TL;DR: Micro-segmentation and software-defined perimeters still matter, but Bravura Security argues that identity governance and IAM are the more scalable foundation for Zero Trust Architecture as cloud adoption, social engineering, and credential abuse reduce the value of network boundaries. The real shift is from perimeter control to contextual access decisions and lifecycle governance.
At a glance
What this is: This analysis argues that Zero Trust Architecture is moving toward identity governance and IAM as the practical foundation, while perimeter-style controls remain useful but less scalable.
Why it matters: For IAM, IGA, PAM, and NHI teams, the implication is that Zero Trust programmes have to centre on access lifecycle and contextual decisions, not just network segmentation.
By the numbers:
- 80% of breaches were linked to external actors in the 2021 Verizon Data Breach Investigations Report, according to Bravura Security.
- By 2025, 81% of breaches were caused by external actors, according to Bravura Security.
Context
Zero Trust Architecture is a security model that assumes no user, device, or connection is trusted by default. In this article, the primary governance question is whether identity governance and IAM now provide a more scalable foundation for ZTA than network-centric segmentation models.
The article frames micro-segmentation and software-defined perimeters as valid controls, but argues they become harder to manage as environments grow more cloud-heavy and dynamic. That makes lifecycle governance, contextual access, and deprovisioning more central to the Zero Trust programme than boundary enforcement alone.
For identity teams, the practical issue is not whether perimeter controls disappear, but whether they can still carry the weight of modern access decisions when credentials, devices, and workloads move across environments.
Key questions
Q: Why do perimeter-based zero trust models fail when credentials are stolen or phished?
A: Perimeter-based models assume the boundary is a meaningful trust divider, but stolen or phished credentials let attackers operate as legitimate users once inside. The failure is not only technical, it is governance-related: access remains valid when the identity behind it is no longer trustworthy. Zero Trust has to verify entitlement and context continuously.
Q: How should security teams implement zero trust IAM in cloud-native environments?
A: Start by enforcing real-time authorization on every privileged request, then replace standing access with scoped, time-bound elevation. Apply the same policy logic across cloud consoles, Kubernetes, databases, CI/CD, and internal apps so exceptions do not become the default control model. Consistency matters more than a single tool choice.
Q: What are the signs that network-centric zero trust is not keeping up?
A: Common signals include heavy reliance on static internal segments, repeated exceptions for cloud and SaaS access, and access decisions that ignore lifecycle state. If the organisation can only explain trust in terms of location or boundary membership, the programme is lagging behind how users and workloads actually operate.
Q: Should organisations prioritise identity governance before micro-segmentation in Zero Trust?
A: In most hybrid and cloud-first environments, yes. Identity governance addresses who gets access and whether that access still makes sense, while segmentation mainly constrains where traffic can go. If the underlying identity model is weak, segmentation often just contains bad access rather than preventing it.
Technical breakdown
Why perimeter-based zero trust becomes harder to scale
Micro-segmentation and software-defined perimeters both try to recreate trust boundaries inside or around the network. That works best when environments are stable, assets are well-bounded, and administrators can maintain clear segments and policies. In large SaaS-driven estates, those assumptions break down because the application layer is less controllable, identity is more portable, and internal boundaries multiply faster than teams can govern them. The technical problem is not that segmentation fails completely, but that its operational cost rises as the environment becomes more dynamic.
Practical implication: treat segmentation as a supporting control, not the primary control plane for a rapidly changing enterprise.
How identity governance changes the zero trust control plane
Identity governance shifts the control point from network location to authenticated identity, access intent, and lifecycle state. In practice, that means provisioning, deprovisioning, approvals, and least privilege become the mechanisms that determine whether access should exist at all. The article is right to connect this to dynamic policy because the core Zero Trust principle is contextual access, not one-time trust establishment. Once access is governed through identity state, the model can work consistently across on-premises, remote, and cloud services.
Practical implication: align access decisions to identity lifecycle events and policy context rather than to segment membership alone.
Why credential abuse turns external attacks into internal access problems
The article’s strongest technical point is that many external intrusions arrive through valid credentials obtained on the dark web or through phishing. That means the attack is no longer about crossing the perimeter, but about abusing legitimate access once the attacker is inside the trust boundary. In Zero Trust terms, this is exactly where identity governance matters most, because the system must continuously verify entitlement, privilege scope, and session conditions instead of assuming the credential is inherently trustworthy.
Practical implication: design for credential abuse as an internal access problem, not just an external breach path.
Threat narrative
Attacker objective: The attacker wants to turn stolen or phished credentials into durable internal access that bypasses perimeter-based defenses.
- Entry occurs when an attacker acquires valid credentials through dark web access or social engineering.
- Escalation follows when those credentials are accepted by systems that still rely on boundary-centric trust assumptions.
- Impact comes from legitimate internal access being used to move through applications and resources without strong lifecycle or contextual control.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance is now the most defensible Zero Trust control plane for large enterprises. Micro-segmentation and software-defined perimeters still matter, but they depend on stable boundaries that modern SaaS and cloud estates no longer guarantee. The governing question is who should have access, for how long, and under what context, which is the problem identity governance is built to answer. Practitioners should treat ZTA as an access governance programme first and a network design problem second.
Standing perimeter controls cannot absorb credential abuse at cloud speed. The article correctly notes that many external breaches arrive through valid credentials, which means the trust failure is inside the access model, not just at the edge. That makes contextual access decisions, approval workflows, and deprovisioning more operationally important than internal segmentation alone. Security teams should map Zero Trust outcomes to access lifecycle controls, not only to traffic controls.
Contextual policy is the differentiator between theoretical and operational Zero Trust. A ZTA that only enforces location or subnet rules still trusts too much at the point of access. Identity governance adds the missing control over entitlement, privilege scope, and ongoing legitimacy, which is what makes Zero Trust scalable across hybrid environments. Practitioners should measure whether access is being decided at identity time, not just at network time.
Zero Trust maturity now depends on reducing access drift, not simply hardening network edges. As organisations move deeper into cloud and SaaS, the access model has to cope with identities that are provisioned, reused, and retired across multiple environments. That is where lifecycle governance, not perimeter replication, becomes the decisive discipline. Teams should expect identity governance to carry more of the Zero Trust burden over time.
Contextual access becomes the more durable answer when traditional boundaries lose explanatory power. The article’s use of hybrid and cloud examples shows that perimeter logic does not describe how modern access actually works. Identity governance, IAM, and JIT principles can be enforced consistently across environments in ways that network-only models cannot match. Practitioners should design for policy portability across the full identity estate.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Read next: Zero Trust Identity Guide
What this signals
Identity governance is the control layer that gives Zero Trust operational meaning. When access decisions follow lifecycle state and context, the programme can govern users, administrators, and workload identities through the same policy logic. That is the point where Zero Trust stops being a perimeter redesign and becomes a governance model.
Access decisions will keep moving closer to the identity layer. As cloud estates and SaaS usage expand, the practical question is whether policy can travel with the identity across environments without relying on static network boundaries. Organisations that cannot answer that are still treating Zero Trust as a topology problem rather than an access problem.
For practitioners
- Prioritise identity governance in Zero Trust planning Make access lifecycle, approval, and deprovisioning the starting point for ZTA design, then layer segmentation where it still adds value.
- Map credential abuse into your trust model Assume external attackers will arrive with valid credentials and test whether your controls can detect and contain that condition inside the trust boundary.
- Use contextual policy for access decisions Tie access to user, device, resource, and session context so authorization is evaluated dynamically rather than by network location alone.
- Limit standing access with just-in-time control Reduce long-lived access paths so users and administrators receive only the access they need for the task and only for the required period.
Key takeaways
- Zero Trust becomes more durable when identity governance, not perimeter design, carries the main access decision.
- The article’s core evidence is that external breaches still dominate, and valid credentials often make those breaches look like insider access.
- Practitioners should treat segmentation as a supporting control and focus primary investment on lifecycle governance, contextual policy, and just-in-time access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on limiting access scope through identity governance and JIT decisions. |
| NHI-10 — Human Use of NHI | The article notes that valid credentials obtained through social engineering can make external attacks look internal. | |
| Recommendation — Reduce standing access and enforce least privilege for identities that carry administrative or workload permissions. Govern access so human misuse of valid credentials cannot inherit broad NHI-style trust. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article argues that contextual authorization and lifecycle control are central to Zero Trust. |
| Recommendation — Align access permissions and entitlements to contextual policy and lifecycle state. | ||
| NIST Zero Trust (SP 800-207) | Policy Enforcement Point — Policy Enforcement Point | The article compares boundary models with dynamic policy-driven access decisions. |
| Recommendation — Place policy enforcement at the access decision point rather than relying only on network boundaries. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The article explicitly describes stolen and phished credentials as the route into the environment. |
| Recommendation — Hunt for credential access activity and validate controls that block stolen credentials from becoming trusted access. | ||
Key terms
- Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Contextual Access Control: Contextual access control changes access decisions based on factors such as device posture, application risk, location, or data sensitivity. In cloud security, it helps move access policy from static entitlements toward decisions that reflect the actual conditions of use.
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org