Part 3: How nature holds the key to cybersecurity’s future

< Back to Part 2: It’s cybersecurity’s kryptonite: Why are you still holding it?

Nature’s secret to achieving more while risking less—and how you can use it.

Lessons from nature

Ants! Precisely what came to your mind when you thought of cybersecurity—right alongside firewalls and Identity and Access Management (IAM) systems, right? Probably not! But consider this unlikely source of inspiration for a moment. These tiny creatures may not seem like experts, but they hold the answer to one of the biggest challenges we face: managing authority.

Individually, ants are simple creatures without much intelligence. They don’t have grand strategies or master plans in their tiny brains. Each ant just does its job—gather food, defend the colony, build tunnels. No single ant holds the key to the colony’s success, not even the queen, yet, as a collective, they achieve remarkable feats: complex underground networks, food supply chains, and even farming fungi.

This decentralized approach, known as swarm intelligence, allows the colony to thrive without relying on any one ant to keep it running. If one ant fails, it doesn’t bring down the whole operation. The colony survives because no single point of failure exists to cripple it.

The problem with centralized authority

Shifting back to cybersecurity. Today’s security models, especially Zero Trust, still concentrate authority in single points—admin accounts, IAM systems, root certificates. These are the keys to the kingdom. Once an attacker breaches any of these points, it’s game over for your platform.

But what if we could apply swarm intelligence to cybersecurity? Imagine a system where no one holds the keys and authority is spread across a network. No single point holds enough power to take down the entire system. Visualize a key vault that manages the keys you want to protect – and now imagine that vault broken into pieces across a network such that even if several pieces are compromised, the entire key, and therefore the system remain completely secure.

Think of it like trying to launch a tactical missile that requires multiple different keys, each held by different people in different locations. Even if one key gets stolen, the missile stays locked because you still need the other keys.

But if all those key holders still answered to the same authority, wouldn’t this just be an overly complicated system with only a slight security boost? Exactly. If the distributed network was still controlled by a single IT team, it wouldn’t solve the problem. That’s why it’s crucial that swarm intelligence operates in a truly decentralized way, spread across multiple independent organizations, so no one controls the network. Think of it like combining the strength of all independent ant colonies.

This is the concept of Cyber-Herd Immunity—a cybersecurity model inspired by nature but built for the digital world.

The Cyber-Herd Immunity concept

We’re all painfully familiar with herd immunity in a medical sense—thanks COVID! When enough people in a population are immune to a virus, the virus can’t spread easily—protecting the entire population including those who aren’t immune. The same principle can apply to cybersecurity. Instead of relying on a single system or authority to defend against attacks, we create a decentralized network of systems that protect each other. The more participants in the network, the stronger the overall defense becomes.

In today’s security architectures, we trust centralized systems with too much authority. Once an attacker gains control of that authority, it’s like introducing a virus into a body with no immune system. The damage is immediate and widespread.

But in a Cyber-Herd Immunity model, the authority needed to grant access and unlock sensitive data isn’t held by any single entity. It’s distributed across a decentralized network of nodes, much like ants distribute tasks across the colony. This decentralization protects the system, even if one part is compromised.

In a decentralized security system, each node (like an ant) has limited authority—Incomplete authority. No one node has enough information to unlock sensitive data or grant access on its own. For any operation to be authorized, multiple nodes must collaborate to verify and action the request.

Trustless authority: the key to the future

This brings us back to the core issue we identified in Part 2: authority. In traditional security setups, authority is concentrated in a few places—for example: admins, IAM systems, root certificates, even plain text configuration files. But with a decentralized, trustless network, we remove the need to place blind trust in any one system or person.

Let’s say you’re working on a platform storing sensitive medical data. Normally, you’d trust your IAM system to manage permissions, encryption, and authentication. But what happens if that IAM system is compromised? All the data is at risk.

In a decentralized network, the authority to grant access to that medical data isn’t held by a single IAM system. Instead, it’s distributed across multiple nodes. Even if one part of the system is breached, the attacker can’t access the data without compromising the network. This decentralization doesn’t just improve security—it eliminates the authority problem.

No one holds too much power. No one has the “keys to the kingdom.” Even if an attacker breaches several layers of defense, they still won’t have enough authority to cause damage.

How this works in practice: decentralized key vaults

Now, let’s put this concept into practice with decentralized key vaults. Today, key vaults are centralized treasure chests storing encryption keys, credentials, and certificates. But these vaults are also high-value targets. If an attacker breaches your key vault, they’ve essentially hit the jackpot.

But what if instead of one centralized vault, we had a network of vaults, each holding a fragment of the key? No single vault contains the full key, so even if one vault is breached, the key remains secure. And because this network is decentralized, it becomes nearly impossible to compromise the entire system.

Interacting with a decentralized key vault would still feel exactly like any key vault – where you’d treat it as the store of keys, authenticate to it and request it to perform cryptographic operations on the stored keys on your behalf, like decrypt a sensitive record for a particular patient – with one significant difference: you’d have a verifiable guarantee no one will ever hold the complete key at any point, so you can rest assure no breach can occur.

In this decentralized model, each key is generated in fragments distributed across independent nodes. When a request is made to access data, these nodes work together, each performing a small part of the operation. No node ever holds the full key, and no single actor can misuse it. This is trustless authority in action—security that doesn’t rely on trusting any single person, system, or vendor.

A new era of collaboration: building the network

Here’s where it gets exciting: this decentralized model doesn’t just protect your platform—it protects everyone. By joining a network of decentralized nodes, you contribute to the security of the entire ecosystem. It’s like being part of a collective immune system that grows stronger with every antigen. The more nodes in the network, the harder it becomes for attackers to breach any single entity.

This isn’t just a theoretical concept—it’s the future of cybersecurity. A collective of organizations collaborating to protect each other, without the need for mutual trust, decentralizing authority, and turning catastrophic breaches into relics of the past.

By spreading authority across a decentralized fabric, we create a system where no one holds enough power to cause real damage, and everyone—from startups to global tech companies— can tap into the collective security benefits of the network.

In Part 4, we’ll dive into the technology that makes this possible: Ineffable Cryptography. We’ll break down how decentralized authority works at scale and how this mathematical breakthrough can protect your systems in ways that traditional cybersecurity measures never could. Get ready to explore the fulfillment of true Zero Trust, where everything sensitive is locked with keys no-one will ever hold—keys no-one can steal, lose or misuse.

Authors:

This 5-part series outlining the worry-free future of cybersecurity for platform developers is an adaptation of Tide Foundation Co-Founders Michael Loewy and Yuval Hertzog’s keynote at ACM SIGCOMM 2024

Michael Loewy is a Co-Founder of Tide Foundation and serves on the advisory board of the Children’s Medical Research Institute.

Yuval Hertzog is a Co-Founder of Tide Foundation and one of the inventors of VoIP.

Series shortcuts:

• Part 1: It’s time to rethink cybersecurity for platform developers
• Part 2: It’s cybersecurity’s kryptonite: Why are you still holding it?
• Part 3: How nature holds the key to cybersecurity’s future
• Part 4: I got 99 problems, but a breach ain’t one
• Part 5: Future proofing your platform