What is the difference between trust but verify and deny by default?

Trust but verify allows applications to run unless recognized as malicious, so it always trails new threats. Deny by default permits only approved applications, which removes that lag and blocks unknown malware and zero-day threats structurally.

Should AI make allow or deny decisions in security tooling?

Rob argues no. An error rate around 15 percent is tolerable in categorization but catastrophic when the output decides whether code executes across an estate. He supports AI for categorization and against it for final decisions.

What is ringfencing and why does it matter for agentic AI?

Ringfencing constrains what an approved application can do once it is running. For agentic AI it bounds the blast radius, which is what makes adoption survivable rather than open-ended.

What made double extortion ransomware different?

Attackers began exfiltrating data as well as encrypting it. That broke the assumption that good backups equal recovery, because the leverage no longer depended on whether you could restore.

The Logic of Deny by Default

Two decades of cleaning up#

Rob’s argument carries weight because of where he formed it. Nearly twenty years at a managed service provider in Ireland, dealing with the consequences of a model that permits anything not yet known to be bad. The turning point was watching a double extortion attack, where exfiltration alongside encryption meant that having good backups no longer meant having a recovery.

Why deny by default is structural#

The distinction Rob draws is not about product quality but about logic. A model that blocks what it recognizes as malicious will always trail the people producing new malicious things. A model that permits only what has been approved does not have that lag, which is what neutralizes zero-day threats and unknown malware.

The 15 percent problem#

Rob is measured rather than dismissive about AI in security. Categorization is a good fit. Final allow or deny decisions are not, and the reason is arithmetic: an error rate that would be acceptable in most applications is catastrophic when the decision is whether to let something execute across an estate.

It is a more useful position than either AI maximalism or refusal, and it maps onto the guardrail argument we hear repeatedly. An agent will reach further than it should if nobody is watching.

Ringfencing and agentic AI#

Ringfencing limits what an approved application is allowed to do once running. Rob makes the case that this is what allows organizations to adopt agentic AI without accepting unbounded blast radius, and covers Zero Trust Network Access as the route to closing exposed ports.

The culture underneath the growth#

A lighter but genuinely useful thread covers how ThreatLocker operates internally: a 60 second support response target with an alarm attached, and random pitch-offs that require every employee to be able to explain the mission.

The Logic of Deny by Default: Building the Ultimate Security Guardrail

The Logic of Deny by Default: Building the Ultimate Security Guardrail

Key Takeaways

Table of Contents