# Architecting Security and AI at Enterprise Scale

> Direct engagement with a Zero Trust and Agentic AI architect. From cybersecurity to AI governance and agentic coding. Integration-first, grounded in hands-on experience.

- Canonical: https://graymatter.ch/about/
- Locale: en
- Body language: en

---

## Nikola Novoselec

**Founder, Gray Matter**

Independent architecture, grounded in hands-on work across enterprise security and governed AI.

I founded Gray Matter in 2016. It took a decade to find its purpose. After 16 years as an architect at one of Switzerland's largest critical infrastructure providers - serving as lead programme architect and technical lead for the Zero Trust programme since 2022 - the purpose became clear: Zero Trust and governed Agentic AI are inseparable, and both need architecture that works in practice, not just in frameworks. The hardest problems sit in the gaps between policy and implementation, governance and delivery, architecture and operations.

## What I Advise On

> Where security architecture and governed autonomy meet.

**Zero Trust Architecture**
Building security architectures that work across fragmented enterprise estates, governance models, and legacy constraints. Horizontal policy woven into connectivity - so controls do not fail at the seams. Security that adapts to the user, not the other way around.

**Governed Agentic AI**
Designing autonomy that is bounded by policy, identity, observability, and operational controls. The same conditions that make Zero Trust difficult at scale - fragmented identity, inconsistent policy, legacy complexity - also make Agentic AI risky to deploy. I help organisations adopt AI safely through Graduated Autonomy: enabling useful automation while preserving control, traceability, and accountability.

This is not theoretical. I build and operate autonomous AI systems in practice - from governed security operations to spec-driven engineering workflows. When I advise on AI governance and agentic coding adoption, it comes from operating these workflows, not from treating them as a trend.

## Enterprise Scale Context

> Experience shaped by complexity at scale.

Zero Trust and AI governance are rarely constrained by tooling alone. The harder problems are fragmented ownership, uneven governance, legacy integration, and consistent policy across complex organisations.

My perspective is grounded in leading the architecture and technical direction of the Zero Trust programme within a major Swiss transformation spanning:

**Scale and reach** across 100+ subsidiaries, 3,500+ locations, 70,000+ employees, 40,000+ endpoints, and 5M+ users, including employees, customers, partners, and suppliers.

**Technical complexity** across Swiss and international operations, hybrid multicloud, hundreds of SaaS applications, and decades of legacy IT, IoT/OT, and industrial control systems.

**Governance and delivery** requiring approval across IT leadership, executive management, and the board, followed by a funded multi-year programme covering all seven Zero Trust pillars.

Industry experience includes logistics, transportation, finance, and the public sector.

In low-risk contexts, integrating connectivity and policy enforcement keeps security in the background and shortens integration timelines.

## Why Direct Engagement Works

> One architect from decision through delivery.

**Continuity**
The person who designed the architecture is the same person who guides implementation. No handovers, no re-education, no context lost between phases.

**Aligned Incentives**
My success is measured by your outcomes, not billable hours. The engagement is focused on delivering results with direct access to the person doing the work.

**Current Practitioner Experience**
My guidance comes from recent, hands-on experience building the systems I advise on. I still architect and build - which means recommendations reflect current operational reality, not yesterday's best practices.

This model is not right for every engagement. If you need a team of 50 consultants or a global programme management office, a larger firm is the appropriate choice. I design at scale, then guide your teams through execution.

## How I Work

> Pragmatic principles for architecture that survives reality.

**Survivability Over Theory**
If a policy cannot survive peak operational loads or a legacy SAP instance, it is a liability, not a security measure. I prioritise resilient, pragmatic architecture over theoretical models. Architecture that cannot survive contact with your budget, organisational culture, and legacy systems is not architecture - it is theory.

**Technology-First Advisory**
I help you decide what technology you need - and what you don't. Whether selecting Zero Trust platforms, AI frameworks, or agentic coding toolchains, I guide your team through evaluation, RFI/RFP processes, and PoC design. When I recommend a product, it is because I believe it serves your interests.

**Resilience Over Perfection**
I design for failure - not to prevent it, but to survive it. The architecture that wins accepts concentrated dependencies deliberately and designs for graceful degradation. I do not design for a world where technology never fails - I design for a business that survives when it does.