From Critical Infrastructure to Global Enterprise Security: How Ankit Verma Is Shaping the Future of Zero Trust and Cybersecurity Leadership

Honestly it wasn’t a straight line. I started in computer science, and it was during my Master of Science in Computer Science that everything shifted for me. I was lucky enough to have Professor Ed Amoroso as a mentor, and his insight really inspired me to explore the world of cybersecurity in depth. Before that I loved the mechanics of how systems fit together the architecture side. But as I took on larger infrastructure and transformation projects I realized how fragile those systems could be. I became less obsessed with just keeping the lights on and more obsessed with what happens when someone tries to turn them off. It became about resilience, not just uptime. I think that’s why program management felt like the right home for me; I wanted to be the bridge between the technical "how" and the business "why."​

Early in my career, I was definitely the person hyper-focused on the GANTT chart, hitting every milestone and managing risks in a spreadsheet. Those fundamentals are still part of my toolkit, but I’ve learned that a project is only as good as the buy-in you build. Whether it’s a massive datacenter move or a Zero Trust rollout the technology is rarely the blocker. In fact when I speak at ISACA this August on weaving IAM, ZTNA, and SASE together, my main message to the audience isn't going to be about the tech itself. It’s going to be about how the real work is helping stakeholders understand the 'why' behind the change. If you don't build trust before you start pushing for execution you’re going to hit a wall every time.

I like to say that Zero Trust is about killing off assumptions. We’ve spent decades trusting anything inside our walled garden but that doesn't work anymore. In business terms it’s really about giving your people the freedom to work from anywhere without putting the company at risk. It isn't a product you buy off the shelf, it's a discipline. You have to constantly verify who is asking for access and why every single time. It’s a journey not a toggle switch.

The scale was frankly intimidating. We were dealing with a multi  agency environment that had decades of technical debt. My biggest moment was realizing that identity management has to be the bedrock of everything else. Before we could implement new security controls we had to spend months just mapping out who actually owned what and where the access gaps were. It wasn't glamorous work but it was essential. If you don't fix the identity foundation first everything you build on top of it is just a bandage. Plus you have to design for the people in the field, not just the people in the office. If you ignore their workflow they’ll find a way to work around your security.

First get real visibility into your identity environment. You can’t protect what you can’t see, and you’d be surprised how many Ghost accounts or unclear permissions are sitting there waiting to be exploited. Second, get your leadership aligned. If IT and the business side define success differently you’re doomed before you start. Third, don't try to boil the ocean. Pick your most critical business processes and secure those first. It’s better to have one massive win that proves the value than to have ten projects that are all halfway finished.

I think it’s a mistake to treat those as competing priorities. When security feels like a roadblock the users will find a way around it and that’s how you get shadow IT. The goal is to make the secure way to work also the easiest way to work. When we engage business stakeholders early we can design controls that actually fit into how they get things done. In my experience the best security is the kind that users barely notice because it’s just naturally woven into their day.

The big one is thinking that passing an audit equals being secure. Compliance is a snapshot; it's like cleaning your house just before the inspectors arrive. But the threat landscape changes every hour. I’ve seen organizations pass every compliance check and still have massive glaring security holes. I always tell my teams: compliance is just the baseline not the destination. You need continuous visibility and the agility to adapt not just a certificate on the wall.

IAM is definitely the one that gets ignored until it breaks and then suddenly it’s the only thing that matters. It sounds simple right? Just managing permissions. But it touches every single app business process and partnership you have. This is exactly why I'm presenting 'The Identity-Centric Perimeter' at the ISACA conference in August because you simply cannot build a cohesive modern security fabric out of ZTNA and SASE if your identity foundation is fractured. Most companies don't realize how much technical debt has accumulated in their identity logs until they try to modernize. If you don't get this layer right your broader Zero Trust strategy is just a dream.

It’s a double edged sword. On defense we will catch threats in real-time that once took weeks to spot but attackers will use those same tools to automate and scale their efforts. That's exactly why I wrote The Cyber Renaissance. I kept seeing digital trust break down in real time and knew we needed a completely fresh blueprint for resilience. We are entering an era where risk management must be continuous data driven and fundamentally focused on rebuilding systemic trust. Moving forward governance must keep pace with the speed of AI. If your security team isn't already integrating AI into its operations to adapt to this new model they’re already behind.

You have to get comfortable speaking the language of business, not just the language of bits and bytes. Executives don't necessarily care about the specific tool you’re using; they care about risk, budget and business outcomes. My advice? Get out of your technical silo. Go talk to the finance team, the operations leads or HR. Learn how the company actually makes money. As you move into leadership your success isn't about having all the answers yourself, it's about knowing how to bring the right people together to solve the problems that actually matter to the business.