Rob Maas is Field CTO at ON2IT and Product Owner of its AUXO™ platform — the platform built to operationalize Zero Trust. He joined ON2IT in 2015, spending his early years in Professional Security Services, where he built deep hands-on experience across networking, firewalls, Infrastructure as Code, and cloud.
Rob holds an extensive portfolio of Palo Alto Networks certifications, is a Certified Instructor, and was the first Palo Alto Networks Cyber Force Elite in the Netherlands. His Zero Trust credentials include the Forrester ZTX Strategist and CSA CCZT. He created the AUXO Terraform Provider and AUXO MCP Server, hosts Threat Talks Deep Dives, and writes regularly on the ON2IT blog.
Articles from Rob
Zero Trust Maturity: a security score you cannot argue with
How the Zero Trust fitness score is built: CMMI as the basis, binary criteria, no weighting, and why a score that can go down is the only one worth having.
Patching was never the solution, even as AI outpaces it
AI exploits vulnerabilities faster than you can patch, but no one was ever fully patched. Rob Maas on shifting from detect and respond to Prevent and Adapt.
Measuring security is hard. Measuring Zero Trust isn't.
Most security metrics report activity, not protection. Measuring Zero Trust takes two dimensions, readiness and fitness. How they work and why you need both.
AI did not break Zero Trust, it exposed who never did it
Four common claims say Zero Trust fails for AI agents. ON2IT Field CTO Rob Maas explains why each one points to missing basics, and what is genuinely new.
Patching cannot be your primary OT control
Attacker speed has outpaced the OT patch cycle. Segmentation is no longer compensating - it must become the primary control, with its own owner and budget.
Zero Trust MCP Server: AUXO for Claude & Copilot
ON2IT's open source Zero Trust MCP server (AUXO) turns Protect Surfaces, flows, measures, and cases into natural language operations in Claude and Copilot.
You don't need additional AI security tooling | ON2IT Blog
AI vendors are pitching a new generation of security tools. Most organizations don't need them. They need to execute Zero Trust on the stack they already own.
Zero Trust for AI Agents
AI agents expand the attack surface. Learn how Zero Trust for AI agents strengthens agentic AI security and protects non-human identities in modern enterprises.
OT needs Zero Trust 2.0
IT and OT are no longer separate worlds. Learn why the Purdue Model falls short for converged networks and how Zero Trust 2.0 secures OT environments.
The Forgotten Protect Surface: Securing SaaS in Zero Trust
SaaS runs your business but is often your security blind spot. Learn how to treat SaaS as a Protect Surface in a Zero Trust world and control your data.
Zero Trust isn't "hard" - it's unfocused.
Zero Trust is not hard, it is unfocused. Learn how a 3-week Zero Trust sprint helps you secure one Protect Surface at a time with tools you already own.
Purdue vs Zero Trust in OT security
Is the Purdue Model still enough for OT security? Compare it with Zero Trust and learn how Protect Surfaces help you segment critical industrial assets.
Zero Trust: A New Year’s resolution worth keeping
Make Zero Trust your New Year's resolution. Learn why the best time to strengthen your security posture is before an incident and how to make progress.
The crucial role of business alignment in cybersecurity
Why does business alignment make or break Zero Trust? Rob Maas covers 'Not Invented Here' syndrome, budget and time limits, and where you can begin.
VPN-Firewall Integration: A Strategic Analysis
Should VPN and firewall run on the same device? Weigh the benefits of consolidation against the risks raised by recent critical vulnerabilities.
Navigating Zero Trust - Part 1
Zero Trust only works when business and IT team up from the start. In part 1 of his series, Rob Maas covers the role of business, architects and IT ops.
Log4j Lessons: What Is Vulnerability Management Anyway?
Written in 2022 after Log4j: what is vulnerability management, can a perfect tool exist, and how should your organization handle unknown threats?
The Log4j lessons: If it ain’t broke, fix it now!
The lessons you can learn from Log4j and how to protect yourself better against these vulnerabilities in the future.
The broken DMZ model
The traditional DMZ model isolates by network zone, not by what's worth protecting. Here's why a compromised web server ends up one hop from your data.
Network segmentation is not Zero Trust
Is network segmentation the same as Zero Trust? No. Learn why segmentation is one enforcement tool, while Zero Trust starts with protecting your data.
Context is key: the data challenge of cybersecurity
One of the biggest challenges within cybersecurity is how to handle the sheer amount of data. Everyone in the field is familiar with the stories of failed SIEM