Topic starter
10/07/2026 9:10 pm
TL;DR: Zero Trust ROI is shifting from detection counts to business continuity metrics, according to Zero Networks, as boards demand evidence that security spend reduces blast radius, constrains lateral movement, and improves containment during attacks. The metric that matters most is whether controls preserve uptime under pressure, not whether they increase activity scores.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “How to Measure Cyber Resilience: Zero Trust ROI”.
By the numbers:
- A single compromised system can enable access to 85% of the environment within one hop.
- The mean time to contain a breach is 60 days, on top of the 181 days it takes to detect a breach in the first place.
Key questions
Q: What breaks when Zero Trust is measured only with detection metrics?
A: Detection metrics can show that tooling is busy, but they do not prove that an attacker could not spread, disrupt services, or reach critical assets.
Q: Why do standing privileges undermine Zero Trust programmes?
A: Standing privileges undermine Zero Trust because they allow access to exist before it is needed and continue after the work is complete.
Q: How can security teams tell whether Zero Trust is actually reducing business risk?
A: They should look for shrinking attack paths, lower lateral movement opportunity, faster containment, and better uptime during incidents.
Practitioner guidance
- Define resilience metrics around attack path reduction Measure how many authenticated steps and network segments separate common ingress points from critical assets, then track whether that distance grows over time.
- Map privileged and service access to critical assets Identify standing privilege, over-scoped service accounts, and cached credentials that allow lateral movement to high-value systems without fresh verification.
- Use business impact analysis to set containment priorities Rank assets by regulatory, revenue, financial, customer, and reputational exposure so control enforcement reflects real continuity risk.
Bottom line: Zero Trust only becomes a resilience strategy when it limits how far an attacker can move after the first foothold.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:34 pm
Blast-radius control is becoming the real proof point for Zero Trust. The article is right to move away from activity metrics and toward operational containment, because board value only materialises when a breach cannot spread. Identity controls, microsegmentation, and explicit verification are now judged by how much damage they prevent, not by how many policies they enforce. Practitioners should treat blast radius as a governance outcome, not a network diagram.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What is the difference between blast radius and lateral movement pathways?
A: Blast radius is the amount of damage a compromise can cause, while lateral movement pathways are the specific internal routes that let an attacker extend access. You can think of pathways as the mechanism and blast radius as the outcome. Both matter, but reducing pathways is one of the most direct ways to shrink blast radius.
👉 Read our full editorial: Zero trust ROI is shifting toward measurable cyber resilience