--- title: "Zero Trust DNS Session 01: Defeat AI threats and 0 Days" description: "How to defeat AI threats and Zero Days applying Zero Trust DNS at the connection layer. Detection evasion is mitigated and patient zero is protected." url: https://adamnet.works/blog/defeating-ai-swarms-and-zero-days-at-the-connection-a-3-part-series-on-zero-trust-dns/ index: https://adamnet.works/llms.txt --- [All Articles](https://adamnet.works/blog/articles.md) Articles · ZT DNS · ZTc # Defeating AI Swarms and Zero Days at the Connection: A 3-part series on Zero Trust DNS ADAMnetworks and Microsoft's ZTDNS product manager launch a 3-part series on Zero Trust DNS, DTTS and making default deny-all practical against AI attacks. Francois Driessen | ADAMnetworks • November 2, 2026 ![ZT DNS Session 01](https://adamnet.works/uploads/zt-dns-sessions01-1.webp) ## Defeating AI Swarms and Zero Days at the Connection: A new Three-Part Series on Zero Trust DNS **How do I protect against AI threats?** Stop trying to win a speed race against detection - AI enhanced malware specialize in detection evasion by using never before seen malware, living off the land (LotL) and disposable attack infrastructure. A preemptive security posture is essential for winning the cyber war against adversarial AI. **We explore a fundamental solution: Change how devices connect: make every connection prove itself with a policy-approved DNS resolution, and refuse everything else by default.** Zero Trust DNS on Windows 11 plus Don’t Talk To Strangers (DTTS) everywhere else means a brand-new, never-before-seen attack can’t reach out, so you don’t have to be patient zero. AI is making new attacks cheap to build and easy to evade detection. Every one of them is a zero day to someone, and the first organization it lands on is patient zero. Detection-first security only catches up after that first victim. We believe the industry needs a better answer, and we think it starts with something basic: how we connect to the internet in the first place. That’s why we’re launching the [**ZT DNS Sessions**](https://adamnet.works/videos/zt-dns-sessions-01-concepts-principles.md), a three-part video series with David Redekop (CEO & founder ADAMnetworks), Francois Driessen (COO & CMO of ADAMnetworks) and Aditi Patange (Product manager for Microsoft Zero Trust ZT DNS) - who builds next-generation networking for Windows. Session 1, _Defeating AI swarms and Zero Days with ZTDNS: Concepts & Principles_, is out now. ### Why AI and zero days change the game Gartner’s recent article on preemptive cybersecurity says generative AI “has accelerated the volume, speed and sophistication of cyberattacks, creating a challenge that traditional detect-and-respond approaches were not designed to handle.” Gartner analyst Isy Bangurah sums it up: “AI shifts strategic advantage to attackers, and only preemptive cyber defense can shift it back.” Gartner positions preemptive cybersecurity as helping organizations “anticipate, deny, disrupt and deceive threats before they cause harm,” and it presents that as an addition to reactive security, not a replacement. Our research team sees the same pattern in the wild. Kits are rewritten quickly to get around defences. One ClickFix kit was [rewritten to get past a rival kit’s page cleaner](https://adamnet.works/blog/a-clickfix-loader-rewritten-to-get-past-a-rival-s-page-cleaner.md). [KeyStealth](https://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec.md) used device code phishing to register rogue Entra ID devices within seconds of getting a token. Compromised IoT can turn into [attack infrastructure](https://adamnet.works/blog/when-iot-becomes-attack-infrastructure-mirai-rondodox-zero-trust-networking.md) on devices that can’t run an agent. As Francois Driessen put it in [_Faster Than Real-Time_](https://adamnet.works/blog/faster-than-real-time.md), attackers are putting AI into malware creation & detection evasion, so defenders have to use it BEFORE the attack can execute: “it’s not about using AI, it’s about using AI correctly.” ### The Fundamentals Matter Putting it mildly, the internet has turned into the world’s Universal Threat Ecosystem. If you are connected to the internet you are potentially connected to an attacker. The internet was never designed to be secure- it was designed to work. Thus, at the very foundation of internet connectivity there is no practical security element to help protect against adversaries.  Aditi’s words ring true: “Fundamental problems cannot be solved with topical solutions.” In Session 1 we answer the question: “why was that connection allowed in the first place?” ### What Session 1 covers: concepts and principles Session 1 brings together ADAMnetworks founder and CEO David and co-founder Francois with Aditi from Microsoft. The conversation starts from first principles: - **IP was built to work, not to be secure.** As David explains, the ARPANET-era design was meant to route around any obstacle. To this day, unless you’re in a zero trust or Don’t Talk To Strangers environment, direct IP-to-IP communication without DNS is still possible, “and that is what the bad guys can easily weaponize.” - **DNS is already where intent shows up.** The vast majority of connections are DNS-based. David estimates direct-IP connections at “less than 1% of connections.” That makes DNS a practical root of trust and a control plane. - **Advanced malware skips DNS on purpose.** Using direct-IP command and control means leaving fewer breadcrumbs for threat intelligence. If a connection without a policy-approved resolution can’t happen at all, that technique stops working. - **Detection evasion stops being a problem.** When everything is denied by default, a brand-new domain or IP is simply not allowed. In Francois’s words, you can “neutralize it without detecting it.” Aditi describes the Microsoft approach as a shift “from detect and respond to prevent by default.” On a Windows device with ZTDNS enabled, outbound connections are blocked by default. A connection is allowed only after a successful resolution from the trusted DNS server configured for ZTDNS. IT admins have a controlled way to allow the few legitimate direct-IP exceptions, and malware without admin rights can’t do that. ### A new security layer for IP: ZTDNS and DTTS  Microsoft ZTDNS and ADAMnetworks’ **Don’t Talk To Strangers (DTTS)** apply the same principle of ZT DNS enforcement at different layers, and they can operate together. - **Windows 11 enterprise & eduction endpoints: Microsoft ZT DNS.** Enforcement runs on the device itself. - **Everything else: adam:ONE® with DTTS.** DTTS enforces the same rule out of band at the nearest layer 2/3 gateway. It identifies each device down to the MAC address, applies the right policy, and opens a time-bound path only to destinations that were resolved through policy. When the time to live expires, the path closes and the destination is a stranger again. No endpoint agent is needed, so the same protection covers medical and industrial IoT, OT, printers, cameras, right down to the “the fish tank thermometer” that has compromised firmware acting as pivot for the main attack.  - **adam:ONE® as the ZTDNS resolver.** adam:ONE® can act as the protective DNS (PDNS) server for ZT DNS endpoints, while DTTS covers the non-Windows devices. With DNSharmony®, organizations can combine several protective DNS feeds instead of picking just one. In the video, David names Infoblox and Quad9 as examples, and Francois mentions agencies required to use CISA’s protective resolver adding other feeds on top. The result for the security team is one policy plane for every device: one resolver, aggregated PDNS intelligence, and AI-assisted policy controls that build and maintain dynamic allowlists, so the allowlist doesn’t have to be hand-built line by line. ### Default deny-all is now practical David is candid about the history. Many veterans still remember managing egress with default-deny access control lists, and they gave it up because it became unmanageable. The difference now is the technology: identity at the connection, DNS as the root of trust, time-bound permissions, and automation that keeps allowlists current. With a smart rollout, legitimate direct-IP needs and mission-critical services are provisioned first, so end users “don’t even experience a hiccup.” We’ve seen this work under pressure. In a [ransomware incident response for a global manufacturer](https://adamnet.works/case-studies/manufacturing-ransomware-incident-response.md), the attackers remained undetected for more than six months and ransomware encrypted nine of ten domain controllers. The incident response team replaced the gateways at all five factories with adam:ONE® in Zero Trust Connectivity configuration, quarantined every device by default, and used DTTS to cut every connection that didn’t start with a policy-allowed DNS resolution. Mission-critical operations were back by Monday morning, and the ransom was never paid. Over the following three and a half years, more than 5,000 re-infection attempts were tracked, and every one was neutralized. ### What’s next in the series | Session 01: Concepts & Principles | Why IP needs a security layer, why DNS is the right root of trust, and how ZTDNS and DTTS make deny-by-default enforceable.  | | - | - | | **Session 02: Technology & Implementation ** | **The technical side of deploying ZTDNS and DTTS together, including resolver configuration, policy, and rolling out without breaking things. ** | | **Session 03: Attack Chains broken** | **We map real attacks against ZT DNS and ZTc-protected networks to show where each attack chain breaks. ** | ### Questions covered in Session 01 **What is Zero Trust DNS (ZTDNS)?** It’s Microsoft’s Windows capability that blocks outbound connections by default and allows a connection only after a successful resolution from a trusted DNS server configured for ZTDNS. **What is Don’t Talk To Strangers (DTTS)?** It’s ADAMnetworks’ enforcement in adam:ONE®. It applies the same deny-by-default rule at the network gateway, so any device can be protected without an endpoint agent, and permissions expire with the DNS time to live. **Can  ZTDNS and adam:ONE® be integrated?** Yes, they can work in tandem. ZTDNS protects Windows 11 Enterprise endpoints, DTTS protects everything else including devices that can’t get an endpoint agent. Adam:ONE® can serve as the protective DNS resolver for both and DNSharmony® allows PDNS aggregation from multiple protective resolvers.  **Is this a replacement for detection tools?** No. It’s a preemptive cybersecurity layer that keeps unknown connections from happening at all, so threats that evade detection can’t reach out. It adds to your existing controls. ### Watch Session 01 now The way to avoid being patient zero is to stop unknown connections before they happen, one connection at a time. [Watch Session 1 on YouTube](https://youtu.be/V3yy3rhB99U) and subscribe to the [ADAMnetworks channel](https://www.youtube.com/@adamnetwrx) so you don’t miss Sessions 2 and 3. --- #### Sources & More Information - Session 1 video: (“Defeating AI swarms and Zero Days with ZTDNS Session 01: Concepts & Principles”, ADAMnetworks) - Gartner, “When Reactive Security Falls Behind AI-Driven Threats” (Oct 6, 2026): - Microsoft ZT DNS elevating enterprise security on Windows: - Microsoft ZT DNS: - ADAMnetworks, Faster Than Real-Time: [https://adamnet.works/blog/faster-than-real-time/](https://adamnet.works/blog/faster-than-real-time.md) - ADAMnetworks, A ClickFix loader rewritten to get past a rival’s page cleaner: [https://adamnet.works/blog/a-clickfix-loader-rewritten-to-get-past-a-rival-s-page-cleaner/](https://adamnet.works/blog/a-clickfix-loader-rewritten-to-get-past-a-rival-s-page-cleaner.md) - ADAMnetworks, KeyStealth: [https://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec/](https://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec.md) - ADAMnetworks, When IoT Becomes Attack Infrastructure: [https://adamnet.works/blog/when-iot-becomes-attack-infrastructure-mirai-rondodox-zero-trust-networking/](https://adamnet.works/blog/when-iot-becomes-attack-infrastructure-mirai-rondodox-zero-trust-networking.md) - ADAMnetworks case study: [https://adamnet.works/case-studies/manufacturing-ransomware-incident-response/](https://adamnet.works/case-studies/manufacturing-ransomware-incident-response.md) About the author ## Francois Driessen | ADAMnetworks COO and CMO Francois Driessen is COO and CMO of ADAMnetworks and its "Human Ambassador", speaking for the company on Zero Trust Connectivity and Preemptive Defense. ## Related reading Video ### [ZT DNS Sessions 01: Concepts & Principles](https://adamnet.works/videos/zt-dns-sessions-01-concepts-principles.md) October 30, 2026 Security Research ### [KeyStealth: Device code phishing to rogue Entra devices and BEC](https://adamnet.works/blog/keystealth-device-code-phishing-to-rogue-entra-devices-and-bec.md) October 22, 2026 Articles ### [Faster Than Real-Time? Why Your Security Fails and What to Do Next](https://adamnet.works/blog/faster-than-real-time.md) November 10, 2025 ## See it on your own network Zero Trust Connectivity reduces attack surface 7000:1 by denying egress by default. Talk to us about what that looks like in your environment. [Request a Demo](https://adamnet.works/contact.md) [How adam:ONE® Works](https://adamnet.works/how-it-works.md)