Zero trust adoption is outpacing implementation across enterprises

At a glance

What this is: Ordr summarises third-party 2026 data showing a wide zero trust execution gap, with broad strategic support but limited full implementation across enterprises.

Why it matters: It matters because identity, access, and policy teams are being asked to operationalise zero trust across multiple systems, where fragmented enforcement can undermine both human and non-human access governance.

By the numbers:

• 82% of organizations consider universal zero-trust network access essential, but only 17% have fully implemented it.
• Tool and vendor sprawl is the top barrier to zero trust adoption, cited by 26% of organizations.
• 78% of organizations manage secure-access policies across more than two separate systems.
• Organizations with zero trust reduced breach costs by an average of $1.76 million per incident.

Context

Zero trust only becomes real when access policy, identity assurance, and enforcement are aligned across the systems that actually grant access. The article describes a common governance gap: many organisations endorse the model, but policy sprawl, legacy constraints, and fragmented tooling keep implementation partial rather than continuous.

For IAM and NHI programmes, the relevant question is not whether zero trust is strategically accepted, but whether it can be enforced consistently for humans, services, and third parties. Where policy sits across multiple consoles, identity governance weakens and privileged access decisions become harder to audit, especially in hybrid and cloud-heavy environments.

Key questions

Q: What breaks when zero trust policies are split across multiple tools?

A: Zero trust breaks down when policy decisions are fragmented across different consoles because enforcement becomes inconsistent, auditability weakens, and exceptions multiply. The organisation may still have good controls in parts of the stack, but the model no longer behaves as a single access boundary. That is when attackers and insiders benefit from gaps between systems.

Q: Why do excessive permissions create so much risk in Zero Trust programmes?

A: Excessive permissions expand the number of paths an attacker can use after the first compromise. Zero Trust reduces trust in the network, but it does not help if an identity can already reach too many systems. Overprivilege turns every identity event into a potential lateral movement opportunity.

Q: How do organisations know if zero trust controls are actually working?

A: They know the controls are working when they can inventory privileged identities, prove access is time-bound, and show that rotation and revocation happen on schedule. A healthy programme also has few manual exceptions and low workflow friction, because recurring bypasses are a sign that policy and operations are out of sync.

Q: How should organisations sequence zero trust when third-party access is a major risk?

A: They should start with the access paths that are easiest to isolate and most exposed to external users, usually contractor and supplier access. That approach gives the programme a measurable boundary, reduces broad network exposure, and forces governance decisions to become operational before the rest of the architecture is modernised.

Technical breakdown

Why zero trust fails when policy enforcement is fragmented

Zero trust is an operating model that assumes access must be continuously verified, not once granted and then trusted. In practice, that means identity, device posture, segmentation, and application access decisions have to be applied consistently at the point of enforcement. When policies live in separate tools, the architecture still exists on paper, but enforcement becomes uneven, exceptions accumulate, and the model degrades into disconnected controls rather than one control system.

Practical implication: Consolidate the enforcement path so identity and access decisions are applied the same way across remote, cloud, and third-party access.

What tool sprawl changes for human and non-human identity governance

Tool sprawl is not just an operational nuisance. It creates competing sources of truth for who or what can access a resource, which is especially risky when machine identities, third-party accounts, and privileged users are governed in different systems. A zero trust design needs policy coherence across IAM, PAM, and workload access patterns, or else NHIs can retain access longer than intended while human access is more tightly reviewed.

Practical implication: Map every access control point that can grant persistent or delegated access and eliminate duplicated policy ownership.

Why ZTNA becomes the practical starting point

ZTNA is often the first visible zero trust control because it replaces broad network reachability with application-scoped access decisions. That matters in environments where remote users, contractors, and third parties create the highest near-term exposure. But ZTNA is only a starting control. Without identity governance, privilege reduction, and segmentation behind it, access shifts from one channel to another instead of shrinking the attack surface in a durable way.

Practical implication: Use ZTNA as an access-control entry point, then connect it to privilege governance and segmentation so the policy boundary holds after initial rollout.

Threat narrative

Attacker objective: The attacker objective is to exploit inconsistent access governance to move from initial entry to overbroad system reach before controls converge.

1. Entry occurs through broad access pathways such as VPN-style connectivity or inconsistent third-party access controls when zero trust enforcement is incomplete.
2. Escalation follows when excessive access privileges or duplicated policies allow users and services to reach systems beyond their intended scope.
3. Impact emerges as fragmented enforcement increases exposure to breaches, slower response, and higher incident cost despite an organisation claiming zero trust maturity.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero trust has moved from architecture to governance problem: the limiting factor is no longer conceptual acceptance but whether access policy can be enforced consistently across identity, network, cloud, and third-party channels. Where control ownership is split across multiple systems, organisations do not have one zero trust model, they have several partial ones. Practitioners should treat policy coherence as the core programme objective.

Tool sprawl creates a policy integrity gap: when 78% of organisations manage secure-access policies across more than two systems, the risk is inconsistent enforcement, not just operational duplication. That fragmentation is especially damaging for IAM and NHI programmes because machine identities often sit outside the manual review patterns used for human users. Practitioners should treat unified policy enforcement as a governance requirement, not a platform preference.

Zero trust without privilege reduction is only perimeter reshaping: the article’s own adoption data shows that organisations still struggle with excessive access privileges even when they claim zero trust intent. That tells us the operating model is being adopted faster than the entitlement discipline behind it. Practitioners should align zero trust with PAM, lifecycle control, and entitlement cleanup or the model remains cosmetic.

Access-first programmes reveal where the market is going: the growth in ZTNA and the emphasis on third-party access show that organisations want narrow, application-scoped control points before they modernise everything else. That signals a pragmatic market shift toward incremental enforcement rather than big-bang redesign. Practitioners should use that pattern to sequence rollout around the highest-risk access paths first.

Named concept: access enforcement fragmentation: this is the condition where zero trust logic is distributed across disconnected tools, producing uneven decisions and weak auditability. It is the practical failure mode behind many stalled programmes, because the organisation believes it has adopted zero trust while access decisions still vary by console. Practitioners should measure whether a single access decision can be explained end to end across systems.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Access enforcement fragmentation: the practical risk is not whether zero trust is accepted, but whether access decisions remain consistent once they pass through multiple tools and owners. For IAM and NHI programmes, that means every additional policy engine increases the chance of drift unless the control boundary is explicitly governed.

The market data suggests practitioners will keep prioritising access-first use cases, especially for third parties and remote users, because those are the easiest places to prove control value. The next step is not broader jargon, but cleaner entitlement governance, tighter policy ownership, and better auditability across the full access chain.

For practitioners

• Consolidate access policy ownership Assign one operating owner for access policy across IAM, PAM, ZTNA, and segmentation controls so that changes propagate consistently.
• Prioritise third-party access first Use contractors, suppliers, and external partners as the first rollout group because their access paths are usually easier to isolate and measure.
• Reduce duplicate enforcement points Inventory every system that can approve or enforce access and retire redundant policy logic that creates conflicting decisions.
• Tie zero trust to entitlement cleanup Review privileged and standing access alongside zero trust rollout so the model does not simply wrap old entitlements in a new access layer.
• Measure whether policies stay consistent Track whether the same user, device, or service receives the same access outcome across channels, especially where cloud and legacy systems intersect.

Key takeaways

• Zero trust is now widely accepted, but many organisations still lack the control coherence needed to enforce it consistently across real access paths.
• The article’s data points to policy fragmentation, excessive privileges, and third-party exposure as the practical reasons implementation lags strategy.
• For practitioners, the priority is to align access enforcement, entitlement governance, and policy ownership before adding more zero trust tooling.

Key terms

• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Zero Trust Network: A Zero Trust Network is a network security approach that does not trust users, devices, or traffic by default. Every connection is continuously verified using identity, device posture, context, and policy before access is granted. It assumes breach, limits lateral movement, and treats network access as conditional rather than implicit.
• Policy Sprawl: The fragmentation that happens when access rules, token settings, and logging controls are managed separately across many destinations. For workloads, it often creates inconsistent enforcement, incomplete audit trails, and revocation gaps that only become visible after an incident or review.
• Privilege Drift: Privilege drift is the gradual gap between the permissions an identity was meant to have and the permissions it actually retains. In AI agent environments, drift grows quickly because roles are reused, tasks change, and lifecycle reviews often lag behind deployment velocity.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and workload identity. It helps security, IAM, and cloud teams connect identity controls to broader access and enforcement decisions.