Zero trust as the operating model for digital trust

At a glance

What this is: This is a DigiCert blog arguing that zero trust is the operating model that makes digital trust possible by requiring continuous verification of access requests.

Why it matters: It matters because IAM, PAM and identity architecture teams must treat trust as an outcome of ongoing verification across humans, devices and software, not as a perimeter assumption.

By the numbers:

• 96% of IT security executives believe that PKI is essential to building a zero-trust architecture.

Context

Zero trust is an access model, not a product category: it requires every request to be verified before trust is granted. In this article, DigiCert frames that model as the mechanism that supports digital trust across users, software, devices and documents.

The identity governance problem is broader than login security. Organisations now need consistent trust decisions across human users, non-human identities and connected endpoints, because the old perimeter assumption no longer matches how work and data move.

Key questions

Q: How should organisations use identity governance and administration to support Zero Trust without creating administrative drag?

A: Organisations should treat identity governance and administration as a control plane for access decisions, not just a compliance layer. The practical goal is to automate joiner mover leaver workflows, enforce least privilege, and maintain audit-ready approvals while keeping policy consistent across cloud and on premises systems. When governance is policy driven and continuously updated, Zero Trust becomes operational rather than aspirational.

Q: Why do PKI and certificate management matter to zero trust programmes?

A: Because certificates are part of the proof that a user, device or service is legitimate, and they also protect the communications that carry that proof. If certificate lifecycle governance is weak, the zero-trust model inherits unreliable identity evidence and inconsistent trust decisions.

Q: What breaks when organisations keep using perimeter-era trust assumptions?

A: Trust becomes location-based instead of identity-based, which creates blind spots across remote work, cloud services and connected devices. The result is a fragmented control model where some assets are verified continuously and others are trusted by default.

Q: Who should own zero trust and digital trust governance?

A: Ownership should sit across identity security, infrastructure, and risk, with clear accountability for the trust controls that span them. Human IAM, NHI governance, and certificate lifecycle management cannot be governed as separate programmes if the business relies on a single trust posture. Shared accountability is the only durable model.

Technical breakdown

Adaptive authentication replaces perimeter trust

Zero trust treats each access attempt as a fresh decision, rather than assuming trust because a request comes from a known network location. In practice, the article points to PKI, MFA and SSO as the mechanisms that let organisations verify identity repeatedly and more contextually. That matters because digital trust depends on proving identity at the moment access is requested, not just at onboarding. The architecture also widens the scope beyond people to devices, software and documents, which is where many IAM programmes still have inconsistent control coverage.

Practical implication: align access policy to request-time verification, not network location or one-time authentication.

PKI is the trust layer that binds identities to systems

PKI is presented as the underlying trust fabric because it provides authentication, integrity and encryption for connected systems. In identity terms, certificates let organisations prove that a user, device or system is what it claims to be, while also protecting communications in transit. That makes certificate governance part of identity governance, not just a cryptography task. When PKI is weak, trust degrades across the entire access path because the proof mechanism itself becomes unreliable.

Practical implication: manage certificate issuance, renewal and validation as core identity controls, not as isolated infrastructure tasks.

Digital trust extends beyond users to connected content

The article expands trust beyond human authentication to include software, servers, devices, digital content and documents. That matters because access control alone does not create trust if the thing being accessed cannot be verified or if the object itself can be manipulated. This is where identity and trust programmes intersect with supply chain assurance, document integrity and device trust. The governance challenge is to maintain a consistent verification model across objects that behave differently but still participate in the same digital transaction.

Practical implication: inventory which non-user assets participate in trust decisions and define verification controls for each class.

NHI Mgmt Group analysis

Digital trust is becoming an identity governance outcome, not a branding term. The article is correct to tie digital trust to zero trust because trust now depends on continuously verifiable identity signals across humans, machines and content. That means IAM and NHI governance teams should stop treating trust as a static state and manage it as an enforced verification pattern across every access path.

PKI is not just enabling technology, it is identity evidence. When certificates prove identity and protect communications, certificate lifecycle management becomes part of the trust model itself. Organisations that separate certificate operations from IAM governance create blind spots in the control plane, especially when access spans endpoints, software and documents.

Zero trust exposes the limits of perimeter-era governance assumptions. Traditional models assume that a known location or authenticated session is sufficient for trust. That assumption no longer holds when access is distributed across cloud services, remote users and connected devices, so policy must move closer to the request and the asset being accessed.

Named concept: digital trust control plane. The article points to a broader control plane in which authentication, certificate governance, compliance and connected-asset verification all contribute to trust. Practitioners should recognise that this is not a single control but a cross-domain operating model that spans IAM, NHI and device trust.

For identity programmes, zero trust only works when trust checks are consistent across actor types. If humans are verified with MFA and SSO while service accounts and devices remain loosely governed, the programme creates asymmetric trust. The result is a control environment that looks coherent on paper but is fractured in practice.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Standards

What this signals

Digital trust is the broader governance layer, while zero trust is the enforcement model underneath it. For practitioners, that means access policy, certificate lifecycle and asset verification need to be designed together instead of managed as separate programmes. The more connected the environment becomes, the more those controls need a single trust logic.

Identity programmes should now assume that trust spans more than human login journeys. When software, devices and documents participate in business processes, the governance model has to classify and verify those assets with the same seriousness applied to user access. That is where zero trust moves from architecture language into operational identity design.

For practitioners

• Map trust decisions across actor types Document where humans, service accounts, devices, software and documents enter trust decisions, then align the control owner for each path.
• Treat PKI as identity infrastructure Place certificate issuance, renewal, revocation and validation under the same governance discipline used for other identity credentials.
• Replace network-based trust assumptions Remove policies that grant confidence because a request came from a known IP range, subnet or internal location.
• Extend verification to non-user assets Define how software, devices and documents are authenticated, validated and monitored inside the trust model.

Key takeaways

• Digital trust depends on continuous verification, not on inherited confidence from a network boundary or a one-time login.
• PKI is central because it supplies the identity evidence and communication integrity that zero trust relies on.
• IAM teams should extend governance beyond users to devices, software and documents, or the trust model remains incomplete.

Key terms

• Digital Trust: Digital trust is the set of cryptographic and identity controls that allow systems, users, and services to verify each other reliably. It includes PKI, federation, certificates, and authentication foundations that must remain adaptable as technologies and threat conditions change.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Public Key Infrastructure: Public Key Infrastructure is the trust system that issues, manages, and revokes digital certificates used to prove identity. In practice it binds keys to entities and policies, making authentication, encryption, and non-repudiation possible across users, devices, and services.
• Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.