  Phen.AI’s KRRA allows him to ask the right questions and knows what answers he expects.  Phen.AI has access to fully “prepare” level knowledge of the network internally and knowledge of what each level of Zero Trust covers, this allows him to access the right information and make judgments based on available datasets.  This allows Phen.AI to have the quick and accurate information needed in supplying compliance coverage and carrying out its duties.  Checkmate and Phen.AI provide visibility and knowledge derived from all data sets, provide an understanding of how actions affect operations and stop attackers/threats, and provide historical knowledge and understanding of all activities throughout the network.

MS      Milestone

A         Activity

C         Capability

SDDC Software-Defined data center

ZT – Zero-Trust

A Continuous Improvement of Integration Across All Areas a
Continually authenticate, access, & monitor user activity patterns to govern users’ access & privileges while protecting & securing all interactions
MS Inventory UsersC MFA

C Role-Based Access
C privilege Access Management
C Attribute Based Access ControlOngoing ZT Improvement
Understanding the health & status of devices informs risk decisions.  Real-time inspection, assessment and patching informs every access request
MS Inventory DevicesC Register, Manage & Ensure IT ComplianceC Integrated Ability to Manage Assets, ID Vulnerabilities & PatchC Remote Connections Without VPN
Secure everything from Applications to hypervisors, to include the protection of containers and virtual machines.
MS Identify DAASC Begin Virtualizing ApplicationsC DevSecOps Environments, Microservices, ContainerizationC Virtualized for SDDC or Cloud Environments
Data transparency and visibility enabled & secured by enterprise infrastructure, applications, standards, robust end-to-end encryption, & Data Tagging
MS Identify DAAS
MS Map Data Flows
A Begin Tagging & Labeling
C Begin Encryption
C Enhanced Access Based on Fine-grained AttributesC DLP, DRM, and Full Encryption

Segment, isolate & control (physically & logically) the network Environment with granular policy and Access controls
MS Map Data FlowsC Begin Micro-segmentationC Micro-segmentation on Majority of Network, Encryption in transitC full micro-segmentation

Automated security response based on defined processes & security policies enabled by AI, e.g., blocking actions or forcing remediation based on intelligent decisions
A Identify Manual Cybersecurity processes to automateC Begin Automating and Orchestrating ProcessesC A&O Controls Most Critical ProcessesC Analytics Drive A&O

Analyze events, activities, & behaviors to derive context and apply AI/ML to achieve a highly personalized model that improves detection & reaction time in making real-time access decisions
MS Log all trafficA Feed Traffic to SIEM
C Develop Basic Cybersecurity Analytics
C Analytics Used to Assess User BehaviorC Dynamic Policies for Access