Topic starter
24/06/2026 6:49 pm
TL;DR: Unosecur argues that zero trust in 2025 depends on identity-first controls, with access discovery, phishing-resistant MFA, JIT privilege, machine identity hygiene and ITDR forming the minimum viable path to a 30-day rollout and 90 to 120 day scale-out. The real challenge is making identity governance, telemetry and fallback access work together without legacy environments breaking.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Zero Trust 2025: 30-Day Identity-First MVP (Scale in 90–120)”.
Key questions
Q: How should organisations start a Zero Trust programme when identity data is incomplete?
A: Start with discovery, not enforcement.
Q: Why do standing privileges undermine Zero Trust programmes?
A: Standing privileges undermine Zero Trust because they allow access to exist before it is needed and continue after the work is complete.
Q: What are the signs that a zero trust rollout is failing in practice?
A: Common warning signs include overlapping tools that do not integrate well, inconsistent policy enforcement across environments, weak visibility into asset and transaction flows, and users bypassing controls because processes are too cumbersome.
Practitioner guidance
- Map identity inventory and privilege concentrations Run discovery across IdP, Active Directory, cloud accounts and top SaaS to identify users, groups, roles, contractors, break-glass accounts and non-human identities.
- Replace standing admin access with JIT elevation Convert sensitive administrative tasks to time-bound elevation with strict expiry and step-up authentication.
- Harden authentication with risk-based controls Move admins toward phishing-resistant MFA and passwordless pilots, but preserve controlled fallback methods for legacy and mixed-device estates.
Bottom line: Zero trust in 2025 is framed here as an identity-first programme, with access discovery, step-up authentication, JIT privilege and machine identity governance doing the real work.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- Week-by-week 30-day MVP sequence with day-level priorities for discovery, authentication uplift, privilege reduction and detection
- Specific guidance on where to place fallback authentication and how to handle legacy application exceptions
- Dashboard metrics and KPI framing for identity coverage, privilege reduction and automation progress
- Detailed examples of ITDR signals and low-risk automation actions for identity operations
👉 Read Unosecur's blog on the 30-day identity-first zero trust MVP →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:46 am
Identity-first zero trust only works when identity inventory is trustworthy. A zero trust programme cannot govern what it has not discovered, and the article’s own sequence makes that dependency explicit. Access discovery is not administrative housekeeping; it is the control foundation that lets policy, certification and detection operate on real entitlements rather than assumptions. The practitioner lesson is simple: if inventory is partial, zero trust is only partially governable.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern machine identities differently from human users?
A: Security teams should govern machine identities with lifecycle, context, and runtime controls, not human approval workflows. That means separate ownership, purpose-based entitlement, expiry, and revocation for service accounts, bots, and agents. Human IAM can inform the model, but machine access needs faster review, tighter scoping, and automated enforcement.
👉 Read our full editorial: Zero trust 2025 needs identity-first controls, not perimeter reset