Agnidipta Sarkar, Chief Evangelist, ColorTokens is a cybersecurity and digital resilience leader with more than three decades of experience spanning cyber defense, risk management, business continuity, privacy, and Zero Trust. At ColorTokens, he works with boards, C-suite executives, and security leaders to strengthen breach readiness and connect cybersecurity programs with business priorities, while also contributing to international standards and industry initiatives through organizations including ISO, the Cloud Security Alliance, NIST, and ISA. Before joining ColorTokens, Sarkar served as Group CISO at Biocon and held senior information security and risk leadership roles at organizations including DXC Technology, Hewlett Packard Enterprise, and HP.
ColorTokens is a cybersecurity company focused on microsegmentation, Zero Trust, and helping enterprises become more resilient when attackers breach traditional perimeter defenses. Its flagship Xshield Enterprise Microsegmentation Platform is designed to prevent attackers and malware from moving laterally across an organization by creating granular security boundaries around workloads and assets spanning data centers, cloud infrastructure, endpoints, Kubernetes environments, operational technology (OT), and Internet of Things (IoT) devices. The platform also incorporates AI-assisted workflows for discovering environments, creating segmentation policies, and accelerating policy deployment, with the broader goal of reducing an organization’s attack surface and limiting the potential impact, or “blast radius,” of a successful breach.
You have spent more than three decades moving from hands-on networking and security roles at HCL, Wipro, HP, HPE, and DXC to serving as Group Chief Information Security Officer at Biocon and contributing to international security standards. How did those frontline experiences shape your conviction that organizations must prepare to contain breaches rather than assume they can prevent every intrusion?
In my early days at HCL and Wipro, cybersecurity felt like the Wild West, exciting, chaotic, and full of opportunity. I dove in, experimenting, failing, learning, and succeeding at everything technology could throw at me: firewalls, IDS, MFA, encryption, audits, governance. But the real education came when I watched my first security incident unfold. Suddenly, all those best practices crumbled under pressure. That was my wake-up call.
At HP, I got a front-row seat to chaos, first as a fly on the wall, then as an operational leader, watching chaos unfold up close. Every incident drove home the same lesson: IT never stands still, and no investment can guarantee safety. When I finally took the reins as Group CISO, I knew my job was to build a playbook for handling breaches, not only for my security operations, but for the whole organization. One that was repeatable, predictable, and could keep the business running when the storm hit, continuously improving the security operations over time.
On paper, the tools looked perfect. In reality, IT Service Management exposed cracks you never saw coming. Asset management, patching, configuration, change, risk—all tangled up with human error. That’s where digital weakness hides, and when the alarms go off, it’s a nightmare to untangle. There is no script for the war room when a breach hits. Chaos is the rule, not the exception. That is why I have spent my career building structure in the eye of the storm and helping leaders cut through the noise and manage risk, not get swept away by it.
Looking back, I am grateful for every lesson—watching from the sidelines, getting my hands dirty in the thick of attacks, and finally leading from the front. That’s why I champion breach readiness as an art, not just a science. You can map out attack patterns all day, but what matters is what happens in the war room, when leaders have to hold the line. That clarity only comes from living through it.
That is why I built a breach readiness framework to anticipate, withstand, and evolve the abilities to face the next cyberattack. The framework helps organizations move with the storm, not against it. The final goal is to realize Koun Ryusui, drifting like clouds, flowing like water, so that, when the next unprecedented attack hits, instead of chaos, enterprises exercise structured flexibility and resilience, leveraging their technology investments to emerge stronger and more confident.
AI is helping attackers automate reconnaissance, vulnerability exploitation, and lateral movement, potentially compressing activities that once took weeks into hours or minutes. Which parts of the conventional incident-response model become ineffective when attacks begin operating at machine speed?
When attacks move at machine speed, the defenders who survive are the ones who can analyze and act faster than the adversary. Yes, AI does give attackers new tools, but it empowers defenders too. In my experience, there are two ways to handle these unprecedented, AI-powered attacks.
First, you need to redesign your digital landscape. Build breach-ready zones and microsegments that separate your crown jewels from the rest. Think of it like a maze: some paths are open, others are blocked, making it tough for unauthorized identities to move freely. That is how you keep AI-powered attacks at bay by slowing them down, because the maze keeps changing with changes in digital systems.
Second, you need templates, playbooks, and clear roles ready before the alarm ever sounds. So that when that does, every human and machine knows what needs to be done and in what priority. The trick is to buy time and slow the AI down, force it to work harder, and deny it easy movement. That is how you keep your defenses in the fight when every millisecond counts.
Ask any sailor who has survived a submarine breach. When water comes rushing in, you do not have time to guess its next move. You need to have reinforced the right doors ahead of time, knowing what you must keep operational and where the pressure will hit. When the breach happens, all you can do is quarantine the flooded compartment and keep the rest of the vessel running. That is how you protect your minimum viable business. In the digital world, that means your minimum viable digital enterprise.
That is what breach readiness is all about. Should an attack ever get through, you quarantine the affected area, trigger your BCP, and keep the unaffected core business running. No shutdown, no crisis. Just an incident emergency.
You advocate discussing breach readiness in business and financial terms rather than treating it solely as a technical issue. Which metrics should boards use to determine whether the organization could continue operating through a serious cyberattack?
Breaches do not just hit your systems; they hit everything and everyone that depends on them. Ask the patient turned away from a hospital, the traveler stranded at an airport, or the car dealer left in debt for months. That is the real cost of a cyberattack. It is not if, but when. That is why boards must look at breach readiness as a business and financial imperative.
There are two metrics every board should track.
First, establish the quantum of material impact the board is willing to accept in pursuit of digital and AI ambitions. That sets the bar for how much of your digital enterprise must stay operational during a breach. I call these the Maximum Acceptable Material Impact (MAMI) and the Minimum Viable Digital Enterprise (MVDE).
Many confuse MVDE with business continuity, but they are not the same. If you say less than 10% impact is acceptable, then 90% of your business must keep running even during a breach. Most business continuity plans only get you back to 30% at best, leaving 60% of your digital business exposed. That paradox keeps leaders up at night.
If you set your MVDE at 70%, you can assure stakeholders that you are investing in defenses that keep the business running, even when the worst happens, building a maze that is tough for human or AI attackers to breach, and the muscle to quarantine attacks at machine speed. This is where microsegmentation plays a foundational lego brick. You can now plug most of your cybersecurity investments like EDR, Firewalls, SASE, Identity (human and non-human), Access, Authorization, and OT cybersecurity into one seamlessly connected signal plane that your SOC can operate during active breaches to contain cyberattacks and isolate the MVDE.
Track the MAMI and MVDE every quarter, for every new digital and AI initiative, and your investors and stakeholders will only seek evidence of how well the resilience is being managed.
“Blast radius” is increasingly used as a measure of cyber resilience. How can an organization calculate its potential blast radius before an attack occurs, and what would constitute an acceptable level of exposure?
Blast radius matters. Significantly.
But it is not the only metric that counts. I always advocate assessing your current blast radius as the first step to building a zero-trust, breach-ready enterprise. All you need is a Breach Readiness Impact Assessment (BRIA), a non-intrusive, API-driven dipstick analysis leveraging your existing EDR. For OT and mainframes, you might need agents or appliances.
Not all blast radius is bad. Sometimes, it’s critical for application performance. The devil is in the details. Take a cache service that speeds up lookups for product info and user sessions. It needs system-to-system connectivity to run an e-commerce platform with multiple microservices. But that same blast radius becomes an exploit if unauthorized users or systems can access it.
You cannot look at blast radius in isolation. Combine it with other security patterns like behavior anomalies, access misuse, privilege creep, authorization overruns, and authentication failures to really understand your breach exposure. And remember, what is acceptable in one industry might be a deal-breaker in another.
How does breach readiness differ from traditional incident response, disaster recovery, business continuity, and zero-trust programs, and where should responsibility for coordinating these disciplines reside?
These are not separate topics; they are intertwined disciplines that must be coordinated around a single business outcome.
I define breach readiness as an enterprise resilience discipline: continuously preparing, architecting, exercising, and governing the organization to anticipate attacks, constrain blast radius, maintain the Minimum Viable Digital Enterprise within the organization’s pre-defined Maximum Acceptable Material Impact, and restore capabilities while the attack is being contained. Breach readiness is the weaponization of zero trust architecture and lays out what must happen before, during, and after a cyberattack. Breach readiness shifts the question from ‘How do we keep attackers out?’ to ‘How do we make sure an incident cannot cause more damage than we are prepared to tolerate, and how much of the business can keep running while we respond?’ Breach readiness is about survivability while the incident is still happening.
The conceptual leap is significant. Disparate enterprise practices of backup and recovery, incident response, disaster recovery, and business continuity all play important roles in being breach ready, because they manage the disruption. They begin when systems are attacked. All three programs of incident response, disaster recovery, and business continuity focus upon “How quickly can we restore what has been disrupted?”. Breach Readiness is focused on “How much of it can remain available in the first place?”.
Breach readiness breaks down silos to ensure the business consequences of a compromise are managed, and stakeholders are assured by focusing on how to keep most of the enterprise “unaffected” and invoke a BC/DR for the part that is affected. Accountability and ownership for being breach-ready lie with executive leadership. The CEO/Board owns the risk appetite and acceptable business outcome. The COO or an equivalent enterprise resilience executive should coordinate breach readiness across the organization, with the CISO owning the cybersecurity dimension.
For enterprises that intend to achieve a state of Kuon Ryushi, complete organizational participation uses technology and AI to manage the effects of a cyberattack is crucial.
ColorTokens is using AI to help security teams analyze environments and generate microsegmentation policies more quickly. Where should organizations trust AI to automate defensive decisions, and which containment actions should continue to require human approval?
Absolutely. We are doing exactly that.
But let’s be clear: ‘using AI to help security teams’ is just the tip of the iceberg. At ColorTokens, we believe in using AI responsibly to make enterprises truly breach-ready. There is a much bigger story than just ‘AI makes microsegmentation easier.’
Recent incidents with Anthropic, OpenAI, AISI, and even the gym booking case in Australia are failures of architecture, not governance. When autonomous AI escapes its sandbox, it is not always malicious or unreliable. It is about how the architecture was built. Humans must clearly define the operating envelope, and AI must stay inside it. That is where governance comes in.
For example, you might allow AI to isolate any endpoint flagged as compromised with confidence above a certain threshold, unless it is an OT safety system, domain controller, payment system, or production-control asset. That is bounded autonomy. But it is easier said than done because you need the architecture to be context-specific and clearly laid out using subject matter experts.
In my opinion and experience, companies must use AI to perform discovery, correlation, dependency mapping, attack-path analysis, blast-radius analysis, policy recommendations, policy synthesis, policy simulation, low-risk policy optimization, pre-authorized containment, and continuous verification and leave the determination of business criticality, acceptable disruption, safety boundaries, crown-jewel definitions, safety constraints (in OT), maximum acceptable impact, autonomy thresholds, exception approvals, major production isolation, and irreversible actions to humans.
Bottom line – AI should be allowed enough freedom to complete its task, but under explicit conditions enforced by infrastructure outside its sphere of control. AI should propose actions, must wait for humans to approve, and then enforce changes at machine speed. The objective isn’t to make AI autonomous. It is to make defensive autonomy bounded.
At ColorTokens, we use AI to make the defender’s control loop fast enough to keep up with attackers. Centralized policy decisioning, multiple enforcement mechanisms, rich telemetry, agentless protection for systems that can’t run agents, cloud and container support, and AI-assisted discovery and policy synthesis—all are part of AI-assisted breach readiness.
Microsegmentation has existed as a concept for years, but organizations frequently associate it with complex deployments and rigid policies. What has changed technologically that makes it more practical across cloud infrastructure, Kubernetes environments, endpoints, legacy systems, and operational technology?
Multiple things.
What started as a fancy way to connect and control networks, ensuring dedicated connectivity and bandwidth, has evolved into a foundational cybersecurity capability. Today, microsegmentation can transform large enterprises into breach-ready organizations, quickly and confidently. Technology shifts have helped us move past the old headaches: mapping dependencies, redesigning network boundaries, configuring VLANs and firewalls, writing rules by hand, and worrying about breaking business traffic. Segmentation used to be slow, expensive, and limited to the data center. Not anymore.
First, identity is now the main conduit for cyberattacks. That is why enhanced identity governance is the first principle of zero trust. In modern cloud environments, IP addresses are meaningless for security. Modern microsegmentation uses identity, access, workload, application, service, and context, not just network location. The security boundary follows identity, access, and the application, not the underlying infrastructure alone.
Second, agentless microsegmentation now goes beyond appliances. It extends protection to legacy systems, IoT devices, and OT that cannot run agents. Modern microsegmentation integrates with EDR, expanding coverage and slashing deployment time from months to hours, because EDR already has the telemetry microsegmentation needs.
Finally, AI is removing the last big bottleneck: context-specific breach-ready policy engineering. AI can analyze multiple data points for context, map dependencies and attack paths, recommend zoning and microsegmentation policies, and simulate their impact before enforcement. Modern microsegmentation enforces policy directly at endpoints and workloads using native OS controls. You no longer need to redesign the network; microsegmentation is now seamless, and policy follows the workload wherever it goes.
The goal is not just to block every lateral movement attempt. But to analyze enough signals at machine speed to ensure that when an attacker gets in, the compromised workload does not become a highway to everything else. Modern microsegmentation is no longer just about dividing networks but about controlling and monitoring the blast radius.
What evidence should executives demand when evaluating the financial case for microsegmentation, particularly regarding ransomware downtime, cyber-insurance premiums, regulatory exposure, and the cost of keeping critical services operational during an attack?
Financial determination of breach impact and correlating a microsegmentation investment that can ensure unaffected operations during a breach requires executives to first realize that cyberattacks will succeed, irrespective of the investment in cybersecurity. In 2025 and 2026, organizations that succumbed to cyberattacks and faced unforeseen downtime include many financially strong organizations like JLR, Nike, and Stryker. Therefore, it is not a matter of if they would be breached, but when.
Once you accept this reality, investing in foundational breach readiness becomes urgent and a matter of business survival. To invest wisely, let us understand the two board-level indicators in more detail.
The first is a measure of survivability. The Maximum Acceptable Material Impact (MAMI) that the top management and governing body are willing to accept for digital transformation or AI adoption ambitions. It might start as a revenue number, but must expand to financial viability, customer trust, reputation, or brand over iterations.
The second is an indicator of competitive edge. The Minimum Viable Digital Enterprise (MVDE) that must remain operational even when the most unprecedented cyberattacks occur. All business cases for new initiatives must consider both factors. The MVDE can begin from 70% and keep increasing based upon the success of the underlying identity and microsegmentation program.
Here is what executives should look for when evaluating microsegmentation: evidence that it can address ransomware downtime, lower cyber-insurance premiums, reduce regulatory exposure, and keep critical services running during an attack.
- Does the microsegmentation platform allow a single platform across datacenters, users, OT systems, and cloud?
- What percentage of our enterprise is structured into zones and microsegments based upon material impact to business versus the previous review?
- How swiftly can the microsegmentation solution be operational with zones, microsegments, and controlled conduits, designed to keep the MVDE operational?
- Can the microsegmentation solution integrate with EDR and use it as an agent to reduce the agent footprint?
- Does the microsegmentation platform use any conversational artificial intelligence to determine context-specific rules and policies?
- Do we have the ability to monitor changes in the behavior of valid users in applications and restrict errant users by identity?
- Can the mean time to detect and respond by quarantining malicious behavior scale with new digital and AI adoption in business?
- Can the microsegmentation platform simulate and model cyber defense scenarios to progressively reduce breach exposure of operations?
While these would address most use cases, compliance will need individual statements of applicability for each regulation, which can explain what part of the regulation can be met by the ColorTokens platform directly, what needs process enveloping the technology, and what needs additional technology and processes.
Many organizations conduct penetration tests and incident-response exercises, yet these may not reveal how far an attacker could move after gaining access. How should companies test containment and survivability under realistic AI-accelerated attack conditions?
If organizations need to embrace the essence of Koun Ryusui in building breach readiness, they must integrate microsegmentation into existing cybersecurity operations and evolve it over time. To do that, microsegmentation needs signal integration with other tools in the Security Operations Center, like the SIEM, the EDR, the Next Gen Firewalls, etc. This would ensure that AI-powered microsegmentation can orchestrate containment when needed, based on indicators of attack and behavioral anomalies.
What you need then are not individual tests, but exercises that help evolve your breach readiness.
There are three things to exercise if your microsegmentation and survivability are realistic. First is the current state of Breach Readiness. This can be performed before you begin your ColorTokens deployment, after you have enforced your policies, and upon every change to determine whether your change has altered the design of your MAZE, which contains material-impact-based breach-ready zones, microsegments, and controlled conduits.
The second is the speed at which you can quarantine cyberattacks when an actual breach happens. The key parameters to test are detection accuracy and the speed of MVDE containment and isolation using AI. And that can be done through penetration tests, red-teaming exercises, and breach attack simulation assessments. These tests should be done without notification to the Security Operations Center to check their response to changing breach parameters.
The third is how your organization would react in an actual breach scenario. Before exercising, ensure your “be breach ready playbooks” are communicated to all relevant internal stakeholders, technical support third parties, and maintenance providers, especially asset owners and OT systems integrators. Then conduct simulated exercises before conducting a red-teaming assessment to provide a realistic experience.
As enterprises deploy more autonomous AI agents with access to applications, data, credentials, and infrastructure, how will breach readiness need to evolve to contain not only compromised human accounts and devices, but also compromised or misbehaving AI agents?
Breach readiness must evolve from containing compromised human accounts and devices to treating autonomous AI agents as a distinct, high-velocity class of non-human identity (NHI) that can act with legitimate credentials at machine speed. The challenge sounds significant on paper because NHI are expected to outnumber human identities at least 250 times by current estimates.
Agents break traditional controls focused on users, endpoints, and static service accounts. They hold live access to applications, data, credentials, and infrastructure; reason and chain actions continuously; and can be compromised via prompt injection, tool poisoning, memory manipulation, supply-chain issues, or simple misalignment/drift. And when they misbehave or are hijacked, the blast radius expands faster than human-paced response can match. Breach response cannot wait for full certainty or multi-team escalation, and hence hardening and automated pre-approved basic responses will be mandatory.
As more autonomous AI agents get deployed, breach readiness needs to use Identity as the primary control plane for agents, enhance Zero Trust to “Agent Trust”, govern guardrails, memory protection, and governance hygiene, graduate to pre-approved friction and automated containment, and integrate Microsegmentation and architectural isolation for containment, along with Runtime visibility, behavioral baselining, and sequence detection.
Breach readiness needs to shift from “can we recover after encryption?” to “can we contain an autonomous actor operating with valid credentials before it cascades?” Indicators of breach readiness should include time-to-understand (which agent, what actions, what data/systems were touched, and whether activity is ongoing) and time-to-friction for agents specifically. The ColorTokens platform can rapidly discover dependencies, generate and refine policy, and enforce containment, especially when augmented by AI for policy automation and becomes central to keeping pace. In this model, we prioritize isolation, containment, and least privilege over perfect prevention.
ColorTokens’ microsegmentation platform extends identity, continuous verification, microsegmentation, behavioral monitoring, and pre-authorized containment to the agentic layer, which will keep the blast radius manageable and preserve operational continuity. The defensive signature required is the same one demanded by machine-speed ransomware: extreme speed of understanding and friction, grounded in assume-breach architecture rather than hope that agents will always stay aligned.
Thank you for the great interview, readers who wish to learn more should visit ColorTokens.
Credit: Source link
