Topic starter
10/07/2026 9:08 pm
TL;DR: Zero Trust identity applies continuous verification to every authentication and authorisation request, and enterprise surveys show 96 percent of organisations now prefer it over VPN while 65 percent plan to retire VPN within twelve months, according to eMudhra. Perimeter-based IAM is no longer the operating model security teams can rely on, because identity has become the trust boundary.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “Zero Trust Identity: Why Perimeter IAM Is Dead in 2026”.
By the numbers:
- 96 percent of organisations now prefer Zero Trust to VPN, according to eMudhra.
- 65 percent plan to retire their VPN within twelve months, according to eMudhra.
Key questions
Q: How should security teams implement zero trust access management across hybrid environments?
A: Start by centralizing identity, authentication, and policy decisions so access is evaluated consistently across cloud, on-prem, and SaaS resources.
Q: Why do perimeter-based IAM models fail in cloud and SaaS environments?
A: They fail because the assumptions behind them no longer hold.
Q: What are the signs that a Zero Trust programme is not being enforced consistently?
A: A Zero Trust programme is likely failing when access still depends on trust by location, broad entitlements, or one-time authentication.
Practitioner guidance
- Replace perimeter assumptions with contextual policy Map every access path that still relies on network location, then require a policy decision based on identity, device, and resource context before granting access.
- Apply the same enforcement model to workloads and users Review service accounts, API-driven access, and workload identities alongside human access so that machine-to-machine traffic is not exempt from Zero Trust policy.
- Demand audit-ready decision evidence Ensure access decisions are logged with enough context to explain why access was granted or denied, especially where policy is dynamic and risk-based.
Bottom line: Perimeter-based IAM no longer matches how cloud, SaaS, remote work, and service access actually operate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
Identity becomes the enforcement boundary when the network stops being trustworthy: Perimeter-based IAM was built for a world in which internal traffic could be treated differently from external traffic. That assumption no longer survives cloud, SaaS, remote work, or machine-to-machine access patterns. The implication is that IAM architecture must be designed around policy decisions at the point of access, not around where the request originates.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What is the difference between zero trust and identity as the perimeter?
A: Zero trust is the broader security model that assumes every request must be continuously verified. Identity as the perimeter is the implementation approach that makes identity, context, and policy the control point for access decisions. In practice, identity becomes the mechanism that enforces zero trust across cloud and hybrid environments, especially when users and workloads move constantly.
👉 Read our full editorial: Zero Trust identity is replacing perimeter-based IAM