TL;DR: Device posture must be tied to access decisions if organisations want Zero Trust to work in remote-first environments, because siloed MDM, directory, and identity tools leave compliance gaps that let unhealthy devices keep accessing sensitive apps, according to JumpCloud. Conditional access turns device health into an enforceable control instead of a reporting exercise.
At a glance
What this is: This is a device posture and conditional access analysis arguing that zero trust fails when endpoint health is checked separately from access control.
Why it matters: It matters because IAM teams need access decisions to reflect live endpoint risk, or remote devices can drift out of compliance while still retaining access to sensitive systems.
Context
Device posture is the security state of an endpoint, including encryption, patch level, firewall status, and screen lock. The article argues that zero trust cannot rely on initial login alone because device condition changes after authentication, especially in remote-first environments.
The governance gap is the split between endpoint management and identity enforcement. When MDM, directory services, and access policy do not share a real-time view, a non-compliant device can remain authorised long after it should have been blocked.
Key questions
A: Security teams should treat device posture as a dynamic access signal, not a one time gate. The practical pattern is to evaluate device health and compliance before each connection request, then allow or block access based on current risk. That approach supports granular control, reduces standing trust, and lets policy respond as endpoint conditions change over time.
Q: Why do siloed endpoint and identity tools create access risk?
A: Siloed tools create risk because one system may detect non-compliance while another still grants access. If posture data does not flow into the directory or policy engine, the access decision is stale. That gap lets known-bad devices keep reaching applications, which is exactly what zero trust is meant to prevent.
Q: What breaks when device posture is checked only at login?
A: Login-only checks break when a device changes after authentication. A user can disable a firewall, fall behind on updates, or move onto an insecure network and still keep their session. Continuous verification is needed because device trust is not static, and access should be revoked when posture changes.
Q: What should teams do when a device becomes non-compliant mid-session?
A: Teams should block or step up access immediately when posture drops below policy, then guide the user to remediate the issue. Delaying revocation until the next login leaves a trust window open for sensitive applications and data. Mid-session enforcement is what makes conditional access operational, not theoretical.
Technical breakdown
How conditional access turns device posture into an access signal
Conditional access evaluates endpoint state at the moment access is requested, then uses that state as an input to the authorisation decision. In this model, device posture is not a dashboard metric but a policy input tied to identity, location, and network trust. The practical difference is that security baselines become enforceable conditions, not after-the-fact compliance evidence. If the platform can continuously reassess posture, the policy can react when a device moves from compliant to non-compliant during a session.
Practical implication: treat posture as a live authorisation input, not a reporting field.
Why siloed MDM and directory tools create enforcement gaps
A fragmented stack splits device management from identity enforcement. An MDM tool may detect that a device is non-compliant, but if that status does not reach the directory or access policy engine, the user can still reach applications. That gap exists because policy evaluation is only as good as the data shared between systems. In zero trust terms, the control plane cannot make a correct decision if endpoint health, user identity, and access rights are held in separate systems that do not synchronise reliably.
Practical implication: eliminate posture-enforcement gaps by joining endpoint and identity policy into one control path.
Why continuous verification matters more than login-time checks
Login-time checks assume device trust is stable after authentication, which is not true in modern endpoint environments. A device can lose firewall protection, fall behind on updates, or move onto an insecure network after the initial access decision. Continuous verification keeps watching for that drift and can revoke access when the device no longer meets policy. This is the operational difference between conditional access as a gate and conditional access as an ongoing control.
Practical implication: set policy to re-evaluate posture throughout the session, not only at sign-in.
Threat narrative
Attacker objective: The objective is to preserve access from an endpoint that should have been denied, then exploit the resulting trust gap to reach protected resources.
- Entry occurs when a non-compliant endpoint authenticates successfully because device health was not enforced at the access layer.
- Credential or session access is then preserved even though the device no longer meets baseline controls such as encryption, patching, or firewall requirements.
- Impact follows when that same endpoint keeps reaching sensitive applications and data, creating an exploitable window for lateral abuse or data exposure.
Breaches seen in the wild
- JumpCloud breach 2023: North Korean hackers breached JumpCloud and abused its device commands framework against a few customers; all admin API keys were reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Device posture has become a zero trust control plane issue, not an endpoint hygiene issue: once posture and access are decoupled, compliance becomes informational instead of enforceable. The article shows why that matters in remote-first environments, where devices drift after authentication and identity alone cannot express trust. The practitioner conclusion is that posture checks belong in the access decision path.
Siloed MDM and directory services create an identity governance blind spot: a compliance signal that stops at the endpoint console does not change authorisation outcomes. That is not a visibility problem in the abstract, it is a policy propagation failure that allows known non-compliant devices to keep consuming applications. The practitioner conclusion is that policy architecture matters as much as endpoint configuration.
Continuous device verification is the real Zero Trust test: one-time checks assume device state is static, but device risk is temporal and session-bound. The article correctly frames the operational shift from initial trust to ongoing trust validation. The practitioner conclusion is that access control must be able to revoke trust mid-session when posture changes.
Conditional access is where endpoint posture becomes enforceable identity policy: this is the named concept that separates reporting from control. When identity, endpoint health, and network context are evaluated together, security teams can make access conditional on the real state of the device rather than on a stale assurance event. The practitioner conclusion is that unified policy evaluation is the deciding design choice.
Multi-OS parity is a governance requirement, not a convenience feature: posture policy that works on one operating system but not another creates uneven trust boundaries inside the same programme. That inconsistency undermines the whole model because risk follows the weakest enforceable platform. The practitioner conclusion is that zero trust posture policy must be applied across every managed endpoint class.
What this signals
Conditional access has to absorb endpoint health directly: zero trust programmes that still treat device posture as a separate compliance layer will continue to miss real-time risk drift. The operational shift is from knowing a device was healthy at some point to proving it is healthy at the moment access is being granted.
Unified policy is the control boundary that matters: when endpoint management and identity systems do not share posture state, the programme creates its own exception path. That weakens both remote access governance and device trust because the same endpoint can be compliant in one console and trusted in another.
Cross-platform consistency is now part of access governance: if Windows gets stricter posture enforcement than macOS or Linux, the organisation has not built zero trust, it has built uneven trust. The practical signal is simple: access policies must behave the same way wherever the endpoint runs.
For practitioners
- Define device security baselines Set mandatory conditions for encryption, supported OS level, active firewall, and screen lock before any device can reach sensitive applications.
- Join posture and identity policy Integrate endpoint management with directory and access policy so non-compliant device state changes can influence authorisation in real time.
- Enforce continuous posture rechecks Re-evaluate device state during the session so access can be revoked when a device becomes non-compliant after login.
- Standardise posture policy across operating systems Apply the same access conditions to Windows, macOS, Linux, iOS, and Android so cross-platform gaps do not become trust gaps.
Key takeaways
- Device posture is only useful when it changes access, because otherwise compliance findings do not affect the threat surface.
- The core failure mode is a split control plane, where endpoint tools detect problems but identity systems still permit access.
- Continuous verification and unified policy evaluation are the mechanisms that turn device health into a real zero trust control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST Zero Trust (SP 800-207), NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST Zero Trust (SP 800-207) | 3.1 — Verify explicitly | The article centers on continuous verification before and during access. |
| Recommendation — Apply explicit verification to re-evaluate device posture before and during every access decision. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Posture is being used to gate entitlements and authorisations. |
| Recommendation — Tie access permissions to current device posture so non-compliance can deny authorisation. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article’s access enforcement depends on governing who or what can use the account from a device. |
| Recommendation — Align account access rules with device compliance signals and revoke access when posture fails. | ||
Key terms
- Device Posture: The current security condition of a device or runtime at the moment access is requested or renewed. Posture can include patch state, protection status, integrity, and whether the endpoint is managed. In identity governance, posture is part of the trust decision, not a separate endpoint problem.
- Conditional Access: Conditional access is a policy model that decides whether an action should proceed based on context such as posture, resource sensitivity, timing, and scope. For AI agents, it must be evaluated at request time so a valid credential does not automatically equal permitted behaviour.
- Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.
- Unified Endpoint And Identity Control: A governance model where endpoint management and identity policy operate through the same decision path. It reduces blind spots by ensuring that a device marked non-compliant in one system can affect authorisation in the system that grants access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org