Agnidipta Sarkar, Chief Evangelist, ColorTokens is a cybersecurity and digital resilience chief with greater than three many years of expertise spanning cyber protection, threat administration, enterprise continuity, privateness, and Zero Belief. At ColorTokens, he works with boards, C-suite executives, and safety leaders to strengthen breach readiness and join cybersecurity packages with enterprise priorities, whereas additionally contributing to worldwide requirements and trade initiatives by way of organizations together with ISO, the Cloud Safety Alliance, NIST, and ISA. Earlier than becoming a member of ColorTokens, Sarkar served as Group CISO at Biocon and held senior data safety and threat management roles at organizations together with DXC Know-how, Hewlett Packard Enterprise, and HP.
ColorTokens is a cybersecurity firm centered on microsegmentation, Zero Belief, and serving to enterprises grow to be extra resilient when attackers breach conventional perimeter defenses. Its flagship Xshield Enterprise Microsegmentation Platform is designed to forestall attackers and malware from transferring laterally throughout a corporation by creating granular safety boundaries round workloads and belongings spanning information facilities, cloud infrastructure, endpoints, Kubernetes environments, operational expertise (OT), and Web of Issues (IoT) units. The platform additionally incorporates AI-assisted workflows for locating environments, creating segmentation insurance policies, and accelerating coverage deployment, with the broader aim of lowering a corporation’s assault floor and limiting the potential impression, or “blast radius,” of a profitable breach.
You’ve gotten spent greater than three many years transferring from hands-on networking and safety roles at HCL, Wipro, HP, HPE, and DXC to serving as Group Chief Info Safety Officer at Biocon and contributing to worldwide safety requirements. How did these frontline experiences form your conviction that organizations should put together to include breaches somewhat than assume they’ll stop each intrusion?
In my early days at HCL and Wipro, cybersecurity felt just like the Wild West, thrilling, chaotic, and filled with alternative. I dove in, experimenting, failing, studying, and succeeding at every part expertise might throw at me: firewalls, IDS, MFA, encryption, audits, governance. However the true schooling got here after I watched my first safety incident unfold. Instantly, all these greatest practices crumbled beneath strain. That was my wake-up name.
At HP, I bought a front-row seat to chaos, first as a fly on the wall, then as an operational chief, watching chaos unfold up shut. Each incident drove residence the identical lesson: IT by no means stands nonetheless, and no funding can assure security. After I lastly took the reins as Group CISO, I knew my job was to construct a playbook for dealing with breaches, not just for my safety operations, however for the entire group. One which was repeatable, predictable, and will preserve the enterprise working when the storm hit, repeatedly enhancing the safety operations over time.
On paper, the instruments seemed good. In actuality, IT Service Administration uncovered cracks you by no means noticed coming. Asset administration, patching, configuration, change, threat—all snarled with human error. That’s the place digital weak spot hides, and when the alarms go off, it’s a nightmare to untangle. There isn’t any script for the warfare room when a breach hits. Chaos is the rule, not the exception. That’s the reason I’ve spent my profession constructing construction within the eye of the storm and serving to leaders lower by way of the noise and handle threat, not get swept away by it.
Trying again, I’m grateful for each lesson—watching from the sidelines, getting my fingers soiled within the thick of assaults, and at last main from the entrance. That’s why I champion breach readiness as an artwork, not only a science. You may map out assault patterns all day, however what issues is what occurs within the warfare room, when leaders have to carry the road. That readability solely comes from residing by way of it.
That’s the reason I constructed a breach readiness framework to anticipate, stand up to, and evolve the talents to face the following cyberattack. The framework helps organizations transfer with the storm, not towards it. The ultimate aim is to appreciate Koun Ryusui, drifting like clouds, flowing like water, in order that, when the following unprecedented assault hits, as a substitute of chaos, enterprises train structured flexibility and resilience, leveraging their expertise investments to emerge stronger and extra assured.
AI helps attackers automate reconnaissance, vulnerability exploitation, and lateral motion, doubtlessly compressing actions that when took weeks into hours or minutes. Which elements of the traditional incident-response mannequin grow to be ineffective when assaults start working at machine velocity?
When assaults transfer at machine velocity, the defenders who survive are those who can analyze and act quicker than the adversary. Sure, AI does give attackers new instruments, but it surely empowers defenders too. In my expertise, there are two methods to deal with these unprecedented, AI-powered assaults.
First, it is advisable to redesign your digital panorama. Construct breach-ready zones and microsegments that separate your crown jewels from the remaining. Consider it like a maze: some paths are open, others are blocked, making it robust for unauthorized identities to maneuver freely. That’s how you retain AI-powered assaults at bay by slowing them down, as a result of the maze retains altering with adjustments in digital methods.
Second, you want templates, playbooks, and clear roles prepared earlier than the alarm ever sounds. In order that when that does, each human and machine is aware of what must be finished and in what precedence. The trick is to purchase time and sluggish the AI down, drive it to work tougher, and deny it simple motion. That’s how you retain your defenses within the battle when each millisecond counts.
Ask any sailor who has survived a submarine breach. When water comes speeding in, you wouldn’t have time to guess its subsequent transfer. It’s worthwhile to have strengthened the suitable doorways forward of time, understanding what it’s essential to preserve operational and the place the strain will hit. When the breach occurs, all you are able to do is quarantine the flooded compartment and preserve the remainder of the vessel working. That’s the way you defend your minimal viable enterprise. Within the digital world, meaning your minimal viable digital enterprise.
That’s what breach readiness is all about. Ought to an assault ever get by way of, you quarantine the affected space, set off your BCP, and preserve the unaffected core enterprise working. No shutdown, no disaster. Simply an incident emergency.
You advocate discussing breach readiness in enterprise and monetary phrases somewhat than treating it solely as a technical challenge. Which metrics ought to boards use to find out whether or not the group might proceed working by way of a critical cyberattack?
Breaches don’t simply hit your methods; they hit every part and everybody that relies on them. Ask the affected person turned away from a hospital, the traveler stranded at an airport, or the automobile vendor left in debt for months. That’s the actual value of a cyberattack. It’s not if, however when. That’s the reason boards should have a look at breach readiness as a enterprise and monetary crucial.
There are two metrics each board ought to monitor.
First, set up the quantum of fabric impression the board is prepared to simply accept in pursuit of digital and AI ambitions. That units the bar for the way a lot of your digital enterprise should keep operational throughout a breach. I name these the Most Acceptable Materials Affect (MAMI) and the Minimal Viable Digital Enterprise (MVDE).
Many confuse MVDE with enterprise continuity, however they aren’t the identical. When you say lower than 10% impression is appropriate, then 90% of your online business should preserve working even throughout a breach. Most enterprise continuity plans solely get you again to 30% at greatest, leaving 60% of your digital enterprise uncovered. That paradox retains leaders up at evening.
When you set your MVDE at 70%, you possibly can guarantee stakeholders that you’re investing in defenses that preserve the enterprise working, even when the worst occurs, constructing a maze that’s robust for human or AI attackers to breach, and the muscle to quarantine assaults at machine velocity. That is the place microsegmentation performs a foundational lego brick. Now you can plug most of your cybersecurity investments like EDR, Firewalls, SASE, Identification (human and non-human), Entry, Authorization, and OT cybersecurity into one seamlessly linked sign aircraft that your SOC can function throughout energetic breaches to include cyberattacks and isolate the MVDE.
Observe the MAMI and MVDE each quarter, for each new digital and AI initiative, and your buyers and stakeholders will solely search proof of how nicely the resilience is being managed.
“Blast radius” is more and more used as a measure of cyber resilience. How can a corporation calculate its potential blast radius earlier than an assault happens, and what would represent a suitable degree of publicity?
Blast radius issues. Considerably.
However it isn’t the one metric that counts. I all the time advocate assessing your present blast radius as step one to constructing a zero-trust, breach-ready enterprise. All you want is a Breach Readiness Affect Evaluation (BRIA), a non-intrusive, API-driven dipstick evaluation leveraging your current EDR. For OT and mainframes, you may want brokers or home equipment.
Not all blast radius is unhealthy. Generally, it’s important for software efficiency. The satan is within the particulars. Take a cache service that hurries up lookups for product information and consumer classes. It wants system-to-system connectivity to run an e-commerce platform with a number of microservices. However that very same blast radius turns into an exploit if unauthorized customers or methods can entry it.
You can not have a look at blast radius in isolation. Mix it with different safety patterns like conduct anomalies, entry misuse, privilege creep, authorization overruns, and authentication failures to essentially perceive your breach publicity. And bear in mind, what is appropriate in a single trade is likely to be a deal-breaker in one other.
How does breach readiness differ from conventional incident response, catastrophe restoration, enterprise continuity, and zero-trust packages, and the place ought to duty for coordinating these disciplines reside?
These will not be separate matters; they’re intertwined disciplines that have to be coordinated round a single enterprise end result.
I outline breach readiness as an enterprise resilience self-discipline: repeatedly making ready, architecting, exercising, and governing the group to anticipate assaults, constrain blast radius, keep the Minimal Viable Digital Enterprise throughout the group’s pre-defined Most Acceptable Materials Affect, and restore capabilities whereas the assault is being contained. Breach readiness is the weaponization of zero belief structure and lays out what should occur earlier than, throughout, and after a cyberattack. Breach readiness shifts the query from ‘How will we preserve attackers out?’ to ‘How will we ensure an incident can’t trigger extra harm than we’re ready to tolerate, and the way a lot of the enterprise can preserve working whereas we reply?’ Breach readiness is about survivability whereas the incident continues to be occurring.
The conceptual leap is critical. Disparate enterprise practices of backup and restoration, incident response, catastrophe restoration, and enterprise continuity all play essential roles in being breach prepared, as a result of they handle the disruption. They start when methods are attacked. All three packages of incident response, catastrophe restoration, and enterprise continuity focus upon “How shortly can we restore what has been disrupted?”. Breach Readiness is concentrated on “How a lot of it may stay accessible within the first place?”.
Breach readiness breaks down silos to make sure the enterprise penalties of a compromise are managed, and stakeholders are assured by specializing in methods to preserve a lot of the enterprise “unaffected” and invoke a BC/DR for the half that’s affected. Accountability and possession for being breach-ready lie with govt management. The CEO/Board owns the chance urge for food and acceptable enterprise end result. The COO or an equal enterprise resilience govt ought to coordinate breach readiness throughout the group, with the CISO proudly owning the cybersecurity dimension.
For enterprises that intend to realize a state of Kuon Ryushi, full organizational participation makes use of expertise and AI to handle the consequences of a cyberattack is essential.
ColorTokens is utilizing AI to assist safety groups analyze environments and generate microsegmentation insurance policies extra shortly. The place ought to organizations belief AI to automate defensive choices, and which containment actions ought to proceed to require human approval?
Completely. We’re doing precisely that.
However let’s be clear: ‘utilizing AI to assist safety groups’ is simply the tip of the iceberg. At ColorTokens, we imagine in utilizing AI responsibly to make enterprises really breach-ready. There’s a a lot larger story than simply ‘AI makes microsegmentation simpler.’
Current incidents with Anthropic, OpenAI, AISI, and even the health club reserving case in Australia are failures of structure, not governance. When autonomous AI escapes its sandbox, it isn’t all the time malicious or unreliable. It’s about how the structure was constructed. People should clearly outline the working envelope, and AI should keep inside it. That’s the place governance is available in.
For instance, you may permit AI to isolate any endpoint flagged as compromised with confidence above a sure threshold, until it’s an OT security system, area controller, cost system, or production-control asset. That’s bounded autonomy. However it’s simpler mentioned than finished since you want the structure to be context-specific and clearly laid out utilizing subject material consultants.
In my view and expertise, corporations should use AI to carry out discovery, correlation, dependency mapping, attack-path evaluation, blast-radius evaluation, coverage suggestions, coverage synthesis, coverage simulation, low-risk coverage optimization, pre-authorized containment, and steady verification and go away the willpower of enterprise criticality, acceptable disruption, security boundaries, crown-jewel definitions, security constraints (in OT), most acceptable impression, autonomy thresholds, exception approvals, main manufacturing isolation, and irreversible actions to people.
Backside line – AI must be allowed sufficient freedom to finish its process, however beneath express circumstances enforced by infrastructure outdoors its sphere of management. AI ought to suggest actions, should look ahead to people to approve, after which implement adjustments at machine velocity. The target isn’t to make AI autonomous. It’s to make defensive autonomy bounded.
At ColorTokens, we use AI to make the defender’s management loop quick sufficient to maintain up with attackers. Centralized coverage decisioning, a number of enforcement mechanisms, wealthy telemetry, agentless safety for methods that may’t run brokers, cloud and container help, and AI-assisted discovery and coverage synthesis—all are a part of AI-assisted breach readiness.
Microsegmentation has existed as an idea for years, however organizations ceaselessly affiliate it with complicated deployments and inflexible insurance policies. What has modified technologically that makes it extra sensible throughout cloud infrastructure, Kubernetes environments, endpoints, legacy methods, and operational expertise?
A number of issues.
What began as a flowery option to join and management networks, guaranteeing devoted connectivity and bandwidth, has developed right into a foundational cybersecurity functionality. Right this moment, microsegmentation can remodel massive enterprises into breach-ready organizations, shortly and confidently. Know-how shifts have helped us transfer previous the outdated complications: mapping dependencies, redesigning community boundaries, configuring VLANs and firewalls, writing guidelines by hand, and worrying about breaking enterprise site visitors. Segmentation was sluggish, costly, and restricted to the information heart. Not anymore.
First, identification is now the primary conduit for cyberattacks. That’s the reason enhanced identification governance is the primary precept of zero belief. In fashionable cloud environments, IP addresses are meaningless for safety. Trendy microsegmentation makes use of identification, entry, workload, software, service, and context, not simply community location. The safety boundary follows identification, entry, and the applying, not the underlying infrastructure alone.
Second, agentless microsegmentation now goes past home equipment. It extends safety to legacy methods, IoT units, and OT that can’t run brokers. Trendy microsegmentation integrates with EDR, increasing protection and slashing deployment time from months to hours, as a result of EDR already has the telemetry microsegmentation wants.
Lastly, AI is eradicating the final huge bottleneck: context-specific breach-ready coverage engineering. AI can analyze a number of information factors for context, map dependencies and assault paths, advocate zoning and microsegmentation insurance policies, and simulate their impression earlier than enforcement. Trendy microsegmentation enforces coverage straight at endpoints and workloads utilizing native OS controls. You now not want to revamp the community; microsegmentation is now seamless, and coverage follows the workload wherever it goes.
The aim isn’t just to dam each lateral motion try. However to research sufficient indicators at machine velocity to make sure that when an attacker will get in, the compromised workload doesn’t grow to be a freeway to every part else. Trendy microsegmentation is now not nearly dividing networks however about controlling and monitoring the blast radius.
What proof ought to executives demand when evaluating the monetary case for microsegmentation, significantly concerning ransomware downtime, cyber-insurance premiums, regulatory publicity, and the price of retaining important providers operational throughout an assault?
Monetary willpower of breach impression and correlating a microsegmentation funding that may guarantee unaffected operations throughout a breach requires executives to first understand that cyberattacks will succeed, regardless of the funding in cybersecurity. In 2025 and 2026, organizations that succumbed to cyberattacks and confronted unexpected downtime embrace many financially robust organizations like JLR, Nike, and Stryker. Due to this fact, it isn’t a matter of if they’d be breached, however when.
When you settle for this actuality, investing in foundational breach readiness turns into pressing and a matter of enterprise survival. To speculate properly, allow us to perceive the 2 board-level indicators in additional element.
The primary is a measure of survivability. The Most Acceptable Materials Affect (MAMI) that the highest administration and governing physique are prepared to simply accept for digital transformation or AI adoption ambitions. It would begin as a income quantity, however should broaden to monetary viability, buyer belief, repute, or model over iterations.
The second is an indicator of aggressive edge. The Minimal Viable Digital Enterprise (MVDE) that should stay operational even when probably the most unprecedented cyberattacks happen. All enterprise circumstances for brand new initiatives should contemplate each elements. The MVDE can start from 70% and preserve growing based mostly upon the success of the underlying identification and microsegmentation program.
Here’s what executives ought to search for when evaluating microsegmentation: proof that it may tackle ransomware downtime, decrease cyber-insurance premiums, cut back regulatory publicity, and preserve important providers working throughout an assault.
- Does the microsegmentation platform permit a single platform throughout datacenters, customers, OT methods, and cloud?
- What proportion of our enterprise is structured into zones and microsegments based mostly upon materials impression to enterprise versus the earlier overview?
- How swiftly can the microsegmentation answer be operational with zones, microsegments, and managed conduits, designed to maintain the MVDE operational?
- Can the microsegmentation answer combine with EDR and use it as an agent to scale back the agent footprint?
- Does the microsegmentation platform use any conversational synthetic intelligence to find out context-specific guidelines and insurance policies?
- Do we now have the power to observe adjustments within the conduct of legitimate customers in purposes and prohibit errant customers by identification?
- Can the imply time to detect and reply by quarantining malicious conduct scale with new digital and AI adoption in enterprise?
- Can the microsegmentation platform simulate and mannequin cyber protection eventualities to progressively cut back breach publicity of operations?
Whereas these would tackle most use circumstances, compliance will want particular person statements of applicability for every regulation, which may clarify what a part of the regulation may be met by the ColorTokens platform straight, what wants course of enveloping the expertise, and what wants further expertise and processes.
Many organizations conduct penetration assessments and incident-response workouts, but these could not reveal how far an attacker might transfer after gaining entry. How ought to corporations take a look at containment and survivability beneath sensible AI-accelerated assault circumstances?
If organizations must embrace the essence of Koun Ryusui in constructing breach readiness, they need to combine microsegmentation into current cybersecurity operations and evolve it over time. To try this, microsegmentation wants sign integration with different instruments within the Safety Operations Heart, just like the SIEM, the EDR, the Subsequent Gen Firewalls, and so on. This could make sure that AI-powered microsegmentation can orchestrate containment when wanted, based mostly on indicators of assault and behavioral anomalies.
What you want then will not be particular person assessments, however workouts that assist evolve your breach readiness.
There are three issues to train in case your microsegmentation and survivability are sensible. First is the present state of Breach Readiness. This may be carried out earlier than you start your ColorTokens deployment, after you might have enforced your insurance policies, and upon each change to find out whether or not your change has altered the design of your MAZE, which incorporates material-impact-based breach-ready zones, microsegments, and managed conduits.
The second is the velocity at which you’ll quarantine cyberattacks when an precise breach occurs. The important thing parameters to check are detection accuracy and the velocity of MVDE containment and isolation utilizing AI. And that may be finished by way of penetration assessments, red-teaming workouts, and breach assault simulation assessments. These assessments must be finished with out notification to the Safety Operations Heart to test their response to altering breach parameters.
The third is how your group would react in an precise breach situation. Earlier than exercising, guarantee your “be breach prepared playbooks” are communicated to all related inside stakeholders, technical help third events, and upkeep suppliers, particularly asset homeowners and OT methods integrators. Then conduct simulated workouts earlier than conducting a red-teaming evaluation to offer a practical expertise.
As enterprises deploy extra autonomous AI brokers with entry to purposes, information, credentials, and infrastructure, how will breach readiness must evolve to include not solely compromised human accounts and units, but in addition compromised or misbehaving AI brokers?
Breach readiness should evolve from containing compromised human accounts and units to treating autonomous AI brokers as a definite, high-velocity class of non-human identification (NHI) that may act with reputable credentials at machine velocity. The problem sounds important on paper as a result of NHI are anticipated to outnumber human identities at the least 250 instances by present estimates.
Brokers break conventional controls centered on customers, endpoints, and static service accounts. They maintain dwell entry to purposes, information, credentials, and infrastructure; motive and chain actions repeatedly; and may be compromised through immediate injection, device poisoning, reminiscence manipulation, supply-chain points, or easy misalignment/drift. And once they misbehave or are hijacked, the blast radius expands quicker than human-paced response can match. Breach response can’t look ahead to full certainty or multi-team escalation, and therefore hardening and automatic pre-approved fundamental responses will probably be necessary.
As extra autonomous AI brokers get deployed, breach readiness wants to make use of Identification as the first management aircraft for brokers, improve Zero Belief to “Agent Belief”, govern guardrails, reminiscence safety, and governance hygiene, graduate to pre-approved friction and automatic containment, and combine Microsegmentation and architectural isolation for containment, together with Runtime visibility, behavioral baselining, and sequence detection.
Breach readiness must shift from “can we get better after encryption?” to “can we include an autonomous actor working with legitimate credentials earlier than it cascades?” Indicators of breach readiness ought to embrace time-to-understand (which agent, what actions, what information/methods had been touched, and whether or not exercise is ongoing) and time-to-friction for brokers particularly. The ColorTokens platform can quickly uncover dependencies, generate and refine coverage, and implement containment, particularly when augmented by AI for coverage automation and turns into central to retaining tempo. On this mannequin, we prioritize isolation, containment, and least privilege over good prevention.
ColorTokens’ microsegmentation platform extends identification, steady verification, microsegmentation, behavioral monitoring, and pre-authorized containment to the agentic layer, which is able to preserve the blast radius manageable and protect operational continuity. The defensive signature required is identical one demanded by machine-speed ransomware: excessive velocity of understanding and friction, grounded in assume-breach structure somewhat than hope that brokers will all the time keep aligned.
Thanks for the good interview, readers who want to study extra ought to go to ColorTokens.
