Topic starter
11/08/2026 3:14 pm
TL;DR: AI has not changed the fundamentals of security, but instead reinforces Zero Trust, according to Illumio. John Kindervag frames the core issue as organisations doing it wrong rather than Zero Trust being broken, and the message is that containment, blast-radius reduction, and resilience remain the practical controls that determine whether breaches spread.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Zero Trust Isn’t Broken. Most Companies Just Do IT Wrong.”.
Key questions
Q: What fails in a zero trust programme when containment is missing?
A: Zero trust fails when teams stop at verification and never define what a compromised identity is allowed to reach.
Q: Why does blast radius matter more than authentication alone?
A: Because authentication answers only whether access was granted, while blast radius shows how much damage that access can cause once abused.
Q: What are the signs that containment controls are failing in a modern environment?
A: The warning signs are broad lateral movement paths, shared admin accounts, persistent service credentials, and critical systems that sit close to routine user or developer environments.
Practitioner guidance
- Define blast radius as a control objective Measure how far a compromised identity, token, or workload can move across production systems, then set reduction targets for the highest-risk paths.
- Map lateral movement paths for NHIs Identify service accounts, APIs, and automation credentials that can reach multiple environments, and prioritise the ones with the widest reachable scope.
- Constrain post-authentication reach Use segmentation and privilege scoping so that successful authentication does not translate into broad east-west movement or uncontrolled workload access.
Bottom line: Zero trust programmes fail when they stop at access verification and do not limit how far a compromised identity can travel.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
11/08/2026 3:28 pm
Containment is the missing control plane in many zero trust programmes. Organisations often adopt authentication and policy language without building the operational boundary that limits what a compromised identity can actually do. That leaves the environment vulnerable to spread even when the front door is technically guarded. The practical conclusion is that zero trust must be judged by containment outcomes, not implementation labels.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: How should security teams prepare for autonomous AI attacks that move at machine speed?
A: Security teams should map the full AI attack surface, including data pipelines, agent orchestration, APIs, identities, and third-party dependencies. They should test complete attack paths, not isolated controls, and validate that detection and response can run continuously outside business hours. Clear authorization boundaries are also essential so autonomous actions that exceed policy can be stopped or reviewed.
👉 Read our full editorial: Zero Trust still fails when teams ignore containment and blast radius
This post was modified 17 hours ago by NHI Mgmt Group