Zero trust adoption: what practitioners need to do about the execution gap

TL;DR: Zero trust is now viewed as essential by 82% of organisations, yet only 17% have fully implemented it, while tool and vendor sprawl remains the top barrier and 78% of organisations manage secure-access policies across more than two systems, according to Ordr 2026 third-party data. The gap is no longer conceptual; governance, consolidation, and enforcement at the control layer now determine whether zero trust changes outcomes.

Editorial analysis by NHI Mgmt Group, based on content published by Ordr: “Zero Trust Statistics 2026 Report”.

By the numbers:

• 82% of organizations consider universal zero-trust network access essential, but only 17% have fully implemented it.
• Tool and vendor sprawl is the top barrier to zero trust adoption, cited by 26% of organizations.
• 78% of organizations manage secure-access policies across more than two separate systems.

Key questions

Q: What breaks when zero trust policies are split across multiple tools?

A: Zero trust breaks down when policy decisions are fragmented across different consoles because enforcement becomes inconsistent, auditability weakens, and exceptions multiply.

Q: Why do excessive permissions create so much risk in Zero Trust programmes?

A: Excessive permissions expand the number of paths an attacker can use after the first compromise.

Q: How do organisations know if zero trust controls are actually working?

A: They know the controls are working when they can inventory privileged identities, prove access is time-bound, and show that rotation and revocation happen on schedule.

Practitioner guidance

• Consolidate access policy ownership Assign one operating owner for access policy across IAM, PAM, ZTNA, and segmentation controls so that changes propagate consistently.
• Prioritise third-party access first Use contractors, suppliers, and external partners as the first rollout group because their access paths are usually easier to isolate and measure.
• Reduce duplicate enforcement points Inventory every system that can approve or enforce access and retire redundant policy logic that creates conflicting decisions.

Bottom line: Zero trust is now widely accepted, but many organisations still lack the control coherence needed to enforce it consistently across real access paths.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →