Bucher Municipal is a leading supplier of vehicles and equipment for cleaning and clearing operations on public and private roads and other traffic areas. It has customers in 140 countries, 180-plus Customer Service Centres spread across five continents and 2,500 employees. It worked with Zscaler to secure branch connectivity, eliminate the attack surface and prevent lateral threat movement. Ádám Kováts, CISO at Bucher Municipal, discusses the company’s cybersecurity priorities and how Zero Trust has helped improve its operations.
What difference have you noticed since using Zero Trust on a day-to-day basis?
We’re no longer sending traffic back through our hubs, so it’s much faster for users to reach their Internet destinations. That’s been one of the biggest benefits for our user base.
From a security perspective, it has also made a significant difference. We now have much greater visibility into what’s happening across our infrastructure. We can see far more of the assets and servers within the environment, giving us a much clearer and more comprehensive view of the entire infrastructure.
Is that why you chose Zscaler?
It was a combination of the platform itself and the partnership. We work very closely with Zscaler across a number of areas, including ZIA (Zscaler Internet Access), ZPA (Zscaler Private Access) and Zero Trust Branch. It really feels like a partnership, and that’s been a significant change compared with the solutions we’ve used in the past.
Can you specify which improvements have been made since using it?
We started with the ZIA component. It gives us much more granular control and a wider range of policy options. For example, instead of simply allowing a user group to access cloud storage, we can define exactly what they’re allowed to do, such as whether they can also download data, upload data or both. It’s a much more advanced level of control than we had with our previous solutions.
On the private access side, the integration with CrowdStrike has also delivered significant improvements. By combining it with device posture capabilities, we’ve been able to effectively hide our infrastructure. Our penetration testers have demonstrated that if they try to modify or disable CrowdStrike, they immediately lose visibility of our environment.
What are your priorities in terms of cybersecurity and going forward with it?
One of our priorities this year is upgrading our traditional branch connectors to the US version of Zero Trust Branch.
Another key priority is continuing to use Airgap. We’ve already implemented it in some locations and it’s currently being rolled out to others. The goal isn’t just to prevent lateral movement between locations, but also to stop movement within individual locations, providing an additional layer of protection.
We’re also focusing on user experience monitoring through a broader rollout of ZDX (Zscaler Digital Experience). We’re already using the platform, but our priority is to extend its deployment across more of the organisation.
How do AI agents fit into your cybersecurity strategy?
AI is a huge and difficult topic. The transformation from SD-WAN to Zero Trust has been happening for some time in different forms, but AI is advancing at a much faster pace.
From my perspective, the biggest challenge is governance. It’s about understanding how AI agents are being used and making sure you have the right controls in place over what they can access and what they’re allowed to do. We’re only at the beginning of this journey, and the number of AI agents will increase dramatically. As their capabilities continue to grow, managing them securely will become even more important.
We’ve already seen how quickly the technology evolves. If you compare the first versions of ChatGPT with the models available today, the difference is remarkable. Their capabilities have advanced at an incredible speed.
For me, it all comes back to the fundamentals of cybersecurity. You need visibility and you need to understand exactly what’s in your infrastructure, which is at the heart of a Zero Trust approach. Deploying ZPA has helped us significantly because if you want to avoid open access policies, you first need a clear understanding of your environment so you can define the right policies.
The same principle applies to AI. You need visibility into how AI is being used across the organisation, including any Shadow AI, so you can put the right governance and security controls in place.
How does Zero Trust help you ultimately?
In the past, security was built around the network perimeter. The focus was on network detection, firewalls and controlling access to the network itself. But over time, the number of endpoints and access points increased significantly, making that approach much harder to manage.
Zero Trust takes a different approach. It’s about reducing the attack surface by minimising the number of entry points into the organisation’s infrastructure. We’ve redesigned our network architecture so that user segments are separated from the underlying infrastructure. We still have our data centres and cloud environments, but the overall attack surface is much smaller, making it easier to protect.
You were one of the first customers who implemented zero trust. What prompted you to move so early?
One of the things I’ve really appreciated is seeing how the product has evolved. We deployed it early and moved quite quickly, so we were able to have ongoing discussions about what could be improved. Zscaler has always been very open to feedback and willing to work closely with us to develop the platform.
One of the biggest improvements has been the integration of AirGap. I can definitely see the benefits it brings. I also like the direction Zscaler has taken with the branch connectors, and the continuous improvements have made the solution work even better for us.
