Topic starter
07/06/2026 8:33 pm
TL;DR: Zero Trust access management has moved from network perimeter thinking to identity-centric control, with Okta arguing that secure identity, continuous verification, and context-aware access are now the core starting points for hybrid work, cloud adoption, and distributed access models. That shift exposes the limits of static trust assumptions: initial authentication is not enough when sessions last for hours or days and risk changes mid-session.
Editorial analysis by NHI Mgmt Group, based on content published by Okta: “Getting Started with Zero Trust Access Management Trust Begins with Secure Identity”.
Key questions
Q: How should security teams implement zero trust access management across hybrid environments?
A: Start by centralizing identity, authentication, and policy decisions so access is evaluated consistently across cloud, on-prem, and SaaS resources.
Q: Why do long-lived sessions create a zero trust gap?
A: Because the initial authentication decision quickly becomes stale when device posture, location, or risk changes after login.
Q: What breaks when non-human identities have standing access in a Zero Trust model?
A: Standing access breaks the core Zero Trust assumption that each request is explicitly evaluated.
Practitioner guidance
- Consolidate identity into a single access policy plane Bring users, contractors, partners, and suppliers under a governed IAM layer so access decisions are consistent across cloud and on-prem resources.
- Implement continuous session checks Use risk signals from device posture, location, and user state to reassess active sessions and trigger re-authentication or termination when conditions change.
- Extend zero trust to non-human identities Inventory service accounts, APIs, and infrastructure identities, then align their authentication and lifecycle controls with the same access governance used for people.
Bottom line: Zero trust access management only becomes operational when identity, context, and session state are governed together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/06/2026 10:29 pm
Identity is the control plane, not an adjacent control. Zero trust access management only works when identity is the primary trust anchor for people, workloads, and service access. Perimeter tools can still reduce exposure, but they cannot decide whether a session should continue when risk changes mid-session. Practitioners should treat identity policy as the place where zero trust becomes enforceable.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations prioritise continuous authentication over broader access redesign?
A: When login sessions are long-lived, users move across devices, or risk can change after authentication. In those conditions, a full redesign may take time, but continuous authentication provides immediate risk reduction by making active sessions responsive to new signals. It is especially valuable where shared devices, mobile apps, or remote work make static trust assumptions weak.
👉 Read our full editorial: Zero trust access management still starts with secure identity