Welcome to Nsoh Research. This guide provides an orientation to the research themes, frameworks, and perspectives that define this body of work. Whether you are a security practitioner seeking implementable guidance, a researcher exploring adjacent domains, or a student building foundational knowledge, this article will help you navigate the content and extract maximum value.
The Central Thesis
One conviction unifies all the work presented here: identity is the control plane of modern security.
As computing has become distributed, autonomous, and deeply integrated with physical processes, traditional security models have collapsed. Perimeter-based security assumed that threats came from outside and that entities inside the network could be trusted. This assumption was always fragile; in the age of cloud computing, remote work, and AI agents, it is untenable.
Identity-first security inverts the traditional model. Instead of asking "is this entity inside the perimeter?", identity-first security asks "who or what is this entity, and should it be trusted to perform this action at this moment?" This question must be answered continuously, not once at authentication time.
This thesis has implications across every security domain:
Network security becomes identity-aware microsegmentation rather than perimeter firewalls.
Endpoint security becomes device identity and posture verification rather than antivirus signatures.
Application security becomes fine-grained authorization rather than coarse access controls.
Cloud security becomes workload identity and least-privilege IAM rather than network isolation.
AI security becomes agent identity governance rather than model alignment alone.
The Research Pillars
The research presented here organizes around five interconnected pillars:
Pillar 1: IAM as the Security Foundation
Identity and Access Management (IAM) is not a supporting function—it is the foundation upon which all other security controls depend. This pillar explores IAM architecture, governance, and operations with a focus on making IAM a strategic security capability rather than administrative overhead.
Key themes include:
- The five layers of IAM architecture
- Identity governance and administration (IGA)
- Privileged access management (PAM)
- Identity analytics and risk scoring
- IAM for regulated industries
Pillar 2: Zero Trust Architecture
Zero Trust is not a product or a technology—it is an architectural philosophy that eliminates implicit trust and requires continuous verification. This pillar explores Zero Trust principles, implementation patterns, and common pitfalls.
Key themes include:
- The "verified trust" framing vs. "never trust"
- Continuous authentication and authorization
- Policy engines and policy-as-code
- Zero Trust for legacy environments
- Zero Trust maturity models
Pillar 3: AI Agent Security
The emergence of autonomous AI agents creates unprecedented identity challenges. Agents that can invoke tools, spawn sub-agents, and make decisions without human intervention require new governance frameworks. This pillar explores identity-centric approaches to AI security.
Key themes include:
- The ICACC Framework for AI agent governance
- Agent identity binding and delegation chains
- Capability scoping and least privilege for agents
- Audit trails for autonomous systems
- Compliance mapping for AI governance
Pillar 4: Critical Infrastructure Resilience
Critical infrastructure—energy, water, transportation, healthcare—operates under constraints that make traditional security approaches impractical. This pillar explores security for operational technology (OT) and cyber-physical systems (CPS).
Key themes include:
- Machine identity in OT environments
- IT/OT convergence security
- Safety-security tradeoffs
- Regulatory compliance (NERC CIP, IEC 62443)
- Resilience engineering for critical systems
Pillar 5: A-DSRM Methodology
The Agile Design Science Research Methodology (A-DSRM) provides a framework for developing security artifacts that are both academically rigorous and practically deployable. This pillar explores the methodology and its application to security research.
Key themes include:
- Design science research in security
- Artifact development and evaluation
- Iteration and refinement cycles
- Bridging research and practice
- Reproducibility and validation
How to Navigate This Content
The content is organized to support multiple reading paths:
For Practitioners
Start with the foundational articles on IAM and Zero Trust. These provide frameworks and patterns that can be applied immediately in enterprise environments. Then explore the pillar most relevant to your current challenges—AI security if you are deploying agents, critical infrastructure if you work in OT environments.
Recommended starting points:
- "Why IAM Is the Most Underrated Security Discipline"
- "The Zero Trust Myth: Why Never Trust Is Actually About Verified Trust"
- "Zero Trust Without IAM Is Just Network Segmentation"
For Researchers
Start with the A-DSRM methodology articles to understand the research approach. Then explore the theoretical foundations in each pillar. The artifacts section provides detailed specifications that can serve as baselines for comparative research.
Recommended starting points:
- "A-DSRM: Agile Design Science Research for Security"
- "The ICACC Framework for AI Agent Governance"
- Artifact specifications in the Artifacts gallery
For Students
Start with the "Start Here" content (you are here) and the foundational articles in each pillar. Build understanding progressively from IAM fundamentals through Zero Trust to advanced topics in AI security and critical infrastructure.
Recommended learning path:
- IAM fundamentals and the five-layer architecture
- Zero Trust principles and the verification architecture
- Machine identity and workload identity concepts
- AI agent security and the ICACC Framework
- Critical infrastructure constraints and solutions
The Practitioner-Researcher Bridge
A distinctive feature of this work is its dual orientation toward both academic rigor and practical deployment. Every framework presented here has been developed through the A-DSRM methodology, which requires:
Problem relevance: Research addresses real problems faced by practitioners.
Design rigor: Solutions are developed systematically with clear design rationale.
Evaluation validity: Artifacts are evaluated against defined criteria in realistic contexts.
Research contribution: Work advances knowledge beyond the specific artifact.
Communication clarity: Results are presented in forms accessible to both researchers and practitioners.
This dual orientation means that practitioners can implement the frameworks with confidence that they rest on solid theoretical foundations, while researchers can build on the work with confidence that it addresses real-world requirements.
Engaging with the Research
This is not a static body of work. Research continues, frameworks evolve, and new challenges emerge. Several channels exist for engagement:
The Insider Channel: Subscribe to receive early access to new research, draft frameworks for feedback, and exclusive content not published publicly.
Advisory Services: For organizations seeking to implement these frameworks, advisory services provide direct engagement with the research.
Academic Collaboration: Researchers interested in collaboration, joint publications, or doctoral supervision should reach out through the contact page.
Speaking and Workshops: Conference presentations and workshops provide opportunities for in-person engagement with the material.
Conclusion
Identity-first security is not a trend—it is the inevitable response to the collapse of perimeter-based security models. As AI agents proliferate, as IT and OT converge, and as Zero Trust becomes the expected architecture, identity will only become more central to security strategy.
The research presented here provides frameworks, patterns, and guidance for navigating this transition. Whether you are securing an enterprise, protecting critical infrastructure, or governing AI agents, the principles remain consistent: know your identities, verify continuously, enforce least privilege, and maintain audit trails.
Welcome to the journey.
Jovita T. Nsoh, Ph.D. is an Assistant Professor of Cybersecurity at the University of Houston and a recognized authority in identity and access management, Zero Trust architecture, and AI security governance.
#Cybersecurity #IAM #ZeroTrust #AIGovernance #CriticalInfrastructure #SecurityResearch