Topic starter
11/07/2026 8:25 pm
TL;DR: $11.6 million in net present value shows the operational case for identity-centric ZTNA, according to Appgate's case work in Forrester's TEI study. Direct-routed enforcement means Zero Trust teams have to govern the connection path itself, not policy intent alone.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Forrester Study Quantifies the Economic and Operational Impact of AppGate ZTNA”.
Key questions
Q: Why does identity-centric segmentation reduce risk in hybrid access environments?
A: Because it limits how far a valid session can move once authenticated.
Q: How do security teams know whether their ZTNA model is actually easier to govern?
A: Look for reduced manual effort in policy updates, cleaner segmentation administration and fewer exceptions created just to keep access working.
Q: What breaks when zero trust access is routed through a shared path instead of enforced directly?
A: Shared routing paths can weaken the practical boundary around access by adding intermediate infrastructure that may expand exposure, complicate inspection and obscure where enforcement actually occurs.
Practitioner guidance
- Audit where access enforcement actually happens Document whether sessions are terminated, inspected or merely relayed before they reach internal resources.
- Scope remote access to the resource, not the network Replace broad internal reach assumptions with resource-specific entitlements so a valid session only reaches the application or system explicitly required for the task.
- Measure admin overhead as a governance signal Track how much manual work remains after policy changes, segmentation updates and onboarding or offboarding of access paths.
Bottom line: Identity-centric ZTNA changes the access control question from who is allowed in to where that access is actually enforced.
Glossary terms: Identity Centric ZTNA, Direct-Routed Access, Identity-centric segmentation, Path control
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 46 minutes ago by NHI Mgmt Group
11/07/2026 8:55 pm
Path control is now part of identity control: zero trust programmes fail when they stop at policy evaluation and ignore the route a session takes to the resource. A direct-routed model reduces reliance on external relays and makes the network path itself a governed trust boundary. For IAM and Zero Trust teams, access design must be measured by where enforcement occurs, not only by who was allowed in.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams prioritise access path control or policy tuning first in Zero Trust programmes?
A: If the routing model still creates unnecessary exposure or depends on external relays, access path control should come first because policy cannot fully compensate for a weak transport boundary. Once the path is governed, policy tuning becomes more effective and easier to validate. The order matters because the path determines how the decision is enforced in practice.
👉 Read our full editorial: Identity-centric ZTNA and what Forrester’s TEI study changes