Why do zero trust controls still leave gaps for identity attacks in modern enterprises?

Zero trust controls are strong at validating credentials, sessions, and devices, but attackers increasingly target the human layer through deepfakes and social engineering. That creates a gap when a legitimate login is still initiated by the wrong person. Organisations need assurance at critical moments, not just at sign-in, to limit impersonation and fraudulent approval paths.

Why This Matters for Security Teams

zero trust is designed to reduce implicit trust, but many enterprise identity attacks do not arrive as broken perimeter events. They arrive as valid sessions, valid devices, and valid approvals from the wrong person. That is why assurance at sign-in is necessary but not sufficient. Attackers now target the human decision point, especially where MFA fatigue, deepfakes, or urgent approvals can bypass otherwise strong controls.

NIST’s Zero Trust Architecture guidance supports continuous verification, yet the hard problem in practice is proving intent at the moment a sensitive action occurs. NHIMG’s Ultimate Guide to NHIs shows why this matters across machine and human workflows: identity compromise is often detected late, after trust has already been converted into access. In practice, many security teams discover impersonation only after an approval, transfer, or token issuance has already been abused.

How It Works in Practice

Modern zero trust should be treated as a control plane, not a one-time gate. That means validating the session, device posture, and risk signals continuously, then adding stronger checks at high-impact moments such as wire approvals, password resets, token grants, or privilege elevation. The goal is to distinguish a legitimate authenticated user from a legitimate user being manipulated in real time.

Operationally, that shifts the design from static IAM to context-aware authorization. Current guidance suggests combining policy evaluation at request time with signals such as location drift, impossible travel, device trust, transaction amount, and the sensitivity of the requested action. This is where zero trust intersects with identity proofing, fraud controls, and step-up verification. For identity infrastructure, the lesson from NHIMG’s 52 NHI Breaches Analysis is that credentials alone do not describe trustworthiness when adversaries can steal, replay, or socially engineer their way into valid access.

• Use continuous authentication for risky actions, not just initial login.
• Require step-up verification for approvals that move money, data, or privilege.
• Bind access to device, context, and user behaviour, not only password or MFA success.
• Log and review approval chains, token issuance, and privilege changes as separate events.
• Treat anomalous consent, not only anomalous sign-in, as a primary alert condition.

This aligns with the broader pattern documented in the Anthropic report on AI-orchestrated cyber espionage, where automation amplifies speed and scale once a foothold exists. These controls tend to break down in highly delegated environments because repeated approval shortcuts and legacy SSO trust chains make the “right login, wrong intent” problem difficult to detect.

Common Variations and Edge Cases

Tighter approval controls often increase friction, requiring organisations to balance fraud resistance against business urgency. That tradeoff becomes sharper in environments where executives, finance teams, or support desks need rapid action and where over-reliance on push approvals can create alert fatigue. Best practice is evolving, but there is no universal standard for proving intent at every critical moment.

One important edge case is third-party access. Vendor admins, outsourced operations, and service desks often sit outside normal behavioural baselines, which makes a clean zero trust policy harder to enforce without disrupting operations. Another is recovery flow abuse: attackers may bypass strong login controls by targeting password resets, help desk workflows, or delegated consent. NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now underscores how widespread identity exposure can be, while Guide to SPIFFE and SPIRE is useful when teams need cryptographic workload identity for services rather than user-centric assumptions.

Ultimately, zero trust reduces blind trust, but it does not automatically prove that the person behind a valid session is making the right decision. That is why high-risk workflows still need layered verification, transaction-specific controls, and explicit fraud monitoring.

Related resources from NHI Mgmt Group

• When does Zero Trust IAM still leave governance gaps?
• Why do Microsoft identity and endpoint tools still leave governance gaps in large enterprises?
• Why does PKI matter for zero trust architecture and identity-first security in modern enterprises?
• Why does traditional MFA still leave gaps in zero trust architectures?