Notifications
Clear all
Topic starter
22/06/2026 3:14 pm
TL;DR: Identity centric ZTNA shifts access decisions from static passwords and perimeter trust to continuous verification, adaptive policies, and least privilege across remote work, cloud, third-party, and device contexts, according to Whiteswan Security. The security model matters because traditional IAM assumptions break down when access must be re-evaluated in real time across users, devices, and applications.
NHIMG editorial — based on content published by Whiteswan Security: Identity centric ZTNA and the evolution of endpoint security
By the numbers:
- The escalating frequency of data compromises, breaches, leaks, and exposures in 2022 affected over 422 million individuals in the United States alone.
- The same year saw 1,802 data compromises in the United States.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams implement identity centric ZTNA in hybrid environments?
A: Start by defining the resources that should be app-scoped, then tie access to identity, device posture, and session context.
Q: Why do traditional VPN and perimeter models fail for modern access control?
A: They assume that once a user is inside the network, trust can be broad and durable.
Q: When should organisations prioritise ZTNA over broader network access models?
A: Prioritise it when remote work, third-party connectivity, or cloud application use makes broad network access too risky to sustain.
Practitioner guidance
- Separate user identity from device trust decisions Define which signals are required for session approval, then validate whether device posture can be re-checked during the session rather than only at sign-in.
- Limit remote access to specific applications Replace broad network-level access with app-scoped entitlements so that a successful login does not expose adjacent internal resources.
- Review third-party and contractor access lifecycles Make sure external users are offboarded promptly, recertified on schedule, and removed from stale access paths that ZTNA would otherwise continue to permit.
What's in the full article
Whiteswan Security's full article covers the operational detail this post intentionally leaves for the source:
- The comparative breakdown of ZTNA versus on-premises firewall VPN behaviour across access control, scalability, and compliance.
- The article's application examples for remote access, cloud connectivity, third-party vendor access, microservices, and IoT device security.
- The platform framing around Zero Standing Privileges and how that changes secure access design in practice.
- The vendor's own discussion of user experience, performance, and network complexity trade-offs in hybrid environments.
👉 Read Whiteswan Security's analysis of identity centric ZTNA for hybrid access →
Identity centric ZTNA for hybrid work: are your controls keeping up?
Explore further
22/06/2026 3:16 pm
Identity centric ZTNA is an access-control model, not a complete identity programme. It can reduce trust in the network path, but it does not automatically solve entitlement sprawl, contractor offboarding, or privileged access governance. The practical lesson is that ZTNA strengthens enforcement only when IAM, PAM, and lifecycle controls are already coherent.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between ZTNA and zero standing privilege?
A: ZTNA controls how access is granted and routed during a session, while zero standing privilege removes persistent access that would otherwise exist before the session starts. They are complementary, not interchangeable. ZTNA can narrow exposure, but ZSP removes standing entitlement that ZTNA alone cannot eliminate.
👉 Read our full editorial: Identity centric ZTNA is reshaping access control for hybrid work
