Day 3 opens with the four technical foundations a leader must actually grasp — not to run them, but to ask the right questions and fund the right things.
Day 3Zero TrustCloudPost-Quantum
Notes: Set expectation: leader-level, not engineer-level. Each pillar ends in a question the leader should be asking.
Lesson 10 · Slide 2
Four foundations
Zero trust & network — the perimeter is gone; identity is the new boundary
Cloud — shared responsibility, where misconfiguration is the dominant risk
Cryptography — what it protects, and the post-quantum clock already ticking
Supply chain — your security is only as strong as your suppliers'
Notes: The map for the lesson. Reveal each; each becomes a section.
Lesson 10 · Slide 3
The perimeter has collapsed
The old model trusted anything inside the network wall. Remote work, cloud, and mobile dissolved the wall. Press →.
Castle-and-moat: trust everything inside
→
One breach inside = free run of the network
→
Zero trust: verify every request, every time
Notes: Reveal step by step. The middle node is the failure of implicit trust — the reason zero trust exists.
Lesson 10 · Slide 4
Zero trust, in plain terms
Never trust, always verify — location on the network proves nothing
Identity is the new perimeter — who and what, checked per request
Least privilege — access to just what's needed, just when needed
Micro-segmentation — a breach in one place doesn't open everywhere
The standard
This is the substance of modern zero-trust architecture guidance (e.g., NIST SP 800-207) — a direction of travel, not a product you buy.
Notes: Keep it conceptual and vendor-neutral. Least privilege echoes Lessons 06/08 — consistency helps the room.
Lesson 10 · Slide 5
Cloud: shared responsibility
The provider secures OF the cloud
The physical data centres, the hardware, the core platform.
You secure IN the cloud
Your data, your access, your configuration. This half is yours — and it's where breaches happen.
Notes: The single most misunderstood cloud idea for leaders: "we moved to the cloud" does not mean "someone else secures our data."
Lesson 10 · Slide 6
Cloud: where it actually goes wrong
Misconfiguration — the dominant cause: a setting left open, a bucket made public
Identity & entitlements — over-broad access is the cloud's insider problem
Visibility — you cannot protect what you don't know you're running
Leader's question
"Who checks our cloud configuration against a hardened baseline, and how would we know if something were left exposed?"
Notes: Most cloud incidents are self-inflicted misconfigurations, not provider failures. The question is the takeaway.
Lesson 10 · Slide 7
Cryptography for leaders
At rest & in transit — encryption protects stored data and data on the move
Key management is the hard part — the maths rarely fails; the key handling does
Crypto-agility — being able to change algorithms without re-architecting everything
Why you care
You don't need the mathematics. You need to know that keys are the crown jewels and that agility is now a requirement, not a nicety.
Notes: Sets up post-quantum. The message: encryption is only as good as key handling, and change is coming.
Lesson 10 · Slide 8
Post-quantum: the clock already runs
Large quantum computers could one day break today's public-key encryption. The threat is not "someday" — it is now.
Harvest now, decrypt later
Adversaries steal your encrypted data today and store it, planning to decrypt it once quantum capability matures. Anything that must stay secret for years is already at risk.
Notes: This is the counter-intuitive point leaders miss: encrypted data can be a liability today. NIST has published post-quantum standards; migration is a multi-year programme to start now.
Lesson 10 · Slide 9
"Harvest now, decrypt later" means an adversary benefits today from stealing data they cannot yet read. What should you do now?
C. A and B ignore that data stolen today can be decrypted later — for anything that must stay secret for years, the clock is already running. D is reckless. The right move is to know what must stay confidential long-term and start the multi-year migration to quantum-resistant cryptography (standards now exist), beginning with crypto-agility.
Notes: The trap is "not urgent." For long-lived secrets it is the opposite. Inventory first, then migrate.
Lesson 10 · Slide 10
Supply chain: your extended surface
Third-party risk — a supplier's breach becomes your breach
Software provenance — do you know what's inside the software you run?
Bill of materials (SBOM) — an ingredients list for software, so you can find what's vulnerable
Notes: Reveal each. Ties directly to Lesson 01's "partners inside the extended target surface." SBOM as a concept, not a product.
Lesson 10 · Slide 11
You are as strong as your weakest supplier
The adversary who cannot breach you directly will breach the small vendor with your access. Supply-chain compromise is now a primary route to hard targets.
Leader's question
"Which suppliers can reach our crown jewels, and what security do we actually require of them?"
Notes: Connect to Day 1: partners are inside your surface. Vendor risk is not procurement paperwork; it is attack surface.
Lesson 10 · Slide 12
Two-minute drill: name your top suppliers
List your three most critical suppliers and, for each, what they can reach in your environment. If you cannot answer the "what they can reach" part, that gap is the exercise.
Notes: Start the timer. Most leaders can name the suppliers but not their access. That asymmetry is the lesson.
Lesson 10 · Slide 13
Recap & what's next
Trust nothing by location; verify identity per request (zero trust)
In the cloud, your configuration is your responsibility — and your risk
Post-quantum's clock runs today; suppliers are inside your surface
Next
Lesson 11 — AI as Threat and Tool: how AI changes the speed and cost of attacks, and where it helps you.
Notes: Bridge: the foundations set the stage; AI is now reshaping how fast adversaries can exploit them.