Zero trust access and identity: how Gathid's CISO Craig Davies frames it

What the podcast page says

The main source on this question is a short podcast page on Gathid's website. Gathid published it on September 24, 2026, titled "Transforming Zero-Trust Access with Craig Davies," credited to the company and labelled a one-minute read.

The page has one summary sentence. It says Davies, the company's CISO, explains how artificial intelligence will be applied to make it easier to use identity to ensure zero-trust access to applications and IT infrastructure.

That sentence contains three claims. First, the summary treats identity as the means of enforcing zero-trust access, and names applications and IT infrastructure as the things being protected. Second, the summary presents AI as the way to reduce the effort involved, and states this in the future tense. Third, the summary describes a direction of work. It does not describe a finished capability or a measured result.

The page then sends readers to the audio recording. The recording and anything Davies says in it are not part of the material this explainer draws on. The summary sentence is the only statement of his framing available here.

Who Davies is, according to Gathid

Gathid's About Us page lists Davies as Chief Information Security Officer on a team that includes the chief executive, chairman and chief financial officer.

The company says it was formed in 2023. It says that before then, its people spent two decades on physical identity and access work for large organizations.

Davies is also named in a second title in the company's blog index, which concerns mergers and acquisitions.

His position matters when reading his comments. He is the security lead at a company whose business is identity governance. His view of zero trust is presented through the company's own channels and alongside the company's own description of the problem.

The governance problem the company describes

The podcast summary links zero-trust access to identity. To see what "identity" means in this context, look at how Gathid describes the underlying problem.

The About Us page states the core issue directly. The company says it saw this first hand in the field and calls the result identity debt.

The site's banner describes the same issue in terms of authority rather than permissions. A second line in the banner puts it another way.

The blog index follows the same theme. One title is about checking what was approved against what actually exists. Another announces a product aimed at the gap between policy and real-world authority.

The site's list of use cases names the governance tasks the company works on.

Where zero trust fits in this material

Taken together, the documents place zero-trust access inside a broader question of identity governance. Under the podcast summary, identity is the means of enforcing zero-trust access. Under the company's own problem statement, many organizations cannot say who has access to what. Under the banner and blog titles, the gap is between assigned access and accumulated authority.

Read side by side, these points connect. If identity is how zero-trust access is enforced, then the quality of identity data determines how well that enforcement holds. The material describes this problem in several forms:

• access that builds up over time
• roles that drift away from what was approved
• combinations of entitlements that conflict with segregation of duties

Each of these weakens the identity data that zero-trust access decisions depend on.

The index also places identity work early in a security leader's tenure. One title addresses identity and access in the first months of a new CISO or CIO. Another treats access granted to outside parties as a separate concern.

The role of AI is the least developed part of the material. The podcast summary says AI will make identity-based zero-trust access easier. It does not say how, against which systems, or under what controls. Those details would sit in the audio, if anywhere.

Questions the material raises for a security leader

Gathid compresses its framing into one line on the About Us page.

The documents raise a set of questions that follow from that line and from the podcast summary:

• Who holds access to which applications and which parts of IT infrastructure?
• Should each of those people hold that access at all?
• Does the access recorded in approved roles match the access that actually exists on accounts?
• How much authority has built up beyond what was originally assigned?
• Where do entitlement combinations conflict with segregation of duties?
• How is access granted to third parties reviewed?

These questions reflect how the company and its CISO describe the problem. The podcast summary adds one more element: AI is expected to make it easier to answer them and to act on the answers for zero-trust access.

What the sources cover and what they leave out

Each source covers a different part of the picture:

• Podcast page (dated September 24, 2026): gives the title of Davies's discussion and a one-sentence summary of its subject.
• About Us page: confirms his role and gives the company's origin and problem statement.
• Blog index: shows the topics the company publishes on, including the two titles that name Davies.

None of the three documents quotes Davies directly on zero trust. None defines zero trust, describes a specific architecture, sets out steps, or reports outcomes. What the material does establish is how the company frames the question:

• zero-trust access depends on identity
• identity governance depends on knowing who can do what and whether they should
• AI is presented as the tool expected to ease that work

For anything more specific about Davies's practical approach, the recording linked from the September 24, 2026 page is the source the company points to.