Topic starter
22/09/2026 3:43 pm
TL;DR: Hybrid work, unmanaged devices, and public networks make point-in-time perimeter security unreliable, according to Cato Networks. The operational challenge is not just where work happens, but whether identity, device posture, and context are governed uniformly, and consistent Zero Trust enforcement across users, devices, and applications is now required to reduce policy gaps and exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Cato Networks: “When the Enterprise Edge Is Everywhere, Security Must Be Too”.
Key questions
Q: What breaks when zero trust controls are not enforced consistently across every edge?
A: Zero trust breaks down when the same identity and risk signal produces different outcomes depending on the access path.
Q: Why do remote and unmanaged devices increase the risk of policy gaps?
A: Remote and unmanaged devices force security teams to rely on context instead of location, and that only works when policy enforcement is uniform.
Q: What are the signs that a zero trust rollout is failing in practice?
A: Common warning signs include overlapping tools that do not integrate well, inconsistent policy enforcement across environments, weak visibility into asset and transaction flows, and users bypassing controls because processes are too cumbersome.
Practitioner guidance
- Standardise zero trust policy decisions Define one access policy model for users, devices, applications, and data so the same risk signal produces the same outcome across office, home, and mobile access.
- Eliminate route-based security exceptions Review VPN, direct internet, and remote access paths for control differences that create inspection or authorization gaps between equivalent sessions.
- Align identity and posture inputs Require identity, device posture, and session context to feed the same enforcement engine rather than separate approval chains.
Bottom line: The article’s core risk is that zero trust can look comprehensive while still behaving inconsistently at the edge.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 hours ago by NHI Mgmt Group
22/09/2026 3:43 pm
Consistency, not point products, is the real zero trust control requirement: once work becomes location-agnostic, the enforcement model has to be location-agnostic too. Separate policy engines naturally create different outcomes for the same user and the same risk signal. That is a governance failure before it is a tooling failure. Practitioners should judge zero trust maturity by policy uniformity, not by the number of controls deployed.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise consistent enforcement or additional zero trust tooling first?
A: Consistent enforcement should come first, because adding more tools on top of inconsistent policy logic usually increases fragmentation. Teams should stabilise the control plane, then decide where more specialised capability is genuinely needed. A zero trust programme that cannot apply the same decision model everywhere is incomplete regardless of feature count.
👉 Read our full editorial: Enterprise edge security needs a consistent zero trust control plane
This post was modified 23 hours ago by NHI Mgmt Group