Zero trust identity controls are now foundational for access security

At a glance

What this is: This is an analysis of why zero trust identity controls now sit at the centre of access security, with identity verification, biometrics and passwordless access presented as the practical answer to stolen credentials and lateral movement.

Why it matters: It matters because IAM teams must treat verified identity as an access control input across human, NHI and adjacent trust chains, not as a login feature layered on top of a trusted perimeter.

Context

Zero trust identity controls are increasingly important because the old perimeter model assumes trust can be granted after one successful login. In cloud apps, remote work and supply-chain integrations, that assumption breaks quickly when stolen credentials or impersonated accounts can move laterally inside the environment.

For IAM practitioners, the governance problem is no longer just authentication strength at the edge. It is whether the organisation can continually prove who or what is accessing systems before access expands, especially where identity is the first and last control point.

The article frames this as a shift from perimeter trust to verified identity, with stronger authentication, biometric checks and passwordless access used to reduce the opportunities for account takeover and ransomware entry.

Key questions

Q: What breaks when organisations keep using perimeter-era trust assumptions?

A: Trust becomes location-based instead of identity-based, which creates blind spots across remote work, cloud services and connected devices. The result is a fragmented control model where some assets are verified continuously and others are trusted by default.

Q: Why do stolen credentials remain such an effective attack path?

A: Stolen credentials work because many systems still treat a successful login as enough evidence of legitimacy. Once an attacker has valid access, they inherit the subject’s trust context and can often blend in with normal activity. That makes credential theft far more efficient than direct exploitation in many environments.

Q: How should security teams use risk signals to reduce account takeover without adding friction for legitimate users?

A: Use risk based branching in the login or signup journey so high risk events trigger stronger verification while low risk users move through with minimal friction. Combine device, behavioural, and identity signals to decide when to step up authentication. The goal is to reduce fraud and takeover attempts without turning every session into the same high friction path.

Q: Should organisations view passwordless as a replacement for Zero Trust controls?

A: No. Passwordless can strengthen the authentication step, but Zero Trust still depends on continuous evaluation of device, user and context. If passwordless is deployed without those surrounding controls, it becomes a better login method rather than a broader trust model.

Technical breakdown

Why perimeter trust fails once identity is the entry point

A perimeter model assumes that once a user passes the front door, subsequent activity can be trusted by default. Zero trust rejects that premise and requires identity checks at the point of access and, in many designs, again as context changes. In practice, this matters because cloud services, remote access and third-party integrations create many more entry paths than a traditional network boundary can meaningfully contain. If authentication is weak or reused, a single compromised account can behave like a trusted user until the damage is done. The technical shift is from network trust to continuous identity verification and constrained session scope.

Practical implication: design access controls so identity proof is required before trust is extended, not after users are already inside.

How stolen credentials become lateral movement

Stolen credentials are effective because they convert one authentication event into broad access that can look legitimate. Phishing, breached-password reuse and account impersonation are common ways attackers obtain a valid login path, then use it to escalate privileges, access data or deploy ransomware. Zero trust limits the blast radius by making each request subject to stronger identity assurance and by reducing the assumption that a successful login equals a trusted session. This is not just an authentication problem. It is a session-containment and authorisation problem, because once the attacker acts as a real user, detection becomes harder unless the control model keeps checking the identity signal.

Practical implication: tighten session scope and step-up checks around sensitive actions, not just initial sign-in.

Why verified digital identity changes the control model

A verified digital identity changes access control because the system is no longer relying solely on a secret the user knows, such as a password. Instead, the identity proof is anchored in a stronger verification process, then reused across services as an authenticated claim. That can reduce password exposure, support passwordless journeys and improve resistance to synthetic or compromised credentials. From an identity architecture perspective, the important point is that verification becomes an upstream trust anchor for downstream access decisions. The control value comes from reducing the number of times the system must trust weak, reusable credentials at all.

Practical implication: treat reusable identity proof as a trust anchor and retire password-centric access paths where possible.

Threat narrative

Attacker objective: The objective is to gain trusted access that can be used to move laterally, abuse privileges and cause operational, financial or reputational damage.

1. Entry begins when attackers steal employee or customer credentials through phishing, password guessing or breached data.
2. Escalation follows as the attacker uses the compromised account to impersonate a trusted user and reach additional systems or data.
3. Impact occurs when the attacker deploys ransomware, steals information or commits fraud under the cover of a legitimate account.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity proof is now the control plane for access security: The perimeter has lost analytical value wherever cloud, remote work and third-party access dominate. Once a login can be stolen or replayed, the real control question becomes whether the organisation can verify the subject behind the session before privilege expands. For practitioners, this moves access security from network boundary design to identity assurance design.

Passwords create a trust debt that zero trust is meant to retire: Reusable credentials are an efficient attack primitive because they are easy to phish, buy and reuse at scale. That makes password-centric access models structurally misaligned with environments that depend on continuous trust decisions. The practitioner implication is to reduce the number of security decisions that depend on a shared secret surviving intact.

Verified identity is more useful when it is reusable and privacy-preserving: The article points to reusable digital identity and selective disclosure as a way to reduce friction while improving assurance. That combination matters because organisations rarely fail only on security or only on user experience. For identity teams, the question is whether verification can become a durable trust input without turning every access event into a data collection exercise.

Zero trust access controls are now a fraud and ransomware control, not just an IAM control: The attack paths described are not limited to compromise of IT systems. They also support impersonation, account takeover and fraud, which means access design has to serve security, privacy and abuse prevention together. Practitioners should read identity controls as a shared control surface across IAM, fraud and incident containment.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Identity assurance is becoming the practical trust boundary: Organisations that still treat sign-in as the end of the verification process are leaving lateral movement open by design. Zero trust programmes should move the trust decision closer to the identity signal and away from the assumption that network location implies legitimacy.

Passwords are increasingly the wrong centre of gravity: The article reinforces a broader governance shift away from reusable secrets and toward stronger identity proof. For practitioners, that means the programme question is not whether passwords are inconvenient, but where they remain the easiest route to account takeover.

Privacy-preserving verification can reduce both risk and friction: Selective disclosure and reusable identity credentials let teams ask for less data while improving assurance. That creates a better fit for customer-facing journeys where security, user experience and data minimisation all matter at once.

For practitioners

• Harden access around verified identity Require stronger identity proof before granting access to sensitive apps, admin functions and remote sessions. Replace reliance on usernames and passwords where the business can support a reusable identity signal instead of a weak shared secret.
• Reduce password dependence in high-risk journeys Prioritise passwordless or phishing-resistant authentication for workflows most likely to be targeted by phishing, account takeover and ransomware entry. Start with privileged, customer-facing or high-value access paths where compromise has the largest blast radius.
• Constrain session trust after sign-in Apply step-up checks, reauthentication triggers and tighter authorisation around sensitive actions so a successful login does not equal open-ended trust. This is especially important where cloud apps and remote access broaden the session footprint.
• Map external integrations to identity assurance Review supply-chain and partner connections as trust extensions, not just connectivity. For each integration, define what identity assurance is required before access is accepted and what should happen if the account signal degrades.

Key takeaways

• Zero trust identity controls matter because perimeter trust fails once stolen credentials can impersonate legitimate users inside cloud and remote environments.
• The article ties the main access risks to phishing, account takeover and ransomware, all of which exploit weak or reused identity signals.
• Practitioners should focus on verified identity, passwordless access and tighter session controls where compromise would create the largest blast radius.

Key terms

• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Reusable Digital Identity: Reusable digital identity is a model where verified attributes or credentials can be presented across multiple services without repeating the full proofing process. It improves usability, but it also requires strict rules for freshness, scope, and revocation so one stale assertion does not become widely trusted.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.