Beyond Zero: Enterprise Security for the AI Era establishes that the application is no longer a sufficient trust boundary. Beyond Zero
pushes authorization down to individual actions on individual resources, with contextual risk decisions running at machine speed. What’s new since BeyondCorp is fusing
static authorization guarantees with dynamic AI reasoning without turning security into a fully probabilistic system.
The mechanism is essentially a continuous feedback loop: an enterprise security world model precomputes context about users, agents, roles, resources, and expected work;
event intake adds endpoint, server, and agent signals, including prompts, plans, and tool invocations; a hierarchical reasoning engine then feeds allow, deny, challenge,
or containment decisions directly back into authorization. Expensive inference is front-loaded so thousands of decisions per second can remain low-latency.
This also collapses the traditional separation between access management and security operations: investigations can happen continuously and immediately change the actor’s
“access bubble.” Challenges add granular friction under ambiguity; containments contract authority when risk increases. More broadly, this suggests that machine-speed
agentic systems may require security to become a closed-loop authorization system rather than a monitoring layer around applications.
Bernardo Quintero’s Infected tells how a simple idea grew into VirusTotal,
then into a company, and eventually into a globally recognized security
capability acquired by Google. More than a corporate timeline, it explores how
curiosity, community building, and entrepreneurial persistence shaped both
Quintero’s career and a cornerstone of modern malware analysis.
Its strongest themes include community building, disciplined entrepreneurship,
resource constraints, local talent, and innovation driven by curiosity and
conviction rather than capital and scale.
The most useful idea in TIRA: Task-Based Intermittent Remote Attestation is not that intermittent
systems can be made task-based, or that remote attestation can hash code and report a digest. What is interesting is the way the paper treats the task abstraction itself
as the unit of attestable progress.
The mechanism is a compiler/runtime co-design. Programmer-defined idempotent tasks are instrumented with software fault isolation; unsafe memory writes and control-flow
transfers are mediated through a Trusted Compute Module; a protected bootloader establishes static attestation at boot; and successful task transitions, interrupt
evidence, and mutable memory effects are folded into a cryptographically chained execution log.
The reported overheads are practical enough to make the design worth studying: about 18% runtime overhead and 4% code-size overhead on average. More broadly, the paper
suggests that in some constrained systems, the right attestation boundary may be the application’s execution abstraction, not just the boot image or hardware root.
Kettle turns build provenance from an assertion into hardware-rooted evidence. It runs builds inside a measured confidential VM,
records source, resolved dependencies, toolchain, environment, and output digests as SLSA/in-toto provenance, then commits the provenance hash into the TEE attestation
report. Verification becomes an attestation check plus digest comparisons rather than trusting CI infrastructure or reproducing the build.
The interesting part is the composition: Kettle reproducibly builds its own CVM image, providing a way to derive the expected launch
measurement; uses a Merkle commitment over build inputs; and can optionally attest the CVM before confidentially delivering source. Reproducibility answers whether another
build produces the same bytes; attestation proves that one measured environment actually observed specific inputs and produced specific bytes.
The broader lesson is that attestation can move build infrastructure outside the trust boundary—but verifier policy still determines which measured builders deserve trust.
For a related approach to ML provenance, see my notes on Atlas, which combines attestation and transparency logs to authenticate a model’s transformation history.
Dominik Merli’s Engineering Secure Devices uses embedded security to teach
broader lessons about system integrity, device identity, and engineering
trade-offs. Its constrained systems make trust boundaries especially clear,
but its mental models also apply to containerized applications and cloud
runtimes.
The book’s treatment of secure boot, firmware updates, cryptographic
implementation, and hardware-anchored identity makes it a valuable addition
for practitioners interested in how integrity is engineered from the ground
up.
The interesting idea here is shifting software provenance from reproducing or trusting a build to cryptographically verifying the computation itself. Reproducible
builds effectively say “repeat my computation”; TEE-based systems attest that trusted hardware performed it. COSMICTURTLE instead runs compilation inside the RISC Zero
zkVM and produces the binary plus a succinct proof binding the claimed source, compiler, and output.
The prototype runs unmodified ChibiCC and successfully zk-compiles 252 C programs, including OpenSSL and libsodium source files. Adversarial tests reject compiler
substitution, source or binary tampering, and replay. This is still far from proving an industrial GCC/LLVM build graph, but it suggests that software provenance can
be dealt with as a verifiable-computation problem rather than primarily a reproducibility or hardware-attestation problem.
aflock applies familiar ideas from SPIFFE/SPIRE, in-toto, capability systems, and policy engines to agent
execution. Rather than trusting an agent to report its own behavior, aflock moves authorization and evidence generation into an external MCP server. Agent identity is
derived from introspectable properties; short-lived JWTs convey authority; and the server signs attestations with keys the agent never sees.
Policies can constrain individual actions and cumulative properties of an execution trajectory. Session attestations are committed through a Merkle tree to provide
ordering and completeness evidence, while Rego evaluates cross-attestation constraints. Hierarchical sub-agent delegation uses in-toto-style sublayouts with mandatory
attenuation, so delegated authority cannot exceed the parent’s constraints.
The broader systems principle is compelling: securing autonomous agents may require treating execution trajectories much like software supply chains—externally
constrained, cryptographically recorded, and recursively verifiable—rather than relying on the agent itself to enforce or describe its boundaries.
The motivation in Fortress is to extend the trust boundary from TrustZone to peripherals. MMIO/DMA regions are assigned to the secure world, and the driver is partitioned
so that code touching sensitive data executes in OP-TEE’s secure kernel. Data then flows through a PTA to a user-space TA for filtering or encryption before being released
to the untrusted OS or cloud. This can help protect sensor data from a compromised OS or hypervisor. Direct MMIO has little overhead; the expensive part is crossing
protection boundaries with buffers—up to orders of magnitude slower in their evaluation. The broader lesson is that confidential execution alone may be insufficient when
plaintext inputs traverse privileged, untrusted software before reaching the TEE.