TL;DR: Zero trust fails in practice when organisations cannot see unmanaged, transient or shadow devices, because asset intelligence is what turns continuous verification into enforceable access policy, according to Lansweeper. Device discovery, classification and context must move ahead of trust decisions if zero trust is to work beyond theory.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Lansweeper's blog post: Zero trust cannot be enforced reliably when organisations lack continuous visibility into the devices, workloads and shadow assets requesting access.
Why it matters: IAM, NHI and broader security teams need asset intelligence because trust decisions fail when unknown devices sit outside policy, monitoring and lifecycle control.
By the numbers:
- The top 35 global data breaches in 2024 exposed more than 5.4 billion records, according to Forrester analysis cited by Lansweeper.
Context
Zero trust depends on continuous verification, which only works when the organisation knows what is connecting, from where, and under which trust context. In hybrid environments, the weak point is often not authentication itself but incomplete asset awareness, especially where unmanaged endpoints, cloud workloads and IoT devices sit outside central control.
In practice, device visibility is the missing governance layer between identity policy and enforcement. A zero trust identity guide is only operational when discovery, classification and monitoring keep pace with device churn, transient access and shadow IT.
This is not a niche problem. Most enterprise environments now contain a mix of managed and unmanaged assets, so the starting position for visibility-led zero trust is typical rather than exceptional.
Key questions
Q: How do I discover unknown devices in a zero trust programme?
A: Use continuous asset discovery across endpoints, servers, cloud workloads, IoT and OT assets, then reconcile those findings with your authoritative inventory. Unknown devices are a trust problem because they cannot be evaluated for posture, ownership or compliance. Zero trust cannot enforce policy reliably until discovery coverage is broad enough to identify what is actually requesting access.
Q: Why do unmanaged devices complicate zero trust access decisions?
A: Because zero trust depends on continuous verification, and unmanaged devices weaken the confidence you can place in the session context. If the device cannot be assessed or controlled, identity alone is not enough to justify broad access. Teams need posture-aware policy, not just stronger authentication.
Q: How should teams measure zero trust readiness for device visibility?
A: Measure zero trust readiness for device visibility by checking whether every device is continuously identified, inventoried, posture-assessed, and tied to a trusted policy decision before access is granted. Strong programmes combine device discovery, endpoint posture checks, certificate-based device authentication, and telemetry from EDR, MDM, or NAC so unknown, unmanaged, or non-compliant devices are quarantined or denied access.
Technical breakdown
Why unknown devices break zero trust enforcement
Zero trust assumes every access request can be evaluated against a known principal, device state and policy context. When a device is unknown, the policy engine lacks the inputs needed to score risk or apply conditional access with confidence. That creates a control gap even if identity authentication is strong. In hybrid estates, the issue is not just unauthorised access but unverifiable access, which is harder to detect because it often looks like normal traffic until policy enforcement fails.
Practical implication: Treat unknown device discovery as an enforcement prerequisite, not an inventory cleanup task.
Continuous discovery versus point-in-time inventory
A point-in-time inventory records what existed during a scan, while continuous discovery tracks what exists now. That difference matters because devices move, reimage, fall out of management or appear through contractor and shadow IT channels. In zero trust, stale inventory creates false confidence: a device that was compliant yesterday may be unmanaged today. Continuous classification lets teams attach posture, ownership and location context to each access decision, which is what makes policy adaptive rather than static. See the Attack Surface Management Guide.
Practical implication: Use continuous discovery to keep trust decisions aligned to current device state, not last week’s scan.
How asset context feeds identity and access decisions
Asset context gives identity policy the evidence it needs to decide whether an access request is acceptable. Device posture, ownership, update state and location can all influence whether access is granted, challenged or denied. This is especially important for contractors, remote users and transient devices, where identity alone does not reveal enough about trustworthiness. Zero trust becomes operational when device intelligence informs the policy layer instead of sitting in a separate reporting stack. Read Zero Trust for AI Agents.
Practical implication: Integrate asset context into access policy so that device posture shapes authorisation in real time.
Threat narrative
Attacker objective: Use invisible or unmanaged devices to reach internal resources through gaps in trust enforcement and monitoring.
- Entry occurs through unmanaged, shadow or transient devices that connect without being captured in the authoritative inventory.
- Credential or session controls then face an unknown endpoint, so the trust engine cannot reliably distinguish legitimate from risky access.
- Escalation happens when policy gaps allow the device to continue accessing internal resources without continuous verification.
- Impact is policy failure at scale, with blind spots that expand the blast radius of compromise and reduce containment confidence.
Breaches seen in the wild
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Device visibility is the control that converts zero trust from a policy statement into an enforceable operating model. Identity verification alone cannot compensate for an unknown endpoint, unmanaged workload or shadow asset. In hybrid environments, the policy engine can only act on what discovery has surfaced and classified, so asset intelligence becomes part of governance rather than a separate hygiene task.
Continuous visibility matters more than inventory completeness at a single point in time. Devices change state faster than annual audits or periodic scans can capture, which means the trust boundary is moving continuously. That makes stale inventory a governance failure, not a reporting issue, and it explains why discovery, classification and verification must be treated as one control loop.
Zero trust programmes now depend on a visibility-first trust model. The named concept is simple: trust cannot be evaluated for what cannot be seen. For practitioners, that means policy design, CMDB accuracy and enforcement telemetry have to be built around continuous asset context, not just user identity.
Shadow assets are now a zero trust governance problem, not merely an operations problem. Unmanaged laptops, IoT devices, OT assets and cloud workloads all create inconsistent enforcement when they sit outside the inventory. The practical conclusion is that zero trust maturity rises or falls on the organisation's ability to bring every device class into scope.
The article shows that zero trust failures often begin with a visibility gap rather than a credential gap. That shifts the governance assumption: the hardest problem is no longer proving who the user is, but knowing what device is asking, whether it is managed, and whether it should be trusted at all. Practitioners should therefore measure readiness by discovery coverage and enforcement consistency, not by authentication coverage alone.
From our research library:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
- Read next: Zero Trust Identity Guide
What this signals
Visibility-first zero trust will become the default governance model for hybrid estates because authentication alone cannot compensate for unmanaged devices. When asset intelligence is missing, the control failure is not in the identity provider but in the policy layer that has no reliable device context to act on.
Shadow devices are the new enforcement boundary. As cloud, remote work and IoT expand the estate, security teams will need to treat discovery coverage as a programme metric, not a technical convenience. That pushes visibility into the same strategic category as least privilege and continuous verification.
Policy teams should expect zero trust maturity discussions to shift from architecture diagrams to operational evidence: what was discovered, what remains unknown, and how quickly the unknowns are reduced.
For practitioners
- Build a continuously updated asset inventory Map endpoints, servers, cloud workloads, IoT and OT assets into a single source of truth and keep it updated through automated discovery.
- Tie access policy to device posture Use compliance state, patch level, ownership and location to decide whether a device receives access, step-up verification or denial.
- Reconcile CMDB records with live discovery Compare configuration records against current network observations so stale or missing assets do not silently bypass zero trust controls.
- Extend zero trust scope to unmanaged devices Include contractor endpoints, BYOD devices and transient cloud resources in discovery and enforcement workflows instead of treating them as exceptions. Read Zero Trust for AI Agents.
- Use visibility metrics as readiness KPIs Track discovery coverage, unknown-device rate and enforcement gaps so leadership can judge whether zero trust is actually operating, not just planned.
Key takeaways
- Zero trust breaks when organisations cannot see the devices that are asking for access, because unknown assets make policy enforcement inconsistent.
- Continuous discovery and classification are more important than point-in-time inventory in hybrid environments where devices change state quickly.
- Practitioners should judge zero trust maturity by discovery coverage, enforcement consistency and the size of the unknown-device population.
Related NHI Mgmt Group resources: Attack Surface Management Guide · Zero Trust Identity Guide · NIST SP 800-207 Zero Trust Architecture Guide · Zero Trust for AI Agents
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventoried | Zero trust readiness here depends on knowing what devices and systems are actually present. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Device context must inform authorisation decisions when unknown assets request access. | |
| DE.CM-01 — Networks and network services monitored | Continuous visibility depends on monitoring that detects unmanaged or transient devices. | |
| Recommendation — Inventory devices continuously so zero trust policies are based on live asset knowledge. Use device posture and ownership to govern access permissions in real time. Monitor network activity to surface unknown devices and enforcement gaps quickly. | ||
| CIS Controls v8 | CIS-1 — Enterprise Asset Inventory | Asset inventory is the central control problem in the Lansweeper analysis of zero trust failure. |
| CIS-6 — Access Control Management | Access control becomes unreliable when unmanaged devices sit outside governance. | |
| Recommendation — Maintain a complete enterprise asset inventory and keep it synchronised with discovery. Restrict access to assets whose device status and ownership are known and current. | ||
| NIST SP 800-53 Rev 5 | CM-8 — System Component Inventory | System inventory is directly relevant to discovering and tracking the devices in scope for zero trust. |
| AC-2 — Account Management | Account governance depends on accurate asset context when devices are unmanaged or transient. | |
| Recommendation — Keep an authoritative system component inventory aligned to continuous discovery. Bind account governance to device context so unmanaged endpoints do not bypass policy. | ||
| MITRE ATT&CK | TA0007;TA0008 — Discovery; Lateral Movement | Unknown devices enable discovery and lateral movement because they sit outside effective policy control. |
| Recommendation — Map unmanaged-device blind spots to discovery and lateral movement techniques in detection planning. | ||
| OWASP Non-Human Identity Top 10 | NHI-06 — Insecure Cloud Deployment Configurations | Cloud workloads and shadow assets are part of the discovery problem that weakens zero trust enforcement. |
| Recommendation — Audit cloud asset coverage and remove unmanaged deployment gaps from zero trust scope. | ||
Key terms
- Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
- Device visibility: Device visibility is the organisation’s ability to discover, classify, and continuously track the assets connected to its environment. In segmentation programmes, visibility is not just monitoring. It is the input that determines whether policies are precise, complete, and safe to enforce.
- Asset Intelligence: Asset intelligence adds context to discovery by classifying what an asset is, how it behaves and why it matters. It turns a raw list of assets into operationally useful information for prioritisation, segmentation and response.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity governance to operational security decisions across modern environments.
Published by the NHIMG editorial team on November 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org