Zero Trust coverage gaps: what IAM teams are missing

TL;DR: Many organisations say they have implemented Zero Trust, but JumpCloud argues that partial coverage across IAM, device trust, network access, PAM, and visibility leaves material gaps. The deeper issue is not whether Zero Trust is adopted, but whether it is enforced consistently across the full access surface.

NHIMG editorial — based on content published by JumpCloud: Where Zero Trust Falls Short and What You Can Do About It

Questions worth separating out

Q: How should security teams implement Zero Trust without creating too many exceptions?

A: Start by mapping where the current programme still trusts users, devices, or services by default.

Q: Why do verified users on unmanaged devices still create serious risk?

A: A verified user on an unmanaged device can still expose the organisation to malware, session theft, or data loss because identity assurance does not guarantee endpoint integrity.

Q: What do teams get wrong about Zero Trust and privileged access?

A: They often treat PAM as a separate admin control instead of a central Zero Trust function.

Practitioner guidance

• Expand MFA beyond admin accounts Enforce MFA across all access points, including routine user access and remote workflows, so the control is not reserved for the highest-risk accounts only.
• Tie access to device posture Require OS version, patch status, encryption, and MDM enrollment checks before sensitive applications or data can be reached from any endpoint.
• Replace broad internal access with app-level policy Move away from network-wide trust and grant only the specific application or service access needed for the session, which reduces lateral movement opportunities.

What's in the full article

JumpCloud's full blog post covers the operational detail this post intentionally leaves for the source:

• A phased Zero Trust roadmap that sequences IAM, device trust, PAM, and monitoring into an implementable programme.
• Specific control examples for conditional access, endpoint posture checks, and privilege revocation across common environments.
• Practical guidance on reducing broad network access and replacing it with application-level enforcement.
• Implementation context for organisations trying to move beyond high-risk-user-only coverage.

👉 Read JumpCloud's analysis of where Zero Trust programs fall short →

Zero Trust coverage gaps: what IAM teams are missing?

Explore further

View Full Forum →  |  NHI Foundation Course →