Topic starter
02/08/2026 12:18 pm
TL;DR: Weak authentication, stolen credentials, and lateral movement remain the main failure points in perimeter-era security, according to Yoti. Zero Trust shifts the control point to verified identity, but the governance challenge is whether organisations can prove who is accessing systems before trust is extended.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “How strong authentication powers Zero Trust and protects against cyber threats”.
Key questions
Q: What breaks when organisations keep using perimeter-era trust assumptions?
A: Trust becomes location-based instead of identity-based, which creates blind spots across remote work, cloud services and connected devices.
Q: Why do stolen credentials remain such an effective attack path?
A: Stolen credentials work because many systems still treat a successful login as enough evidence of legitimacy.
A: Use risk based branching in the login or signup journey so high risk events trigger stronger verification while low risk users move through with minimal friction.
Practitioner guidance
- Harden access around verified identity Require stronger identity proof before granting access to sensitive apps, admin functions and remote sessions.
- Reduce password dependence in high-risk journeys Prioritise passwordless or phishing-resistant authentication for workflows most likely to be targeted by phishing, account takeover and ransomware entry.
- Constrain session trust after sign-in Apply step-up checks, reauthentication triggers and tighter authorisation around sensitive actions so a successful login does not equal open-ended trust.
Bottom line: Zero trust identity controls matter because perimeter trust fails once stolen credentials can impersonate legitimate users inside cloud and remote environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:19 pm
Identity proof is now the control plane for access security: The perimeter has lost analytical value wherever cloud, remote work and third-party access dominate. Once a login can be stolen or replayed, the real control question becomes whether the organisation can verify the subject behind the session before privilege expands. For practitioners, this moves access security from network boundary design to identity assurance design.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations view passwordless as a replacement for Zero Trust controls?
A: No. Passwordless can strengthen the authentication step, but Zero Trust still depends on continuous evaluation of device, user and context. If passwordless is deployed without those surrounding controls, it becomes a better login method rather than a broader trust model.
👉 Read our full editorial: Zero trust identity controls are now foundational for access security