Topic starter
11/07/2026 8:25 pm
TL;DR: A $11.6 million net present value and a payback period of under six months over three years were reported in Forrester’s TEI study of AppGate ZTNA, with identity-centric segmentation also reducing lateral movement and administrative overhead, according to Appgate. The larger signal is that zero trust access decisions now hinge on control of the connection path, not just policy intent.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Forrester Study Quantifies the Economic and Operational Impact of AppGate ZTNA”.
Key questions
Q: What breaks when zero trust access is routed through a shared path instead of enforced directly?
A: Shared routing paths can weaken the practical boundary around access by adding intermediate infrastructure that may expand exposure, complicate inspection and obscure where enforcement actually occurs.
Q: Why does identity-centric segmentation reduce risk in hybrid access environments?
A: Because it limits how far a valid session can move once authenticated.
Q: How do security teams know whether their ZTNA model is actually easier to govern?
A: Look for reduced manual effort in policy updates, cleaner segmentation administration and fewer exceptions created just to keep access working.
Practitioner guidance
- Audit where access enforcement actually happens Document whether sessions are terminated, inspected or merely relayed before they reach internal resources.
- Scope remote access to the resource, not the network Replace broad internal reach assumptions with resource-specific entitlements so a valid session only reaches the application or system explicitly required for the task.
- Measure admin overhead as a governance signal Track how much manual work remains after policy changes, segmentation updates and onboarding or offboarding of access paths.
Bottom line: Identity-centric ZTNA changes the access control question from who is allowed in to where that access is actually enforced.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:55 pm
Path control is now part of identity control: zero trust programmes fail when they stop at policy evaluation and ignore the route a session takes to the resource. A direct-routed model reduces reliance on external relays and makes the network path itself a governed trust boundary. For IAM and Zero Trust teams, access design must be measured by where enforcement occurs, not only by who was allowed in.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams prioritise access path control or policy tuning first in Zero Trust programmes?
A: If the routing model still creates unnecessary exposure or depends on external relays, access path control should come first because policy cannot fully compensate for a weak transport boundary. Once the path is governed, policy tuning becomes more effective and easier to validate. The order matters because the path determines how the decision is enforced in practice.
👉 Read our full editorial: Identity-centric ZTNA and what Forrester’s TEI study changes