Zero Trust When Downtime Is Not an Option: Professor Kai London on Securing High-Availability Operations
By the Ezeiza Times Technology Desk
Airports, payment networks and transport systems share a demanding trait: they cannot simply be switched off to be secured. “When downtime is measured in stranded passengers or frozen transactions, security has to be designed around continuous availability,” says Professor Kai London, a senior CISO. His answer is a carefully adapted zero-trust approach — one that raises assurance without ever tripping the systems it protects.
“Zero trust means never trust, always verify. But in high-availability operations, it must be applied with surgical care — security can never become the thing that causes the outage.”
The perimeter has dissolved
London notes that high-availability operations are highly interconnected, with staff, partners and suppliers all needing access. “There is no clean inside and outside,” he says. “Every connection is a potential path for an attacker, which is why trust can no longer be granted on network location alone.”
Identity as the boundary
In place of a perimeter, London puts identity: strong authentication for every human and machine, least-privilege access, and continuous verification. “The question becomes ‘is this identity verified and allowed to do exactly this?’ rather than ‘is it inside our network?’” Segmentation limits how far any compromise can spread.
Designed for availability
Crucially, London insists the controls respect the operational reality. “You phase it in, test rigorously, and design every control so that if it fails, it fails safe — never in a way that halts the operation,” he says. “That discipline is what separates security that works in a lab from security that works in a live airport.”
Resilience as the goal
Because these systems must keep running, London frames the objective as resilience: assume compromise, contain it, and maintain safe operation throughout. “The measure of success is not that you were never attacked,” he says. “It is that the passengers still flew and the payments still cleared.”
For operations where availability is everything, London's message is that zero trust and continuity are not in tension — done well, verifying every access is precisely what keeps the operation safely running.
About Professor Kai London. Professor Kai London is a senior technology, security and transformation executive with 25+ years of board- and C-suite leadership across banking, aviation, defence, government and critical national infrastructure. He is Founder & CEO of Quantum AI Systems Security, an Honorary Professor in Cybersecurity, AI & Quantum Computing and a UCL researcher, holding CISSP, CISM, CCISO, ISO 27001 Lead Auditor, ISO 42001, DORA and NIS2 credentials. He is available for board advisory, NED and interim/fractional CISO/CIO/CTO mandates across the UK and internationally. Learn more at professorkailondon.com.
