Topic starter
12/07/2026 12:17 pm
TL;DR: Zero Trust has moved from a niche concept to a broad resilience strategy, with John Kindervag and Chase Cunningham arguing that security graphs now underpin better mapping, prioritisation, and containment, according to Illumio. The practical shift is away from compliance-driven alerting toward attacker-aware control of blast radius and transaction flow.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Zero Trust Has Grown Up. Here’s What Its Founders Say Is Coming Next.”.
Key questions
Q: How should security teams implement Zero Trust when they cannot fully map all transactions yet?
A: Start with the protect surface, not the entire estate.
Q: Why do security graphs improve containment more than alert-driven monitoring?
A: Security graphs improve containment because they show how an attacker can move between systems, which is the information alerting often lacks.
Q: What are the signs that a Zero Trust programme is too abstract?
A: A Zero Trust programme is too abstract when teams can describe policy goals but cannot show the shortest path to critical systems or explain what limits attacker movement.
Practitioner guidance
- Map transaction flows around the protect surface Identify the critical applications, services, and data paths that define your protect surface, then document how users and workloads actually reach them.
- Use graph analysis to find shortest attack paths Model the relationships between identities, services, and network segments so you can see which paths an attacker would likely exploit first.
- Prioritise containment over broad alert accumulation Tune segmentation and enforcement controls to shrink reachable blast radius, especially around high-value services with dense dependencies.
Bottom line: Zero Trust is maturing from a policy story into a containment story, and the practical test is whether teams can show how far an attacker can move after entry.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:31 pm
Security graphs are becoming the practical operating model for Zero Trust. Zero Trust has always been about controlling access paths, but graph-based analysis turns that principle into something defenders can actually reason about. The important shift is from policy intent to observed relationships across identity, workload, and network layers. For practitioners, that means containment planning should start with the path model, not the control catalogue.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations combine AI-driven operations with containment controls?
A: Organisations should keep AI-assisted operations inside tighter blast-radius boundaries than manual work. AI can accelerate change, but it also accelerates mistakes if it can act across too many systems. The safest pattern is to pair automation with identity-aware segmentation so AI outputs do not become unrestricted internal movement.
👉 Read our full editorial: Zero Trust has matured into graph-driven containment strategy