Articles by

Tom McNamara

From Glass Cases to Ephemeral Access

The recent Louvre Crown Jewels heist is a perfect metaphor for enterprise cybersecurity failures. Cameras, alarms, and guards didn’t stop the theft — predictable routines, unchecked access, and unverified trust did. Enterprises face the same problem: long-lived credentials, over-permissioned APIs, and siloed monitoring create blind spots that attackers exploit to steal data, IP, and secrets. Static defenses aren’t enough. Just like museum staff relied on routines and assumed trust, cybersecurity teams often assume certificates, firewalls, and segmentation are sufficient. But attackers don’t follow the rules — and neither should defenses. Hopr.co solves this with ephemeral trust. Workloads continuously verify identity via WoSP, identities rotate automatically with MAID™, communications stay secure with SEE™, and secrets hop dynamically with Cloud Native AMTD.

November 14, 2025

The Complexity Tax for Platform Engineers and DevOps

Platform Engineers and DevOps teams are struggling with the 'service mesh' model because of massive overhead, extreme complexity, and a steep learning curve. The articles proposes a lightweight, simpler, and more integrated decentralized solution to the problem that is currently their biggest headache. They don't need the complexity of a full-blown service mesh to secure east-west traffic. The Hopr WoSP delivers the same workload-to-workload authorization without the YAML hell, and without the massive operational overhead.

November 14, 2025

Beyond the Locked Front Door - ZTNA

Industry data shows that the vast majority of breaches occur on "trusted" and "allowed" connections. Is your ZTNA solution just a locked front door, leaving all the internal doors wide open for attackers to roam freely? The "allow and ignore" model of ZTNA 1.0 is a recipe for disaster. It's time to move beyond session-based trust. Learn about "Zero Trust by the Transaction"—a new paradigm that continuously verifies trust for every single API call and workload interaction, stopping lateral movement and insider threats cold.

November 14, 2025

Runtime Microsharding Shrinks the Enterprise Attack Surface

Enterprises a challenged to defend their ever-growing attack surface. Complexity, Zero Days, and static network configurations make a target rich environment for increasingly sophisticated threats. Conventional defenses seem to have reached a ceiling of effectiveness. But a new Cloud Native AMTD is an active cyber defense that microshards the attack surface in to many small pieces and animates them so that attackers are confused in targeting application workloads.

July 16, 2025

What Does Hopr Replace In An Enterprise Security Architecture?

Innovative solutions can often challenge conventional thinking. Conventional cyber defenses such as API Security, Firewalls, Gateways, and others exist to filter out "bad stuff" before it reaches the digital engine of your business - your application workloads and data. This article helps CISOs understand the value of the WoSP through the analogy of an automobile engine with three conventional filters.

June 5, 2025

AI and the Crisis of Machine Credentials (and How to Avoid It)

Machines [also known as Non-Human Identities (NHI)] that operate within and across enterprises is exploding. Led by the emergence of Artificial Intelligence (AI) agents, these machines represent a significant risk to enterprises. The combination of static secrets, ungoverned NHIs, and autonomous AI agents is creating a perfect storm of complexity, risk, and visibility gaps. Organizations that wait for a breach before acting will find themselves overwhelmed. But those who act now — embracing ephemeral credentials, zero-trust principles, and machine-native identity security — will emerge stronger, more resilient, and future-ready.

June 5, 2025

Proxies in the Cloud: Managing Traffic and Securing A Digital World

Proxies are common software designs that are widely used to abstract repetitive code and simplify a software architecture or code development. While they come in different types and are used for different purposes, the use of proxies for communications management is common, but many people may not know that security functions can also be proxied. In this article, I explain a novel and powerful new proxy – a Workload Security Proxy – that decentralizes access credential management to dramatically improve security and shrink the attack surface of digital enterprises.

June 5, 2025

AMTD and Zero Trust in a Single Solution: The WoSP

Enterprise CISOs are challenged to find cost savings without compromising security. As cyber threat sophistication increases and overcomes conventional defenses, Zero Trust becomes an important cosideration for security architectures and compliance. A new option has arrived that combines AMTD with Zero Trust principles to deliver stronger security and cost savings for CISOs.

June 5, 2025

Redefining Multi-Cloud Application Networking with a Workload Security Proxy

Most enterprises operate with applications in different cloud environments and may even be part of a digital ecosystem that shares application data with third party organizations. But conventional credential management make this a complicated and vulnerable task. Hopr.co's Workload Security Proxy is a solution that simplifies and secures multi-cloud application networks.

June 5, 2025

Reversing A Rising Tide - API Data Losses

The last three years have shown a clear trend toward larger, more frequent, and more sophisticated M2M API-based attacks, particularly in cloud and multi-cloud environments. Compromised API keys have played a critical role in these attacks, enabling attackers to target data in transit and escalate privileges across complex infrastructures. Despite the increasing number of API security solutions, protecting machine-to-machine APIs and data remains a significant challenge, especially as threats grow larger, more frequent, and more sophisticated. A compelling alternative to conventional API security solutions exists and it is a dynamic, decentralized approach to API Threat Protection and workload Access Control.

June 5, 2025

Why TLS 1.3 and Automated PKI Fall Short of Zero Trust Principles

Enterprises running sensitive business operations in the cloud confront difficult security and privacy challenges. One of them is data loss prevention. While it's true that cloud providers do offer experienced security professionals and tools, it is not true that cybersecurity will be stronger. This article explains some of the reasons why CISOs and security professionals need to take a close look at their application networks and cloud infrastructure. The good news is that innovative solutions to overcome the vulnerabilities and gaps exist and are easy to adopt and implement.

June 5, 2025

Machine Identity - Avoid the Crisis

Machines operating across the Internet outnumber humans by a ratio of three-to-one. This will rise dramatically as more Internet of Things (IOT) devices arrive. Existing approaches for managing identity and trust for a massive number of machines rely on centralized and legacy solutions that won't work for the machine era. A decentralized solution capable of speed, trust, and agility is needed to avoid a crisis and enable a graceful transition to high trust machine identities.

June 5, 2025

A Looming Crisis

As the Internet and cloud explode with new IoT devices, automation, and wireless connectivity, we face a looming financial crises from accelerating cybercrime. APIs, by definition, are machine-to-machine transactions, and those that are public-facing are particularly at risk of attack. A new cyber defense for these API endpoints has arrived.

June 5, 2025

IAM in a Box

Containers are an important part of modern cloud engineering. They evoke the idea of portability and relocation. But in the cloud this is often inhibited because they become anchored to external services within a particular cloud environment, and it becomes difficult to relocate them to a different environment. This article describes how containers can be freed and portability restored.

June 5, 2025

A Short History of Moving Target Defense

Automated Moving Target Defense (AMTD) is emerging in the cybersecurity market as a new form of moving target defense (MTD). Not many people know that MTD is not new. It has been used effectively in communications security and information security for over 50 years before it appeared as a cybersecurity strategy. Today’s AMTD is a generational improvement over MTD, even the MTD from just a few years ago. The latest forms of AMTD are built for the cloud and are far more sophisticated than their predecessors. One new form even combines AMTD with Zero Trust to produce a strategic combination that amplifies the cybersecurity benefits at a relatively low cost.

June 5, 2025

Why Is the Trend of API Attacks Still Increasing?

APIs have become essential to delivering business services from the cloud. But they have also become a big vulnerability point for business risk. They can leak a lot of data and are lucrative attack points for threat actors. Many API security solutions are operating, but the attack statistics are still rising. I think I know why, and AMTD is how to fix it.

June 5, 2025

An Unintentional Secret - Automated TLS and its Zero Trust Fallacy

Transport Layer Security (TLS) and its companion, mutual TLS (mTLS) are stalwart security protocols known for encrypting communications over the Internet. When they are applied to root domains (such as is the case for Web domains and browsers) they represent identity trust. However when they are implemented with automated PKI certificates, they lose an important security quality: identity trust. Due to the speed and scale of cloud automation, the intermediate certificate authorities that issue PKI certificates eliminate vetting of the receiving identity (a containerized workload).

June 5, 2025

Small, Fast-moving Targets

Containerized workloads are the basic building blocks of modern day applications and services. And Application Programming Interfaces (APIs) are the code that stitches the workloads together to build a scalable application or business process. They are attractive targets for sophisticated adversaries that have time and skill to bypass traditional perimeter defenses and gain access to enterprise resources such as workloads, then they can easily move laterally and attack APIs. A moving-target defense (MTD) is a great strategy for protecting sensitive workloads and data. This article describes three components of an MTD for containerized workloads and data.

June 5, 2025

A Moving Target Defense for the Cloud

Moving business services to the cloud offers enterprises significant benefits, but it include some big risks and challenges for security and data privacy, too. The marketplace offers many solutions for protecting business systems and data, but many of them were built before the cloud when the systems and data were on-premises. Data on cyber attacks to the software supply chain and APIs indicates that traditional solutions aren't performing too well in the Cloud. A "lift-and-shift" approach to digital transformation won't work and may be very costly. Operating in the cloud requires new thinking about security and a moving target defense is a great "cloud-native" security strategy to consider.

June 5, 2025

Four Dilemmas of Keeping Secrets

Secrets are essential to security in cloud operations. Digital Transformation, new cloud and software architectures, and new technologies such as docker and kubernetes are producing an explosion of secrets and APIs. The secrets and APIs are a popular vulnerability path for data theft. The conventional options to manage secrets for humans and monolithic apps in a data center cannot meet the scale, reach, speed, and protection needed in the cloud. In fact, they create four dilemmas for enterprise security and risk professionals: Secrets Chaining, Secrets Leakage, Machine Secrets, and Secrets Injection. In addition to describing the how and why behind each of these secrets dilemmas, the article also presents three principles to solve all four dilemmas with a single innovative approach.

June 5, 2025

Vanishing Secrets

Not all secrets need persistence and storage. There are times when encryption secrets can be ephemeral. It's been estimated that 80% of Internet traffic is due to APIs, and nearly every API requires a secret to prove identity and establish trust of the machine making a request. These secrets should be vaulted if they're static. But this requires yet another API and more secrets. We think ephemeral secrets are a better choice for APIs and we invented a novel approach to create secrets that vanish and don't need to be stored.

June 5, 2025

Machine Identity - Who’s Who in the Cloud?

Identities for machines operating in the cloud, like humans in the natural world, are an important quality that is essential to trust, authorization, and authentication. Machines are identified by cryptographic material that takes the form of a certificate. But in the cloud, it is challenging to find, track, and manage the many certificates that are dynamically assigned and used. New approaches to managing machine identities in a zero trust cloud environment are needed to realize secure business operations in the cloud.

June 5, 2025

Keeping Secrets Is Hard

Keeping secrets is hard because they have to stay secret to deliver security. And for machines and workloads in the cloud the consequences to lost secrecy can ripple through the entire business and bring down many digital operations in an instant. Leakage of digital secrets occurs almost naturally over time; disclosure eventually happens and secrecy is lost. But the risk of lost secrecy and the impact to cloud operations is minimized with the right tools.

June 5, 2025

Subscribe to our newsletter

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Hopr.co offers a true Zero Trust Network Access (ZTNA) solution for cloud machines in multi-cloud architectures. Hopr's technologies protect high-value applications, APIs, and data in all clusters, clouds, and organizations.

Hopr’s Workload Security Proxy (WoSP)—a lightweight, drop-in proxy—enforces Zero Trust at every transaction, and rejects all untrusted attempts to access a trusted workload.

In addition to network proxy function, WoSPs also proxy credential management and hop workload access credentials at a high frequency to create an Automated Moving Target Defense (AMTD) arround communicating workloads.

The Cloud Native AMTD shrinks and animates the attack surface to proactively disrupt threats before an attack occurs.