Identity-centric ZTNA and what Forrester’s TEI study changes

At a glance

What this is: Appgate’s TEI study summary says a composite ZTNA deployment delivered $11.6 million NPV, less than six months’ payback and lower operational overhead through identity-centric, direct-routed access.

Why it matters: For IAM and Zero Trust teams, the key question is whether access control is being enforced at the connection layer as well as the policy layer, especially where hybrid access and segmentation need to limit lateral movement.

By the numbers:

• The composite organisation in the study achieved $11.6 million net present value over three years, according to Appgate.

Context

Identity-centric ZTNA matters because many zero trust programmes still treat access as a policy decision without enough attention to where traffic is actually routed and enforced. In practice, the control plane and the data path can drift apart, especially in hybrid environments where latency, segmentation and administrative overhead all compete with security goals.

Appgate’s source article frames direct-routed access as a way to keep encrypted connections under customer control while reducing dependence on cloud relays. That is relevant to IAM and Zero Trust teams because the access decision is only as strong as the path that carries it, and the article’s starting point is typical of organisations trying to modernise remote access without inheriting extra routing complexity.

Key questions

Q: What breaks when zero trust access is routed through a shared path instead of enforced directly?

A: Shared routing paths can weaken the practical boundary around access by adding intermediate infrastructure that may expand exposure, complicate inspection and obscure where enforcement actually occurs. In Zero Trust programmes, that creates a gap between policy intent and traffic handling. The result is often more complexity, less legibility and weaker containment if a session is abused.

Q: Why does identity-centric segmentation reduce risk in hybrid access environments?

A: Because it limits how far a valid session can move once authenticated. If access is tied to identity, context and a specific resource, a compromised credential does not automatically translate into broad internal reach. That containment effect matters in hybrid estates where remote access often becomes the easiest route to lateral movement.

Q: How do security teams know whether their ZTNA model is actually easier to govern?

A: Look for reduced manual effort in policy updates, cleaner segmentation administration and fewer exceptions created just to keep access working. If the model still depends on constant operator intervention, the architecture may be functionally secure but operationally brittle. Governance improves when the access path is simple enough to explain, audit and sustain.

Q: Should teams prioritise access path control or policy tuning first in Zero Trust programmes?

A: If the routing model still creates unnecessary exposure or depends on external relays, access path control should come first because policy cannot fully compensate for a weak transport boundary. Once the path is governed, policy tuning becomes more effective and easier to validate. The order matters because the path determines how the decision is enforced in practice.

Technical breakdown

Why direct-routed ZTNA changes the enforcement model

Direct-routed ZTNA establishes an encrypted path between the user and the authorized resource instead of sending sessions through a shared cloud relay. That reduces an intermediary hop, but the more important security effect is architectural: enforcement happens closer to the protected resource and the organisation retains tighter control over traffic handling. In identity terms, the access decision is still driven by user context and policy, but the network path becomes part of the trust boundary. This matters in hybrid estates where routing, segmentation and inspection all influence whether a denied connection is truly denied.

Practical implication: Map where your current ZTNA vendor enforces policy and verify that the access path itself cannot become a hidden trust extension.

How identity-centric segmentation limits lateral movement

Identity-centric segmentation ties reachability to authenticated identity and context, rather than assuming that once a user is inside a network zone they should move freely. That is different from perimeter-era VPN access, where broad network presence often becomes the real privilege. Segmentation therefore reduces the size of the blast radius if credentials are abused or a session is compromised. In practice, the control is less about blocking all movement and more about ensuring that each connection is explicitly scoped to the resource needed, with no residual east-west access implied by network membership.

Practical implication: Design access policies around resource-specific reachability, not just remote connectivity, so compromised sessions do not inherit broad internal access.

What the TEI numbers really measure in access governance

TEI figures such as payback period, NPV and administrative savings are economic outputs, but they also imply something operational about the control model. If a ZTNA design reduces hands-on administration, then policy changes, entitlement updates and segmentation maintenance are being centralised and simplified. That can improve governance, but only if the access model remains understandable to security teams and auditable to risk owners. The article’s numbers should therefore be read as a signal about manageability as much as return on investment.

Practical implication: Use the economic case to test whether your access model is becoming simpler to govern, not merely cheaper to own.

Threat narrative

Attacker objective: The objective is to convert remote access into broader internal reach so that one authenticated connection can open multiple systems instead of one scoped resource.

1. Entry occurs through remote access, where the security value of a connection depends on whether the path itself is tightly controlled or broadly exposed.
2. Credential or session abuse can turn remote connectivity into internal reach if segmentation is weak and access is not tied to the specific resource being used.
3. Impact is lateral movement and administrative overhead, because uncontrolled internal reach expands blast radius and makes governance harder to sustain.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Path control is now part of identity control: zero trust programmes fail when they stop at policy evaluation and ignore the route a session takes to the resource. A direct-routed model reduces reliance on external relays and makes the network path itself a governed trust boundary. For IAM and Zero Trust teams, access design must be measured by where enforcement occurs, not only by who was allowed in.

Identity-centric segmentation is a blast-radius control, not just an access feature: when reachability is bound to identity and context, a compromised session does not automatically become a network foothold. That matters more than generic “secure remote access” language because the real governance problem is limiting unintended lateral movement. Practitioners should treat segmentation as a containment mechanism that complements authentication, not a layer below it.

TEI metrics expose operational friction in access governance: a short payback period and reduced administrative load suggest that the access model is easier to operate, but they do not prove governance maturity on their own. The deeper signal is that complexity is being removed from policy maintenance and path handling. Teams should interpret financial ROI as evidence that the architecture may be easier to sustain at scale.

Direct-routed ZTNA creates a clearer control surface for hybrid access: hybrid estates usually fail at the seams between cloud services, internal infrastructure and user connectivity. A self-routed design keeps those seams inside the organisation’s control, which is where IAM and network security teams need them. The practitioner takeaway is to prefer access architectures that make the trust boundary legible rather than distributed across third-party relays.

Zero trust validation must include the transport layer: if policy says “deny” but the routing model still introduces unnecessary exposure or latency, the programme has not fully aligned enforcement with intent. That is why connection path control should sit alongside authentication, authorization and segmentation in Zero Trust reviews. The practical conclusion is to assess whether the access architecture strengthens or dilutes the policy decision once traffic leaves the client.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Access path control is becoming a core Zero Trust design choice: programmes that only optimise policy intent often miss the enforcement layer that determines whether a session is actually contained. Identity-centric ZTNA makes the route between user and resource part of the security model, which is why access reviews should include transport and segmentation, not just identity checks. According to the Ultimate Guide to NHIs, 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, and that same logic applies when human access paths are being redesigned.

Connection topology is now a governance variable: hybrid access architectures are no longer just network engineering decisions. They shape how containment, auditability and change control behave when identities, endpoints and resources are spread across environments. Practitioners should expect Zero Trust reviews to ask where a session is enforced, who controls the path and how much trust a relay introduces.

The biggest programme risk is not whether access is encrypted. It is whether the organisation can still explain and prove the boundary after the session leaves the client.

For practitioners

• Audit where access enforcement actually happens Document whether sessions are terminated, inspected or merely relayed before they reach internal resources. If the policy decision is separated from the routing path, identify the point at which lateral movement could still occur.
• Scope remote access to the resource, not the network Replace broad internal reach assumptions with resource-specific entitlements so a valid session only reaches the application or system explicitly required for the task.
• Measure admin overhead as a governance signal Track how much manual work remains after policy changes, segmentation updates and onboarding or offboarding of access paths. Persistent operational effort usually indicates the architecture is harder to govern than the business case suggests.
• Review segmentation for lateral movement containment Test whether a compromised user session can pivot beyond its intended destination, especially in hybrid environments where VPN assumptions may still shape access design.

Key takeaways

• Identity-centric ZTNA changes the access control question from who is allowed in to where that access is actually enforced.
• The study’s economic results point to reduced operating friction, but the governance value lies in clearer containment and simpler administration.
• Zero Trust teams should test connection paths, segmentation and relay dependence together, because policy alone does not define the real trust boundary.

Key terms

• Identity Centric ZTNA: An access model that uses identity, device posture, and context to decide whether a session should reach a specific resource. It replaces broad network trust with narrower, policy-driven access decisions and is commonly used to support hybrid work and distributed applications.
• Direct-Routed Access: An access architecture where traffic is enforced inside the customer boundary instead of being backhauled through a shared cloud broker. The value is tighter operational control, lower external exposure, and a clearer trust boundary for high-sensitivity or regulated environments.
• Identity-centric segmentation: Identity-centric segmentation is the practice of limiting access by identity, device, and authorised resource rather than by network location alone. It is especially relevant to defence environments because it reduces lateral movement and produces a clearer audit trail for compliance review.
• Path control: The governance of how traffic moves between a user and a resource, including which intermediaries are allowed and where policy is enforced. In Zero Trust, path control matters because the access decision is only as strong as the route used to deliver it.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect access governance, machine identity control and operational resilience in one programme.