Zero trust access management still starts with secure identity

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Okta's blog post: Zero trust access management should start with secure identity, continuous verification, and context-aware access instead of a trusted internal network model.

Why it matters: It matters because IAM teams have to govern access decisions across humans, services, and hybrid environments where initial authentication alone no longer covers session risk.

Context

Zero trust access management is the discipline of deciding access from identity, device, context, and session state rather than from network location alone. The article’s core claim is that the modern perimeter has moved to secure identity, because hybrid work and cloud adoption make perimeter trust assumptions unreliable.

That matters for IAM because identity is now the control plane for both human users and non-human identities that access applications, APIs, and infrastructure. The article frames continuous verification as the practical answer to long-lived sessions, changing device posture, and risk that can emerge after login.

Key questions

Q: How should security teams implement zero trust access management across hybrid environments?

A: Start by centralizing identity, authentication, and policy decisions so access is evaluated consistently across cloud, on-prem, and SaaS resources. Then add context signals such as device posture, location, and session risk to decide whether access should continue, step up, or end. The goal is to make identity the control plane, not the network boundary.

Q: Why do long-lived sessions create a zero trust gap?

A: Because the initial authentication decision quickly becomes stale when device posture, location, or risk changes after login. A session that lasts for hours or days can outlive the conditions that made it acceptable, which means attackers only need to preserve the session rather than defeat the original sign-in. Continuous verification closes that gap by re-evaluating access during the session, not just before it.

Q: What breaks when non-human identities have standing access in a Zero Trust model?

A: Standing access breaks the core Zero Trust assumption that each request is explicitly evaluated. If service accounts or API keys keep broad rights indefinitely, the model cannot reduce blast radius or prevent reuse after compromise. The practical result is that governance shifts from continuous control to a one-time trust decision at creation time.

Q: When should organisations prioritise continuous authentication over broader access redesign?

A: When login sessions are long-lived, users move across devices, or risk can change after authentication. In those conditions, a full redesign may take time, but continuous authentication provides immediate risk reduction by making active sessions responsive to new signals. It is especially valuable where shared devices, mobile apps, or remote work make static trust assumptions weak.

Technical breakdown

Why secure identity becomes the zero trust starting point

Zero trust replaces the old assumption that anything inside the network is inherently trusted. In the article’s model, identity becomes the modern perimeter because access is no longer tied to a fixed location or a static corporate boundary. That changes IAM design from one-time authentication to policy-based access decisions that consider user, device, application, and context together. The architecture also has to cover employees, contractors, partners, and suppliers, which means access governance has to extend beyond the internal workforce. Continuous trust is therefore not a slogan. It is the operating model that makes distributed access governable.

Practical implication: anchor zero trust design in identity policy and session controls, not in perimeter tools alone.

How continuous verification changes session governance

The article highlights a basic failure mode in traditional access control: authentication happens once, but risk changes after the session starts. A stolen device, shared workstation, or altered risk signal can make an otherwise valid session unsafe while it remains active. Continuous verification means the identity provider keeps reassessing the session and can trigger re-authentication or end the session when posture changes. This is materially different from static sign-in checks because the control is now coupled to the session lifecycle rather than the login event. That is why long-lived sessions on mobile and cloud apps are a governance problem, not just an authentication problem.

Practical implication: define which sessions require ongoing risk evaluation and which events should force re-authentication or termination.

Why the control model must include NHI and infrastructure access

The article does not treat identity as only a human problem. It explicitly notes that processes can act on their own to access data, and it includes APIs and infrastructure in the zero trust scope. That matters because service accounts, workloads, and automated access paths often escape the same governance that human logins receive. When access spans apps, servers, and cloud resources, identity controls need inventory, policy, and lifecycle discipline across every actor type. Otherwise zero trust becomes a human-only policy layered on top of unmanaged machine access, which leaves the highest-volume access paths outside the model.

Practical implication: extend zero trust governance to service accounts, APIs, and infrastructure identities with the same rigor used for users.

Threat narrative

Attacker objective: The objective is to gain durable access through identity rather than the perimeter and use that access to reach data or move laterally.

1. Entry occurs when attackers exploit credential abuse or highly targeted phishing to obtain an authenticated session or identity foothold.
2. Privilege expansion follows when fragmented identity systems, weak lifecycle discipline, or over-trusted sessions leave access paths open across applications and infrastructure.
3. Impact occurs when the attacker uses the surviving session or access path to reach data, account surfaces, or lateral movement opportunities that zero trust was meant to restrict.

Breaches seen in the wild

• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.
• Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity is the control plane, not an adjacent control. Zero trust access management only works when identity is the primary trust anchor for people, workloads, and service access. Perimeter tools can still reduce exposure, but they cannot decide whether a session should continue when risk changes mid-session. Practitioners should treat identity policy as the place where zero trust becomes enforceable.

Session governance is the real zero trust test. The article’s strongest operational point is that authentication at the gate is not enough when sessions last for hours, days, or weeks. That shifts the governance question from who signed in to whether the session should still exist under current context. Teams that cannot terminate or step up sessions in response to posture changes are running partial zero trust, not continuous verification.

Zero trust exposes the gap between human IAM and machine access. The article explicitly includes processes that act on their own, which means service accounts and infrastructure identities belong in the same trust model as users. This is where many programmes fracture: human identity gets MFA and SSO, while non-human access remains under-governed. The implication is a single access architecture with different control patterns by actor type, not separate trust stories.

Continuous trust is the named concept that replaces static trust. In this article’s terms, secure identity is not a one-time credential event but a constantly reassessed state. That concept matters because it reframes zero trust from perimeter elimination to trust recalibration across the session lifecycle. For practitioners, the policy question is no longer whether access was valid at login, but whether it remains valid right now.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Identity Security Programme Guide

What this signals

Continuous trust: The article’s core architectural shift is away from one-time authentication and toward ongoing trust reassessment across the session lifecycle. That is the practical breakpoint for zero trust programmes, because access control now has to react to changing context instead of assuming the sign-in decision remains valid.

Identity programmes should now be judged on whether they can terminate, step up, or re-evaluate sessions when posture changes. If a team can secure login but cannot govern what happens after login, it has not yet moved to a true zero trust operating model.

For practitioners

• Consolidate identity into a single access policy plane Bring users, contractors, partners, and suppliers under a governed IAM layer so access decisions are consistent across cloud and on-prem resources.
• Implement continuous session checks Use risk signals from device posture, location, and user state to reassess active sessions and trigger re-authentication or termination when conditions change.
• Extend zero trust to non-human identities Inventory service accounts, APIs, and infrastructure identities, then align their authentication and lifecycle controls with the same access governance used for people.
• Reduce trust in long-lived sessions Set policy for high-risk applications so dormant or unusually persistent sessions are revalidated rather than assumed safe until logout.

Key takeaways

• Zero trust access management only becomes operational when identity, context, and session state are governed together.
• Long-lived sessions are the point where static trust assumptions fail and continuous verification becomes necessary.
• Non-human identities must sit inside the same trust model as users, or zero trust coverage remains incomplete.

Key terms

• Zero Trust Access Management: Zero Trust access management is the practice of making every access decision explicit, contextual, and continuously reassessed. It replaces blanket trust in a network zone with identity, device, and risk-based policy that can change during a session. In mature programmes, it governs both human and non-human actors.
• Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.
• Context-Aware Access Review: A decision process that evaluates access requests using request intent, existing entitlements, resource sensitivity, and operational evidence. In identity programmes, it reduces blind approvals by forcing reviewers or automation to weigh the real circumstances behind the request, not just the ticket itself.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.