Notifications
Clear all
Topic starter
12/07/2026 12:23 pm
TL;DR: CISA’s updated Zero Trust Maturity Model now places Identity first, linking least privilege, continuous visibility, and policy automation to practical maturity rather than a destination, according to SentinelOne. That shift makes identity governance the control plane for NHI, human access, and emerging autonomous behaviour, not a side effect of network segmentation.
NHIMG editorial — based on content published by SentinelOne: identity-first zero trust and least privilege maturity
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: Why do service accounts and other NHIs complicate GRC implementation?
A: NHIs complicate GRC because they often outnumber human accounts, change outside normal HR-driven lifecycle processes, and carry access that is easy to overlook in reviews.
Q: Why do static policies undermine zero trust maturity?
A: Static policies assume access conditions stay stable long enough for a one-time decision to remain valid.
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Practitioner guidance
- Map identity first in your zero trust roadmap Inventory all identity types, including users, service accounts, API keys, certificates, and workload identities, then map each to the zero trust pillar it affects most directly.
- Remove static access assumptions from policy design Identify where access is still granted once and trusted indefinitely, then replace that with conditional, continuously evaluated authorization for high-risk paths.
- Tie IAM, PAM, and NHI telemetry together Correlate login events, entitlement changes, token use, and privileged activity so identity abuse can be detected as a control failure rather than a separate alert class.
What's in the full article
SentinelOne's full analysis covers the operational detail this post intentionally leaves for the source:
- Ranger Identity Assessor for AD coverage of vulnerabilities in Active Directory and Azure AD.
- Attack path visualization details for stored or orphaned credentials and misconfigurations at the endpoint layer.
- CIEM-focused entitlement analysis for cloud identities, resources, and overprovisioned access.
- ITDR and endpoint identity detection examples for unauthorized queries and privilege escalation attempts.
👉 Read SentinelOne's analysis of identity-first zero trust and least privilege maturity →
Zero trust identity maturity: are your controls actually keeping up?
Explore further
12/07/2026 12:36 pm
Identity-first zero trust is a governance shift, not a tooling preference. CISA’s updated model is useful because it makes identity the organising principle for least privilege, visibility, and continuous verification. That matters across human IAM, NHI governance, and PAM because access is now the common failure point across all three. Practitioners should read the model as a maturity benchmark for whether identity controls actually govern trust, not as another architecture diagram.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when identity-based access fails in a Zero Trust programme?
A: Accountability sits with the identity, security, and platform owners who control entitlement design, lifecycle governance, and response automation. If service accounts, tokens, or human credentials are outside a clear ownership model, the programme cannot enforce revocation or prove that least privilege is being maintained.
👉 Read our full editorial: Identity-first zero trust is reshaping least privilege maturity
