Topic starter
12/07/2026 12:15 pm
TL;DR: Zero Trust replaces implicit network trust with continuous verification, least privilege, and containment, and the article argues that 90% of organisations still struggle to operationalise it while attackers continue moving laterally after a foothold, according to Zero Networks. The governance problem is not the idea of Zero Trust, but the gap between architectural intent and enforceable identity, network, and workload controls.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “What Is Zero Trust Security? A Practical Guide for Modern Defenders”.
Key questions
Q: What breaks when Zero Trust is applied only at the perimeter and not to the connection itself?
A: Perimeter-only Zero Trust leaves internal traffic and service-to-service calls too exposed.
Q: Should organisations prioritise identity governance before micro-segmentation in Zero Trust?
A: In most hybrid and cloud-first environments, yes.
Q: What are the signs that privileged access controls are too weak in a Zero Trust program?
A: Common warning signs include excessive privilege, unrestricted access that never expires, weak monitoring of privileged activity, and inconsistent enforcement of authentication checks.
Practitioner guidance
- Map policy to enforcement points Inventory where access is actually allowed, denied, or narrowed across identity providers, network controls, and workload layers.
- Remove standing access from high-risk paths Prioritise privileged users, service accounts, admin interfaces, and east-west connections that remain open outside the exact task window.
- Separate external access from internal containment Treat remote access controls and internal segmentation as different enforcement problems.
Bottom line: Zero Trust fails when organisations stop at policy and never convert least privilege into enforceable access and containment controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:29 pm
Policy without enforcement is not Zero Trust, it is documentation. The article is right to separate the philosophy from the architecture, because a written least-privilege model does not change attacker movement by itself. What matters is whether identity, device, network, and workload controls enforce the policy at the point of access. Practitioners should judge Zero Trust by containment outcomes, not by whether the policy exists.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What should teams do when a Zero Trust programme still allows lateral movement?
A: They should treat the problem as an enforcement gap, not a branding issue. The immediate focus should be the paths that remain open after authentication, because those are the routes attackers use to escalate and reach high-value assets.
👉 Read our full editorial: Zero trust security exposes the gap between policy and enforcement