Topic starter
02/08/2026 12:06 pm
TL;DR: Manual reconciliation is becoming the bottleneck in zero trust inventory, according to Tonic, when applications, datasets, owners, and dependencies cannot be kept current. Continuous discovery has to feed enforcement and ownership checks in near real time for the control model to stay usable.
Editorial analysis by NHI Mgmt Group, based on content published by Tonic: “A CISO’s Reality: Discovery is Where Zero Trust Programs Quietly Die”.
Key questions
Q: Why does fragmented inventory create risk in zero trust programmes?
A: Fragmented inventory creates risk because controls inherit whatever uncertainty exists in the system of record.
Q: How do security teams know whether a discovery programme is actually working?
A: Look for evidence that the programme covers the full estate, refreshes its baseline regularly, and produces a manageable rate of validated findings rather than alert noise.
Q: What breaks when zero trust discovery is not in place?
A: Zero Trust stalls when teams cannot describe applications, datasets, owners, and dependencies with enough confidence to enforce policy.
Practitioner guidance
- Instrument discovery as a continuous control Move discovery out of quarterly cleanup cycles and into a standing workflow that revalidates applications, datasets, services, and owners as the environment changes.
- Reconcile ownership from evidence, not memory Use tickets, runbooks, change records, and on-call rotations to confirm who owns each application or service when the CMDB disagrees or is stale.
- Link inventory to enforcement decisions Tie authoritative inventory updates to segmentation, access tightening, and data policy enforcement so controls only move when ownership and dependency confidence are high.
Bottom line: Zero Trust inventory fails when the organisation cannot maintain reliable, current context about applications, datasets, owners, and dependencies.
Glossary terms: Agentic discovery, Discovery Trust Gap, Authoritative inventory, Continuous validation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:11 pm
Discovery truth gap: Zero Trust fails first at the point of inventory truth, not at the point of policy design. If applications, datasets, and owners cannot be described consistently across systems, every downstream enforcement decision starts from uncertainty. Practitioners should treat unreliable source-of-truth data as a governance defect, not an administrative inconvenience.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What role should human confirmation play in agentic discovery?
A: Human confirmation should handle uncertain cases, not every case. Agentic discovery should gather evidence from operational sources, propose the most likely owner or dependency chain, and then route only low-confidence findings for approval. That keeps the loop fast without turning inventory governance into blind automation.
👉 Read our full editorial: Agentic discovery turns zero trust inventory into a continuous control