Topic starter
11/07/2026 1:58 pm
TL;DR: The NSA’s Zero Trust Implementation Guidelines translate Zero Trust into 91 measurable activities across discovery, identity, segmentation, visibility, and automation, while the article says 88% of CISOs still struggle to implement it and 90% of security leaders see it as central to security posture, according to Zero Networks. The real issue is not Zero Trust intent, but the gap between policy language and enforceable operational controls.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “Implementing Zero Trust: How to Operationalize NSA Guidelines”.
By the numbers:
- The NSA’s Zero Trust Implementation Guidelines cover 91 activities across five modular phases.
- 88% of CISOs have experienced significant challenges in their Zero Trust implementation attempts.
Key questions
Q: What breaks when Zero Trust only covers login and privileged access?
A: Security gaps remain in applications, cloud services, and machine identities that are not subject to the same verification discipline.
Q: Why does Zero Trust adoption stall even when organisations agree with the model?
A: Adoption often stalls because the easiest option is to do nothing.
Q: What are the signs that a zero trust rollout is failing in practice?
A: Common warning signs include overlapping tools that do not integrate well, inconsistent policy enforcement across environments, weak visibility into asset and transaction flows, and users bypassing controls because processes are too cumbersome.
Practitioner guidance
- Tie identity to network enforcement Move privileged and sensitive internal access decisions to enforcement points that evaluate identity, device and context together instead of only at login.
- Remove implicit internal trust Default-deny east-west traffic and explicitly approve internal communications that are required for business function, including system-to-system flows.
- Automate segmentation policy lifecycle Use automation to keep segmentation boundaries and access rules aligned with live traffic patterns so policy does not drift as systems change.
Bottom line: Zero Trust is still failing in many organisations because the architecture is not being enforced where access is actually used.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:08 pm
Zero Trust fails when organisations confuse adoption with enforcement: The article shows that broad agreement on Zero Trust does not solve the operational gap between architecture language and implementable controls. That gap is visible whenever identity and network policy remain separate, because internal trust still exists even when the perimeter has been modernised. Practitioners should treat Zero Trust as an enforcement model, not an intent statement.
A few things that frame the scale:
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should organisations prioritise identity governance before micro-segmentation in Zero Trust?
A: In most hybrid and cloud-first environments, yes. Identity governance addresses who gets access and whether that access still makes sense, while segmentation mainly constrains where traffic can go. If the underlying identity model is weak, segmentation often just contains bad access rather than preventing it.
👉 Read our full editorial: NSA Zero Trust guidelines expose the operational gap in ZT