NSA Zero Trust discovery makes identity inventory the first control

At a glance

What this is: This is an analysis of the NSA’s new Zero Trust implementation guidance, with the key finding that discovery and identity inventory now sit before enforcement.

Why it matters: It matters because IAM, NHI, and Zero Trust programmes cannot credibly enforce least privilege or continuous verification without authoritative inventories, telemetry, and policy visibility.

Context

Zero Trust fails as a control model when organisations try to enforce policy before they can see what identities, devices, applications, data, and traffic paths actually exist. In practice, discovery is the governance layer that turns identity from a static directory problem into an operational control plane.

The NSA’s January 2026 implementation guidance treats discovery and inventory as the prerequisite for policy enforcement, not as a documentation exercise. That matters for NHI, human IAM, and autonomous access models because every one of them depends on authoritative visibility before least privilege can be made real.

Key questions

Q: How should organisations start a Zero Trust programme when identity data is incomplete?

A: Start with discovery, not enforcement. Build authoritative inventories for users, service accounts, devices, applications, workloads, and data paths, then map ownership and access boundaries. Without that baseline, least privilege and continuous verification become assumptions rather than controls, and policy decisions will be too brittle to trust.

Q: Why does missing identity discovery undermine Zero Trust enforcement?

A: Because enforcement depends on authoritative scope. When users, service accounts, workloads, or devices are missing from inventory, policy engines cannot distinguish legitimate access from blind spots, so they compensate with overbroad access or manual exceptions. That weakens both security and auditability.

Q: What are the signs that Zero Trust discovery is failing?

A: Common signs include unexplained access exceptions, inconsistent policy outcomes across teams, incomplete service account records, and telemetry that cannot be tied back to a known identity source. When those symptoms appear, the programme is enforcing policy faster than it is discovering the environment.

Q: When should security teams prioritise visibility over tighter policy controls?

A: Prioritise visibility first whenever the environment includes unknown identities, hybrid access paths, or incomplete telemetry. Tighter policy without discovery usually shifts risk into exceptions and outages. A mature Zero Trust programme proves coverage before it narrows access.

Technical breakdown

Why discovery is the first Zero Trust control

Discovery in Zero Trust is the process of identifying users, non-person entities, devices, applications, workloads, data stores, and traffic flows well enough to govern them. The NSA’s guidance matters because policy enforcement depends on known subjects, known resources, and known paths. Without that inventory, least privilege becomes aspirational, continuous verification lacks context, and telemetry cannot be tied to a stable access model. The operational shift is from trust assumptions to measurable state.

Practical implication: Build authoritative inventories before tightening policy, or Zero Trust controls will be inconsistent and hard to audit.

How identity inventory changes access enforcement

Identity inventory is not just an account list. It is the structured record of who or what can act, where that identity is used, what privileges it carries, and which systems consume its assertions. In Zero Trust architectures, that inventory becomes the input to policy decisions across users, workloads, and service accounts. If the inventory is incomplete, enforcement engines either overgrant access to avoid outages or deny valid paths and create shadow exceptions.

Practical implication: Map every identity source and access path to the policy engine so privilege decisions reflect current state, not stale records.

Why visibility and telemetry determine whether zero trust works

Visibility and telemetry are the feedback loop that proves access decisions are working as intended. The NSA ties discovery to logging, traffic analysis, and policy inspection because without those signals, organisations cannot tell whether enforcement is actually aligned to business and mission context. This is where many programmes stall: they have policy language but not enough observability to confirm that the policy is being applied at the right layer and to the right identity.

Practical implication: Instrument identity, device, and application telemetry so policy drift and access exceptions are visible before they become normalised.

Threat narrative

Attacker objective: Exploit blind spots in identity and resource discovery to retain access paths that a mature Zero Trust programme should have constrained.

1. Entry occurs through an incomplete view of identities and resources, where unknown users, devices, workloads, or service accounts remain outside inventory and policy scope.
2. Escalation follows when access decisions rely on stale or partial identity data, allowing overbroad privileges and inconsistent enforcement paths to persist.
3. Impact is a Zero Trust programme that looks compliant on paper but still permits unnecessary access, weak auditability, and perimeter-style exceptions inside the environment.

Breaches seen in the wild

• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity inventory is now the control that decides whether Zero Trust is real or rhetorical. The NSA’s implementation guidance treats discovery as the prerequisite for policy, not a supporting activity. That matters because every later control, from least privilege to analytics, depends on knowing which identities and resources exist in the first place. Practitioners should read this as a governance reset, not a tooling preference.

The hardest Zero Trust problem is not authentication, it is authoritative scope. Organisations can authenticate users and workloads all day and still fail if they cannot enumerate every service account, application, and traffic path that should be governed. This is where NHI programmes and human IAM programmes converge: both need complete scope before policy can be trusted. The implication is that inventory quality becomes a board-relevant security control.

Visibility has become the evidence layer for Zero Trust maturity. The NSA’s focus on telemetry, logging, and policy analysis reflects a simple reality: if access decisions cannot be inspected, they cannot be governed. That makes visibility an operational requirement for auditors, security architects, and IGA teams, not a monitoring afterthought. Practitioners should treat inspection quality as part of the control itself.

Zero Trust discovery exposes the identity blast radius hidden in hybrid environments. Once organisations begin mapping users, devices, workloads, and service accounts together, the real problem becomes the number of paths a single identity can touch. That blast radius is what determines whether enforcement is granular or merely cosmetic. The practical conclusion is that access architecture now has to be designed around discoverability, not just policy intent.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Identity inventory is the sequencing control for Zero Trust. Programmes that move straight to enforcement usually end up governing only the identities they can already see, which leaves service accounts, workloads, and shadow access paths outside the policy boundary. The practical test is whether discovery can enumerate the access estate before enforcement starts.

Zero Trust discovery changes the job of IAM and NHI teams at the same time. IAM teams have to treat inventory quality as an enforcement prerequisite, while NHI owners have to prove that service accounts and workloads are not hiding in unmanaged corners of the environment. That convergence is where policy stops being abstract and becomes operational.

Identity blast radius is now a programme design metric. If one identity can touch too many systems before discovery is complete, policy will always lag reality. That is why authoritative inventories, telemetry, and access path mapping now belong in the same governance conversation.

For practitioners

• Inventory identities before enforcement Create authoritative inventories for users, service accounts, workloads, devices, and applications before tightening access policy. Treat missing inventory as a control gap, not an administrative nuisance.
• Map access paths to policy sources Trace where identity assertions come from, which applications consume them, and where policy decisions are made. Reconcile those dependencies so stale sources do not drive enforcement.
• Instrument discovery with usable telemetry Collect logs and flow data that show which identities accessed which resources, under what context, and whether policy matched the request. Use that evidence to validate inventory quality.
• Separate discovery from enforcement milestones Do not declare Zero Trust progress from policy documents alone. Set a discovery milestone for identity, device, data, and application coverage before moving to stricter enforcement.

Key takeaways

• Zero Trust discovery is not a preliminary task in the NSA model, it is the control that makes enforcement possible.
• Incomplete inventories create policy gaps that look like architecture choices but behave like governance failures.
• The practical response is to treat identity visibility, telemetry, and access-path mapping as prerequisites for least privilege.

Key terms

• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Identity Inventory: Identity inventory is the process of discovering and recording every identity that can access systems or data. For NHIs, it includes owner, purpose, privilege scope, lifecycle status, and where the credential is used. Without inventory, governance, audit evidence, and incident response all become partial and unreliable.
• Visibility And Analytics: Visibility and analytics are the capabilities that show how systems, workloads, and applications communicate and whether policy is being followed. In Zero Trust programmes, they provide the evidence needed to design segmentation, detect violations, and assess control effectiveness. Without them, security teams cannot confidently build or test enforcement decisions.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.