Quick Take
- Narration: Daniel Thomas May handles the material competently at the technical level, but one reviewer found the character voices in the narrative sections flat, the fictionalized framing exposes more performance demands than pure nonfiction narration.
- Themes: Zero Trust security, AI in cybersecurity, MLOps and adversarial AI
- Mood: Urgent and practical, with the texture of a professional case-study seminar
- Verdict: Solid technical content on applying Zero Trust principles to AI systems, let down somewhat by thin character work in the narrative framing, the ideas outpace the storytelling.
I came to this one shortly after finishing George Finney’s first Zero Trust book, Project Zero Trust, which used a fictionalized case study format to make a dense security framework digestible. The approach is unusual enough in technical writing to be memorable, Finney tells a security story rather than presenting a security manual, which lowers the activation energy for readers who find straight frameworks exhausting. Rise of the Machines continues that experiment, and the technical content is strong. What the sequel had to wrestle with was whether the narrative vehicle could carry the heavier freight of artificial intelligence, mergers and acquisitions, and adversarial AI, subjects that are even more complex than the baseline Zero Trust material.
The answer is mostly yes, with the honest caveat that one reviewer found the audio version specifically problematic for the fiction portions. That feedback is worth registering: the character work in this kind of hybrid technical fiction depends heavily on narration to succeed, and flat delivery in conversational or dramatic sections can make the novelistic scaffolding feel like an obstacle rather than an aid to understanding. For listeners who engage primarily with the security content rather than the story, this is a lesser concern.
Zero Trust Meets AI: The Restaurant Analogy
Finney’s signature move is the unexpected analogy, and Rise of the Machines delivers one of his best: a restaurant comparison for explaining how to secure AI systems. The logic is this, a restaurant’s kitchen (data and model processing), front of house (interfaces and access points), and supply chain (data pipelines and MLOps infrastructure) can all be mapped onto the access control and verification requirements of a Zero Trust AI architecture. It is genuinely illuminating. AI security literature tends to get tangled in either the mathematics of model robustness or the abstraction of governance frameworks; Finney’s analogy keeps the structural argument clear and grounded in something everyone can visualize.
The treatment of adversarial AI is the section that distinguishes this book from general AI security content. Finney addresses not just the use of AI by security teams (threat detection, anomaly identification) but the use of AI by attackers to probe, manipulate, and undermine security systems. The adversarial angle, prompt injection, model poisoning, data pipeline manipulation, is handled with appropriate seriousness, and the Zero Trust response to each attack surface is articulated clearly: never assume the model or its inputs are trustworthy, verify continuously, apply least-privilege principles to data access.
The Sequel’s Additional Terrain
One thing Finney is explicit about is that this book was written to cover ground the first Project Zero Trust did not reach. The chapters on mergers and acquisitions, business continuity, and remote work add practical texture that will resonate with security professionals who have been through an acquisition and discovered that two different Zero Trust implementations do not simply merge gracefully. The M&A section is particularly useful, the moment of acquisition is one of the highest-risk periods in any organization’s security posture, and the book treats it with the seriousness it deserves rather than folding it into a generic chapter on network expansion.
The antivirus discussion, situated within a Zero Trust frame, argues for something many security professionals have been saying for years: traditional signature-based antivirus is insufficient as a primary defense in environments where Zero Trust is the operating model. The argument is clear and the logic is sound, though practitioners in larger enterprises will find the discussion somewhat familiar. For IT professionals in smaller organizations still relying heavily on endpoint protection, the conceptual reframing is worth the time.
Regulatory Alignment and the Compliance Layer
The closing material on regulatory issues and the alignment of compliance frameworks with Zero Trust principles reflects an emerging reality in enterprise security: Zero Trust is no longer just a vendor narrative but an increasingly codified regulatory expectation. Finney’s treatment of this is current enough to be useful for compliance teams and CISOs making the case for Zero Trust investment to non-technical leadership. The framing, that regulatory bodies are converging on Zero Trust as the expected baseline, provides organizational justification that security practitioners often struggle to articulate in business terms.
Who Should Listen and Who Should Skip
IT professionals, network engineers, system administrators, cloud architects, and security leaders who engaged with Finney’s first Zero Trust book will find this a worthwhile continuation. The narrative format makes it more accessible than a pure reference text, and the AI-focused content is current and substantive. Listeners who have not read Project Zero Trust can follow along, but the book functions as a sequel and benefits from that prior context. Those expecting a purely literary experience will find the character development thin, this is a technical book with a narrative wrapper, not the reverse. The audio caveat from one reviewer is worth taking seriously: if the character performance in technical fiction bothers you, this may frustrate more than it illuminates.
Frequently Asked Questions
Do I need to have read Project Zero Trust before listening to this sequel?
The book stands on its own conceptually, Finney reestablishes the Zero Trust framework before extending it. But it is explicitly a continuation and references events and characters from the first book. Listeners who start here will get the technical content but miss some of the narrative context that gives the sequel its structure.
One reviewer said the narration is bad and the characters are simplistic, is the audiobook format worth it for this title?
The negative review applies specifically to the fiction portions of the book. The technical content is well-organized and the concepts are substantive. Listeners who are primarily interested in the Zero Trust-meets-AI material and less invested in the story wrapper will find the audio version functional. Those who engage strongly with character-driven narrative may find the format less satisfying than the print version.
How technical is the coverage of adversarial AI and MLOps security?
Conceptually rigorous but not mathematically deep. Finney addresses prompt injection, model poisoning, and data pipeline integrity through a Zero Trust lens rather than through formal ML security research. Practitioners in ML engineering may find some of the security concepts oversimplified, but security professionals without deep ML backgrounds will find the level of detail appropriate and actionable.
Is this book useful for compliance and governance teams, or is it primarily for technical practitioners?
Both audiences are served, though differently. Technical practitioners get the most from the specific protocol and architecture discussions. Compliance teams and security leadership will find the regulatory alignment sections and the business continuity material useful for making organizational cases for Zero Trust investment, particularly as regulatory frameworks increasingly codify Zero Trust expectations.
