Your crown jewels aren’t really yours and there’s probably nothing you can do about it…

Victor De Luca, a sales engineer at Zscaler who started his security career in the Canadian Armed Forces, argues that most organizations cannot actually say where their crown jewels live or who controls them. He walks through the standard security cycle of identify, quantify and mitigate, then shows how a shared-responsibility model (illustrated with AWS's own diagram) applies to nearly every asset, not just cloud infrastructure, citing that 85% of US critical infrastructure sits in private hands. A running startup example (DNS registrar, certificate authority, cloud workloads, customer data agreements, SaaS tools, an MSP with admin access) shows how quickly ownership and control fragment. He proposes a four-team response: leadership should prioritize availability, integrity and confidentiality in that order and publish uncomfortable metrics about exposure; IT should inventory assets and map data flows across integrated SaaS tools; legal should embed access, storage and retention clauses into every contract; and security should accept that attack-surface scanning is often impossible on assets they do not own, pursue automated supply-chain security, and cover all seven common exfiltration channels. He closes citing a real case where a backup tool quietly gained access to seven systems through reused credentials.