Beyond Zero: Google Publishes Successor to BeyondCorp

Google has published a research paper detailing Beyond Zero, an advanced security model designed for the era of artificial intelligence. This model expands upon Zero Trust, Google's approach to enterprise security, by introducing a new paradigm for protecting AI agents.

Key differences from traditional Zero Trust include authorization at the individual action and resource level, a blend of static policies and dynamic controls for heightened risk scenarios, and the incorporation of extensive contextual and risk-based data. This information is derived from five core principles outlined in the paper: authorization at the action and resource level, combining static policies and dynamic controls for higher-risk situations, continuously updated context about users, actions, data, and risks, automated investigation triggered by risk indicators, and challenges or containment measures that may necessitate additional verification or data from users and AI agents.

The introduction of Beyond Zero comes as AI agents are deployed across the globe, transforming the assumptions surrounding enterprise security. SaaS vendors will need to provide action-level authorization, while standards in this field must evolve. Google notes that smaller security teams will face challenges regarding false positives, intent, auditing, and cost.

Google's approach to Beyond Zero has garnered mixed reactions. While Heather Adkins, VP of security engineering at Google, explains that continuous authorization of every action at scale initially seemed excessive, the scale of users and AI agents has made it necessary. SaaS vendor Canva's security manager, Kane Narraway, expresses cautious optimism about the goals but warns about the challenges smaller enterprises might face in implementing these ideas.

The community's response has largely been skeptical, with concerns raised about the reliability and complexity of AI-driven authorization.